Google HEIR Production Readiness and Limitations
On this page
Quick answer
HEIR can be a serious compiler component for encrypted computation, but production readiness is not a project-wide property you inherit from the repository or Google’s demos. The current documentation still has testing-only binaries and incomplete end-to-end paths, while the repository disclaims official Google product support.
Advance only when the exact program, scheme, parameters, backend, generated code, accuracy, latency, keys, threat model, operations, and support plan pass your own review.
Current maturity boundaries
The official records establish several limits:
- the team is still working on an end-to-end binary for workflows such as converting precompiled Torch models to a selected backend;
- current general paths use
heir-opt,heir-translate,rules_heir, orheir_py; - nightly binaries are intended for compiler-pass testing, not production;
- Python currently requires a separately installed OpenFHE;
- Python backends other than OpenFHE remain in progress;
- C and C++ input-language support is described as experimental at best in the getting-started example;
google/heiris not an officially supported Google product.
These facts do not mean HEIR cannot be used in production. They mean the adopting team owns qualification, pinning, patch response, operational support, and recovery.
Eight production gates
| Gate | Evidence to require |
|---|---|
| Program | Exact model or function, supported operations, shapes, secret annotations, and plaintext oracle |
| Cryptography | Scheme rationale, security level, parameters, noise/error budget, key roles, and expert review |
| Toolchain | Pinned HEIR commit/release, backend, rules, compiler, platform, generated code, SBOM, and licenses |
| Accuracy | Representative and boundary fixtures with application-specific error acceptance |
| Performance | Encryption, serialization, transfer, evaluation, decryption, throughput, memory, and tail latency |
| Keys | Generation, custody, rotation, backup, loss, compromise, multi-tenant isolation, and deletion |
| Application | Authentication, authorization, replay, output release, metadata, logs, quotas, and abuse response |
| Operations | Canary, observability, rollback, incident owner, dependency patches, support, and exit plan |
Demo performance versus service performance
Google’s announcement publishes four HEIR-compiled applications and identifies the measurements as single-threaded CPU latency. That is useful evidence for those implementations, not a service-level promise.
Measure end to end:
- input preparation and encryption on the client;
- ciphertext size and network transfer;
- server deserialization and evaluation;
- output transfer and decryption;
- application validation and downstream action;
- concurrency, memory, cold starts, retries, and p95/p99 behavior.
If an accelerator is part of the plan, require results on the exact accessible hardware and software release. A planned accelerator demonstration is not current deployable evidence.
Security and privacy acceptance
Write the threat model before tuning performance. Identify which party owns keys, which inputs are encrypted, what the evaluator can infer from metadata and output, and what happens at plaintext endpoints.
Require independent cryptographic review of parameter selection and the full protocol. Compiler correctness tests, backend test suites, repository badges, and peer-reviewed work are useful but do not validate your integration or output-release policy.
Include dependency provenance and generated-code review. A compiler can faithfully generate code for an unsafe application design, and a correct encrypted computation can still release a sensitive result to the wrong party.
Start with the HEIR overview, review the OpenFHE and Lattigo workflow, and use the homomorphic-encryption AI readiness check before a pilot.
Frequently asked questions
Is Google HEIR production ready?
HEIR is usable open-source compiler infrastructure, but production readiness is workload-specific. Current documentation marks nightly binaries as testing-only, describes unfinished end-to-end workflows, and the repository says HEIR is not an officially supported Google product.
Do Google’s HEIR demos prove my latency target?
No. Google reports example latency on a single-threaded CPU for specific applications. Reproduce the exact model, circuit, parameters, hardware, traffic, serialization, encryption, evaluation, and decryption path for your workload.
Does homomorphic encryption protect the entire application?
No. It protects selected computation over ciphertext under a defined cryptographic model. Keys, plaintext endpoints, metadata, logs, access, outputs, dependencies, generated code, and operations need separate controls.
Official sources
Source check: August 19, 2026. Recheck maturity, packages, backends, frontends, schemes, binaries, security guidance, examples, issues, licenses, and support status before production approval.