Contents
Google published a deep dive this week on HEIR, the compiler project it has been building since 2023 to make fully homomorphic encryption (FHE) usable by ordinary application developers instead of only cryptography researchers. The pitch is simple to state and hard to build: take a model that runs on plaintext data, run it through a compiler, and get out a version that computes correct answers on encrypted inputs without ever decrypting them along the way.
That matters because privacy and product features have historically been in tension. End-to-end encryption protects user data from breaches, but it also blocks the service provider from doing anything useful with that data, spam filtering, fraud detection, personalized recommendations. The usual workaround is to push computation onto the user’s device, which only works if the device has the horsepower and if the provider is comfortable shipping its model, and its intellectual property, into every user’s hands. Homomorphic encryption sidesteps both constraints by letting the server compute directly on ciphertext.
Three things worth understanding
HEIR compiles existing models rather than requiring a rewrite. Built on MLIR, the same compiler infrastructure underneath much of Google’s ML tooling, HEIR takes a program written in Python, lets the developer annotate which variables are secret, and handles the transformation into FHE-compatible operations automatically. That is the difference between “cryptography team required” and “add a type annotation,” and it is the actual bottleneck HEIR is trying to remove. Manually hand-converting a model to run under FHE has, until now, needed a team of cryptographers per project.
The four demo applications show this working past toy examples. Google compiled a deep learning recommendation model with Belfort Labs, LG, and NYU that serves content recommendations without seeing the user’s feature vector, a credit card fraud detector with Niobium and hardshell.ai, an encrypted-traffic anomaly detector (the Kitsune system) with Niobium, and a hotword detector with Belfort Labs that could let a voice assistant recognize a wake word without the audio ever being visible in the clear. All four run today on single-threaded CPU, with the source published in Google’s fully-homomorphic-encryption GitHub repository.
Hardware acceleration is the next unlock, and it is already lined up. FHE’s biggest practical cost has always been the compute overhead of doing math on ciphertext instead of plaintext. Google has partnered with four companies building homomorphic encryption accelerators, Belfort, Niobium, Cornami, and Optalysys, and says latency benchmarks against that hardware are coming. HEIR has also picked up academic collaborators at Georgia Tech, CMU, UC Santa Barbara, Purdue, Edinburgh, and Tsinghua, with four peer-reviewed papers already built on top of it.
Try it: additive homomorphism, live
The core trick that makes any of this possible is that certain encryption schemes let you operate on ciphertexts and get a ciphertext of the correct combined result, without ever seeing the plaintext. Here is a toy version of additive homomorphism you can run yourself: two numbers get “encrypted” with a shared secret offset, added together while still encrypted, and decrypted only at the end.
About the demo
This is a simplified additive scheme for illustration (encrypt by adding a random mask, decrypt by subtracting it), not the lattice-based cryptography HEIR actually compiles to. It demonstrates the property, not the security.Enter two numbers and click the button.
Where this leaves application developers
The interesting claim in Google’s writeup is not that FHE is fast now, it still carries real overhead and today’s demos run single-threaded on CPU, but that the engineering cost of adopting it is collapsing. When applying homomorphic encryption to a model means annotating a Python function instead of hiring a cryptography team, the calculus for regulated industries, healthcare and finance especially, shifts from “theoretically possible” to “worth prototyping this quarter.” My take is that HEIR’s real bet is the same one every good compiler makes: hide the hard math behind a boundary ordinary engineers can reason about, and let hardware acceleration close the remaining performance gap over the next few years. If you build anything that touches sensitive user data and has been avoiding a cloud-side ML feature because of it, HEIR’s GitHub repo and its four worked examples are worth an afternoon to see whether your use case fits.