Google HEIR for Homomorphic Encryption and Private AI
On this page
Quick answer
HEIR is Google’s open-source, MLIR-based compiler toolchain for homomorphic encryption. It helps translate selected computations into code for backends such as OpenFHE, Lattigo, tfhe-rs, and Jaxite so a server can evaluate supported functions over encrypted inputs.
HEIR is not a managed private-AI service, a drop-in wrapper for every pretrained model, or an officially supported Google product. Use it as compiler infrastructure inside a separately designed cryptographic and production system.
What homomorphic encryption changes
Ordinary encryption protects data at rest or in transit but usually requires decryption before computation. Homomorphic encryption allows specific computation directly over ciphertext. The evaluator receives encrypted inputs and produces an encrypted output without holding the client’s decryption key.
That can shift a privacy decision for workloads such as recommendations, fraud detection, network-traffic analysis, or hotword detection. Google showcased HEIR-compiled examples in each category and reported their latency on a single-threaded CPU.
Those examples demonstrate feasible compiled applications. They do not prove that another model, dataset, parameter set, threat model, latency target, or deployment will meet its requirements.
Where HEIR fits
| Layer | Responsibility |
|---|---|
| Frontend or input IR | Express the supported computation and mark secret values |
| HEIR passes | Lower and optimize the program through MLIR dialects |
| Scheme selection | Choose semantics such as BGV, BFV, CKKS, or CGGI where supported |
| Backend code generation | Emit integration code for a supported cryptographic library |
| Application harness | Generate keys, encrypt inputs, evaluate, decrypt outputs, and handle errors |
| Production system | Own identity, transport, metadata, access, monitoring, retention, recovery, and support |
The official repository currently lists OpenFHE and Lattigo for BGV, BFV, and CKKS; tfhe-rs and Jaxite for CGGI. Backend support is not scheme interchangeability: numeric semantics, approximation, parameter selection, performance, generated APIs, language, and integration differ.
Read the OpenFHE and Lattigo workflow guide before selecting a path.
The pretrained-model boundary
Google’s announcement says HEIR can convert pretrained AI models that operate on plaintext to operate on encrypted inputs. Its stated vision is a one-click path for encrypted inference.
The current getting-started documentation is narrower. It says the team is still working on an end-to-end binary for workflows such as converting a precompiled Torch model to a specific backend. Today’s documented paths use the broader heir-opt and heir-translate tools, rules_heir, or the Python package under current backend constraints.
Treat “one click” as product direction, not present general availability. Validate the exact model import, supported operations, approximation error, cryptographic parameters, generated code, and integration path you plan to use.
What HEIR does not secure by itself
Homomorphic evaluation does not automatically hide:
- request timing, size, endpoint, or traffic patterns;
- the model, generated code, deployment configuration, or logs;
- plaintext before encryption or after decryption;
- keys on the client and any key-management workflow;
- access decisions, output release, or downstream actions;
- vulnerabilities in the compiler, backend library, harness, or application.
Define the precise data and threat boundary. If the output itself reveals sensitive information, encrypted computation does not make that output safe to release.
Use the production limitations guide and encrypted-inference readiness check before moving beyond a reproducible evaluation.
Frequently asked questions
What is Google HEIR?
HEIR, or Homomorphic Encryption Intermediate Representation, is an open-source MLIR-based compiler toolchain for lowering selected computations to homomorphic-encryption backends.
Does HEIR let a server compute on encrypted data?
That is the core homomorphic-encryption model: a service evaluates a supported computation over ciphertext and returns an encrypted result. The complete application’s keys, metadata, endpoints, code, and surrounding systems still need separate protection.
Is HEIR an officially supported Google product?
No. The official google/heir repository explicitly says HEIR is not an officially supported Google product.
Official sources
- Google Security Blog: Making private AI practical with homomorphic encryption
- Google HEIR repository
- HEIR documentation
Source check: August 19, 2026. Recheck repository, documentation, schemes, backends, frontends, examples, licenses, security guidance, and support status before adoption.