Last updated: August 15, 2026 · By Vishal Swami, Founder & Lead AI Reviewer, AISagely
Google is making private AI practical with a new open-source compiler called HEIR. It takes a normal, trained AI model and turns it into one that can run inference directly on encrypted data, without ever decrypting your input. Google’s security blog laid out the details on August 14, 2026, and the code backing the announcement is public on GitHub, not just described in a press release. The model computing on your data never sees the raw values — not the input, not the intermediate steps, and not the output. Only you, holding the private key, can decrypt the final result. That is the actual claim being tested here, and it now has working demos behind it.
Short answer: Google's HEIR compiler converts pre-trained AI models — written in Python or TensorFlow — so they run on fully homomorphically encrypted (FHE) data instead of plain text. The server doing the computing never decrypts the input or the output. Google has shown four working demos, including fraud and intrusion detection, built with partners like Belfort Labs and Niobium. HEIR is free and open source on GitHub.
I spend most of my time testing AI products against their marketing claims. "Your data is never seen by us" is one of the most abused lines in the industry. So when Google published a technical, code-backed post about computing on encrypted data — not just encrypting it in transit — I wanted to check what's real. What's still a research demo, and what would it take for a normal developer to actually use this?
What you'll need
You do not need a cryptography background to follow this. You do need to know the problem HEIR solves. Standard encryption protects data in transit and at rest. But the moment a server needs to compute on that data — run a model, run a query — it typically has to decrypt it first. That decrypted moment is where breaches and insider risk happen. Fully homomorphic encryption (FHE) removes that step. Computation happens directly on ciphertext, and nothing gets decrypted along the way.
To actually use HEIR yourself, you'd need a few things. First, a pre-trained model in Python, PyTorch, or TensorFlow. Second, comfort with Bazel or Python packaging, since HEIR ships as both a Bazel toolchain and a heir_py package. Third, patience: FHE inference is still ten to a few thousand times slower than plain-text inference, depending on the workload. This is a developer tool. It is not a consumer feature you'll find in a Gemini settings menu yet.
Step-by-step: what Google actually built
1. Understand the Private Computing Toolkit HEIR fits into
HEIR isn't a standalone project. It's the newest addition to Google's Private Computing Toolkit. That toolkit already includes differential privacy, private set membership, private information retrieval, and secure enclaves on Google Cloud. HEIR is the piece that handles "compute without decrypting."
2. See what HEIR compiles
HEIR takes a model written for plain text — a normal PyTorch or TensorFlow model, or Python code — and rewrites it to operate over ciphertext. It targets FHE libraries like OpenFHE, Lattigo, and tfhe-rs. It also targets hardware backends, including GPUs, TPUs, and custom ASICs from partners like Cornami and Optalysys. It's built on MLIR, the same compiler infrastructure underneath TensorFlow and JAX.
3. Check the working demos
Google and its partners compiled four real applications with HEIR. A deep learning recommendation model, built with Belfort Labs, LG, and NYU. Credit card fraud detection, with Niobium and hardshell.ai. Network intrusion detection using the Kitsune anomaly detector, with Niobium. And a hotword detector for audio-triggered AI agents, with Belfort Labs. These aren't toy benchmarks. Fraud detection and intrusion detection are exactly the workloads where a bank or a security vendor cannot afford to see raw customer data.
4. Know the actual cost: speed
In my read of Google's published numbers, FHE inference on a single CPU thread is still much slower than plain text. Google's own post frames this as a tradeoff engineers accept on purpose, not something HEIR fully hides. Hardware accelerators — GPU, TPU, FPGA, ASIC — are the path Google and its silicon partners are betting on to close that gap. Software alone won't do it.
5. Try it yourself if you're a developer
HEIR is Apache-2.0 licensed and live on GitHub at google/heir, with 790 stars and 152 forks as of this writing. You can install heir_py from PyPI after setting up OpenFHE. Or build from source with Bazel, using bazel build //tools:heir-opt. Full docs and tutorials are at heir.dev.
Example prompts you can copy
These help you reason through whether FHE is relevant to something you're building, using Gemini, Claude, or ChatGPT:
- Sanity-check the fit: "I'm building [describe your app] and it handles [type of sensitive data]. Would fully homomorphic encryption via a tool like Google's HEIR compiler realistically fit this workload, or is that overkill for what I'm doing?"
- Compare privacy techniques: "Explain the practical difference between differential privacy, secure enclaves, and fully homomorphic encryption for protecting user data an AI model needs to process. When would I pick each one?"
- Translate the announcement: "Explain Google's HEIR homomorphic encryption compiler in plain English: what problem does it solve, what does it cost in terms of speed, and who should actually be using it today?"
- Estimate the tradeoff: "If FHE inference is roughly 10x to several thousand times slower than plaintext inference depending on the model, what kinds of AI workloads can tolerate that today and which ones can't?"
Common mistakes to avoid
In my testing of privacy-adjacent AI claims generally, the first mistake is mixing up "encrypted in transit" with "computed on while encrypted." Most companies claiming "we never see your data" mean the first, weaker claim. HEIR is one of the few concrete examples of the second, harder claim actually shipping in code.
Second, don't assume this is production-ready for your average SaaS app tomorrow. Four demos with named research partners is a strong signal of real progress. It is not evidence that FHE is now as fast as normal inference. It isn't, by a wide margin, and Google says so directly.
Third, don't assume HEIR itself is a hosted product you can just call via an API. It's a compiler and toolchain you integrate into your own model pipeline. That means real engineering time before you get an encrypted inference endpoint out the other side.
Fourth, watch for vendors borrowing "homomorphic encryption" as a buzzword. Google backed its claim with benchmarks, named partners, and open code. If a company can't point to working demos or a public repo, treat the claim skeptically.
Homomorphic encryption vs. other privacy approaches Google uses
| Technique | Data ever decrypted server-side? | Speed vs. plaintext | Where Google uses it |
|---|---|---|---|
| Standard TLS encryption | Yes, to compute | Native speed | Almost everywhere (baseline) |
| Differential privacy | Yes, but noise is added to outputs | Native speed | Aggregate analytics, Chrome usage stats |
| Secure enclaves | Yes, inside a hardware-isolated boundary | Near-native | Google Cloud Confidential Computing |
| Fully homomorphic encryption (HEIR) | No — computation happens on ciphertext | 10x–1000x+ slower, workload-dependent | Fraud/intrusion detection demos, recommendation models |
Figures per Google's August 14, 2026 security blog post and the google/heir GitHub repository.
Tools that make sense of AI privacy claims
If you're trying to figure out how much of Google's AI security messaging to trust, my breakdown of Google fixing more Chrome bugs in June using AI covers a similar pattern. It's a specific, code-backed claim that held up under scrutiny. For a look at what happens when AI training data isn't protected at all, scanning 7.6 petabytes of Hugging Face training data for secrets shows the scale of the problem HEIR-style approaches are trying to prevent. If you want to experiment with Google's AI stack directly, how to use Google AI Studio is the fastest on-ramp. For the broader question of when an AI capability claim is genuinely as good as it sounds, why AI reasoning is sometimes right for the wrong reasons is a useful companion read. My AI tool ratings hub tracks vendor claims like this over time, rather than taking any single announcement at face value. And if you're weighing whether new AI infrastructure investments actually translate into real-world gains, the AI productivity illusion is worth reading alongside it.
My take
This is a genuinely rare case in AI privacy marketing. A company published open-source code, named academic and industry partners, and working demos, instead of a vague "privacy-first" slogan. HEIR doesn't make FHE fast — Google isn't claiming that. But it makes FHE usable by developers who aren't cryptography researchers. That's the real bottleneck this field has had for years. The honest caveat is the same one Google gives: this is still meaningfully slower than plain-text computation, and hardware accelerators are doing a lot of the work to make it viable at all. For most developers, this isn't something to adopt this quarter. For anyone building in fraud detection, healthcare, or finance — where regulation already limits what raw data you're allowed to see — HEIR is worth tracking closely. It's one of the first credible paths to computing on data without ever holding it.
Frequently Asked Questions
Is HEIR free?
Yes. HEIR is fully open source under the Apache-2.0 license, available now at github.com/google/heir. There's no paid tier — it's a compiler toolchain you install and integrate yourself, not a hosted Google Cloud product with usage-based pricing.
How long does it take to get a model running on HEIR?
That depends heavily on the model and your familiarity with Bazel or Python packaging. Google's own demos — fraud detection, intrusion detection, a recommendation model, and a hotword detector — took research and industry partners months to build, not hours. For a solo developer testing a small model, expect a real setup investment. You'll install OpenFHE or another backend, compile with HEIR, then test the encrypted inference speed against your latency budget. It will be slower than you expect.
What's the easiest way to try this?
Start by reading the docs and tutorials at heir.dev rather than diving straight into the compiler. If you're not a developer, the easiest way to understand this is to read Google's original post and treat it as infrastructure news — this isn't a feature you'll toggle on in a consumer AI product yet.
Does homomorphic encryption make AI models slower?
Yes, substantially. Google's post is explicit that fully homomorphic encryption carries a real performance cost compared to plaintext computation, which is why hardware accelerators from partners like Cornami and Optalysys are a core part of the effort — software compilation alone doesn't close the gap.
Is this the same as end-to-end encryption?
No. End-to-end encryption protects data in transit so only the sender and receiver can read it, but a server still has to decrypt it to compute anything meaningful. Homomorphic encryption lets a server run a computation — like an AI model's inference — on data that stays encrypted the entire time, including during the computation itself.