Google open-sourced HEIR, a compiler for running AI on data it never sees
Google shipped HEIR on August 14, an open-source compiler that turns ordinary programs into ones that run on encrypted data. Homomorphic encryption has been the cryptography world's most tantalizing party trick for fifteen years: compute on ciphertext, get back a result you can decrypt, and the server never sees a single input. The catch was always that writing an FHE program required a cryptographer. HEIR is Google saying that part should be the compiler's job.
They announced the intent back in 2023 and this is the delivery. Four compiled applications shipped as demonstrations, all on single-threaded CPU, which is the number that matters because it means nobody is hiding the cost behind a cluster. A deep learning recommendation model built with Belfort Labs, LG and NYU. Credit card fraud detection with Niobium and hardshell.ai. Threat intrusion detection using Kitsune, also with Niobium. And a hotword detector with Belfort Labs, which is the one to imagine hardest, because it means the always-listening microphone in your house could in principle run its wake-word check without the audio ever being legible to the vendor.
Why this belongs in an agents feed: the single biggest thing keeping agents out of hospitals, banks and law firms is not capability, it is that running an agent over the data requires shipping the data. Every enterprise deployment argument in 2026 eventually collapses into that sentence. On-prem inference is the current workaround and it is expensive and it caps you at whatever model you can host. Encrypted inference is the other answer, and it has been ten years from useful for ten years. A compiler plus four working demos plus hardware partners is what the beginning of the end of that looks like.
Sober framing: FHE is still orders of magnitude slower than plaintext compute, and nothing here says you will be running an agent loop under encryption next quarter. What changed is the tooling floor. Google partnered with accelerator builders Belfort, Niobium, Cornami and Optalysys, and with Georgia Tech, CMU and UC Santa Barbara, and four peer-reviewed papers already build on HEIR.
Source is on GitHub, writeup at blog.google under the security section.
← Back to all articles
They announced the intent back in 2023 and this is the delivery. Four compiled applications shipped as demonstrations, all on single-threaded CPU, which is the number that matters because it means nobody is hiding the cost behind a cluster. A deep learning recommendation model built with Belfort Labs, LG and NYU. Credit card fraud detection with Niobium and hardshell.ai. Threat intrusion detection using Kitsune, also with Niobium. And a hotword detector with Belfort Labs, which is the one to imagine hardest, because it means the always-listening microphone in your house could in principle run its wake-word check without the audio ever being legible to the vendor.
Why this belongs in an agents feed: the single biggest thing keeping agents out of hospitals, banks and law firms is not capability, it is that running an agent over the data requires shipping the data. Every enterprise deployment argument in 2026 eventually collapses into that sentence. On-prem inference is the current workaround and it is expensive and it caps you at whatever model you can host. Encrypted inference is the other answer, and it has been ten years from useful for ten years. A compiler plus four working demos plus hardware partners is what the beginning of the end of that looks like.
Sober framing: FHE is still orders of magnitude slower than plaintext compute, and nothing here says you will be running an agent loop under encryption next quarter. What changed is the tooling floor. Google partnered with accelerator builders Belfort, Niobium, Cornami and Optalysys, and with Georgia Tech, CMU and UC Santa Barbara, and four peer-reviewed papers already build on HEIR.
Source is on GitHub, writeup at blog.google under the security section.
Comments