Google’s HEIR explores AI inference over encrypted inputs

Google showcased a HEIR update on August 14, 2026. This August 16 report explains its central idea for developers: performing computations over encrypted data without revealing the original inputs to the server doing the work.

HEIR is an open-source compiler project first introduced in 2023. The news concerns its progress and application examples, rather than the creation of an entirely new project.

Encryption during computation

Fully Homomorphic Encryption, or FHE, allows operations on encrypted data with encrypted results returned. The aim is to avoid requiring the computing system to see the inputs in clear form.

HEIR seeks to simplify converting programs to this execution model. Google says it can transform pre-trained models to operate on encrypted inputs.

The important design question is who actually needs to see the information. In this approach, being able to perform a calculation is separated from being able to read the original content.

That offers a different way to define the trust boundary between the data owner and the processing provider. Understanding the boundary still requires a precise description of what is being protected, rather than a broad label such as “private application”.

Demonstrations have a defined scope

The update presents examples including content recommendations and hotword detection. Google acknowledges computational overhead and describes easier adoption by non-specialists as a project goal.

A working example consequently does not establish that every application can be converted into a ready-to-run service with one click. Model choice, response time and operating cost need to be evaluated against the application’s requirements.

Proving that a computation is possible and establishing that it suits a particular service are separate milestones. A promising result on a bounded task can be valuable while leaving further questions about resources and the user experience at scale.

What should a development team evaluate?

Our assessment is that HEIR provides an important avenue for research and privacy-focused services. Starting with a narrowly defined task makes the trade-offs easier to measure than attempting to move an entire system at once.

A team could specify the inputs to protect, the acceptable result and the practical waiting-time limit before comparing an implementation with those requirements. This is a suggested evaluation method, rather than a test we performed.

Privacy, result correctness and service responsiveness remain distinct criteria. Progress on one does not replace checking the others. Reading the demonstrations within their stated scope therefore gives developers a more useful picture than generalising them to every AI workload.

Sources

• Google Security — HEIR update, 14 August 2026
• Google Developers — earlier HEIR announcement, 10 August 2023
• HEIR — project overview