Google Announces HEIR, Compiler for Encrypted AI Model Computation

On August 19, 2026, Google announced “HEIR,” an open-source compiler for AI models based on Fully Homomorphic Encryption (FHE). This is a toolchain that compiles Python code for trained AI models and converts it to enable inference processing on encrypted data without decryption. According to reporting by Publickey’s Jniino, it is explained that HEIR will allow cloud vendors and service providers to offer AI services while maintaining security and privacy.

Basics of Fully Homomorphic Encryption and

HEIR’s Position

Fully Homomorphic Encryption is a technology that allows computations to be performed on encrypted data, with the results remaining encrypted. With traditional encryption, data had to be decrypted for every operation and then re-encrypted afterward. By introducing FHE, AI models on the cloud can utilize encrypted data directly for learning and inference without ever decrypting the user’s confidential data. HEIR was developed as a compiler to make the practical implementation of FHE easier.

HEIR takes code for an AI model written by a programmer in Python as input and uses annotations to specify which data should be treated as secrets. During compilation, HEIR automatically handles the conversion to FHE-compatible logic. This allows developers to build privacy-aware AI systems without needing to directly implement complex encryption algorithms. Google expects HEIR to serve as a straightforward starting point for application developers to realize privacy-focused software.

Four Demonstrated Use Cases and Application

Possibilities

Google has introduced four collaborative research projects as current application examples of HEIR. The first is a collaboration with Belfort Labs, LG, and New York University on encrypting recommendation processing using deep learning. The second is an application to credit card fraud detection in joint research with Niobium and hardshell.ai. The third is a joint project with Niobium that compiled the existing intrusion detection system “Kitsune” with HEIR to enable anomaly detection on encrypted network traffic. The fourth is a joint project with Belfort Labs developing a detector for “hot words” that trigger an AI agent.

These examples indicate that HEIR’s development is progressing based on concrete use cases, not merely as a technical demonstration. In fields like credit card fraud detection and intrusion detection, where transaction data and network traffic are inherently confidential, protection via FHE holds significant importance. Even for recommendation processing, the ability to utilize user behavior history without decrypting it can greatly reduce privacy concerns.

Development Challenges and Prospects for

Industry Standards

HEIR is still in the development stage, and FHE’s inherent performance challenges remain. Fully homomorphic encryption incurs very high computational costs; operations on encrypted data take significantly longer compared to working with plaintext data. Implementing complex AI models, especially large language models, with FHE could make inference speed and resource consumption prohibitive for practical service delivery. It is anticipated that Google will continue to work on optimizing HEIR’s performance and validating practical applications.

Google has stated its goal for HEIR to become the industry-standard compiler for FHE. Compilers and toolchains for handling FHE are still diverse, and a unified standard has not yet been established. Google’s influence and its open-source development approach position HEIR as a potential foundation for widespread adoption. Amid growing industry interest in privacy-preserving technologies, the trajectory of HEIR will likely influence the future design of cloud AI services.

Editorial Opinion

In the short term, the announcement of HEIR could accelerate the development of privacy-preserving AI cloud services. Particularly in fields handling sensitive data like healthcare and finance, the practicality of FHE-based processing will begin to be validated, potentially leading to the creation of new service models. It is expected that cloud providers other than Google will also move to develop FHE-compatible tools, leading to intensified technological competition. In the long term, it is believed that the maturation of tools like HEIR will make it easier to comply with data privacy regulations. As strict regulations like GDPR and personal data protection laws advance, FHE will support a paradigm shift from the traditional model of “entrusting data to users” to a new one of “delegating computation without handling the data directly.” This could fundamentally redesign data flows while simultaneously increasing the reliability of AI services.

There is a point that is difficult to verify here. It concerns the practical operational challenge of whether AI inference using FHE can be delivered cost-effectively in a cloud environment while maintaining accuracy comparable to traditional methods.

References

• “Google、AIモデルをコンパイルして暗号データを復号せずに扱えるように変換する「HEIR」発表。完全準同型暗号を利用し、AIでのセキュリティやプライバシー保護など実現へ”, by jniino — Publickey, 2026-08-18T15:55:25.000Z (ARR)
• Source URL: https://www.publickey1.jp/blog/26/googleaiheirai.html