The privacy problem is simple. The engineering is not

Many AI services need a person to send sensitive information to a remote system. Medical notes, financial patterns and private audio all become useful inputs only after they leave the device. Standard encryption protects them on the journey and at rest, but normally not while a server is working with them.

Fully homomorphic encryption, usually shortened to FHE, tries to change that. It lets a computer perform certain calculations on encrypted data. The result can then be decrypted by the person or organisation that holds the key. The server can do the work without seeing the original input.

The catch is cost. FHE has long been technically impressive and practically awkward. Converting a real program is specialist work, and encrypted computation can be far slower and more expensive than the ordinary version. That is the gap Google’s HEIR project is trying to narrow.

What HEIR is

Google describes HEIR as an open-source compiler toolchain and development platform for homomorphic encryption. Its full name is Homomorphic Encryption Intermediate Representation. The project is maintained by Google and its public code is released under the Apache 2.0 licence.

In plain terms, the project aims to take a high-level program, mark some inputs as secret, and compile an encrypted equivalent. The project documentation says it supports modern FHE schemes, several back ends and work on hardware accelerators. It also describes Python and Torch among the intended front ends.

That does not mean an ordinary model can be switched to encrypted inference with a single button today. Google calls that its vision. A compiler can make the work more approachable, but it cannot erase the mathematical and hardware trade-offs underneath it.

Four demos, not four finished markets

Google’s announcement points to four applications compiled with HEIR: a recommendation model, credit-card fraud detection, encrypted network-traffic anomaly detection and a hotword detector. The company says the examples show how a provider could process useful signals without seeing the underlying recommendation features, transactions, packet contents or audio recording.

The examples make the case more concrete than a cryptography paper alone. They are still demonstrations. Google says its latency numbers are for a single-threaded CPU, and it says it plans to show the effect of hardware accelerators in future work. That is a useful limit to keep in view when thinking about scale.

A workload that tolerates a delay, handles a narrow model and has unusually sensitive data may be a good early fit. A large interactive assistant that needs cheap, rapid responses is a different problem. The article does not provide a general performance comparison across model sizes or cloud costs.

Why this matters beyond one compiler

Private AI discussions often fall into a false choice. Either data stays entirely local, or it goes to a cloud service that can read it. FHE offers another option in principle: a remote system can contribute compute without seeing the values it is computing over.

That matters most where the value of a model and the sensitivity of the input are both high. Healthcare, finance and security are obvious examples, but not automatic ones. An organisation still has to decide who holds keys, what the system logs, how it handles outputs and whether the privacy benefit is worth the operational burden.

HEIR is not proof that private cloud AI has been solved. It is evidence that the tooling is becoming less confined to cryptography teams. That is a quieter development than a new consumer model. It may be more consequential for certain systems.

What is confirmed, what Google says, and what is open

Confirmed: Google published its HEIR update on 14 August 2026. HEIR has public documentation and source code, and the project describes itself as a compiler toolchain for fully homomorphic encryption. Google’s repository carries an Apache 2.0 licence.

Google’s claims: HEIR can help convert pre-trained AI models that work on ordinary data into models that operate on encrypted inputs. Google says its four demos show private-inference applications and that hardware accelerators should improve latency in future demonstrations.

Open questions: the cost and latency for larger models, the performance on real production hardware, the engineering burden for teams outside specialist groups, and which kinds of deployment deliver a meaningful privacy benefit once key management, outputs and logs are included.

Sources

  1. Google Security Blog — How Google is making private AI practical with homomorphic encryptionPrimary Google announcement, published 14 August 2026. Source for the HEIR update, the four demonstration applications and Google’s statements about latency and future accelerator work.
  2. HEIR documentation and Google’s public FHE repositoryPrimary project documentation. Source for HEIR’s role as an FHE compiler toolchain, its stated goals and Google maintenance. The linked public repository documents the Apache 2.0 licence.