Google HEIR OpenFHE and Lattigo Compiler Workflow
On this page
Quick answer
HEIR currently offers three practical entry paths:
- Bazel and
rules_heirfor generated OpenFHE or Lattigo libraries inside a reproducible build; heir_pyand a local OpenFHE install for a Python-authored evaluation path;- source build plus
heir-optandheir-translatefor direct control over lowering and backend code generation.
Choose from the integration language, supported scheme, build ownership, generated-code review, cryptographic expertise, and production support you actually have—not from the shortest demo.
Workflow comparison
| Path | Current use | Key boundary |
|---|---|---|
Bazel + rules_heir | Generate an OpenFHE C++ or Lattigo Go library and integrate it into a Bazel project | Own module versions, compiler flags, scheme parameters, generated API, and tests |
heir_py | Compile supported Python functions to an OpenFHE-backed flow | OpenFHE must be installed locally; other Python backends are still in progress |
| Direct tools | Run heir-opt passes and heir-translate code generation yourself | Maximum control also means maximum responsibility for pass order and integration |
| Nightly binaries | Inspect or test compiler passes quickly | Documentation says not for production |
The current docs say an end-to-end binary for some pretrained-model conversions remains work in progress. Do not design around a binary that the documented release does not yet provide.
Bazel and rules_heir
The documented rules_heir path connects an MLIR source program, HEIR compiler flags, a scheme, and a backend macro. For example, the Lattigo workflow can annotate the module for Lattigo and CKKS, lower MLIR to CKKS, and generate a Go library and test harness.
A production evaluation should pin:
rules_heir, HEIR, backend, compiler, language, and Bazel versions;- input IR and secret annotations;
- exact scheme and parameter-generation inputs;
- generated encrypt, evaluate, decrypt, and configuration APIs;
- expected plaintext result and permitted numeric error;
- known-good, boundary, malformed, and adversarial fixtures.
Passing a dot-product example proves the toolchain is connected. It does not prove the scheme parameters or error budget are safe for another circuit.
Python and OpenFHE
The heir_py package includes heir-opt and heir-translate binaries and optional frontend/backend components. The documented Python example defaults to BGV with OpenFHE and offers a convenient encrypt-run-decrypt flow for testing.
The convenience wrapper does not remove native dependencies. HEIR says users must install OpenFHE directly because generated code is compiled and linked against the system-specific installation. Non-OpenFHE Python backend support is currently in progress.
Record the OpenFHE build configuration, compiler, ABI, OpenMP choice, platform, package hashes, generated code, and deployment target. A notebook that works on one machine is not a portable artifact until those facts are reproducible.
Direct lowering and translation
The direct workflow runs heir-opt to lower the selected program and heir-translate to emit backend code. It exposes the compiler pipeline and generated types, parameter setup, encryption helpers, evaluation operations, and decryption helpers for inspection.
Review the generated code as a dependency:
- pin the source commit and toolchain;
- archive the input IR and flags;
- inspect generated code and build output;
- compare decrypted results with a plaintext oracle;
- test numeric precision and failure behavior;
- benchmark encryption, transfer, evaluation, and decryption separately;
- run cryptographic and application security review.
The HEIR production limitations guide covers the gaps between a reproducible compiler demo and an operated private-inference service. Use the readiness check to capture one workload’s decision record.
Frequently asked questions
How can I use HEIR today?
The official repository lists three paths: Bazel with rules_heir and OpenFHE or Lattigo, heir_py with a local OpenFHE installation, or building HEIR and invoking heir-opt and heir-translate directly.
Does heir_py include OpenFHE?
No. The getting-started guide says the user must install OpenFHE directly because the Python frontend compiles generated C++ and links it against the local OpenFHE installation.
Can I use the HEIR nightly binaries in production?
No. HEIR documentation says the nightly binaries are intended for testing compiler passes and not for production use.
Official sources
Source check: August 19, 2026. Recheck setup instructions, tool names, package extras, backend and scheme support, build requirements, release status, and examples before implementation.