HEIR is free and open source under the Apache-2.0 license, with the code on GitHub at github.com/google/heir. There is no paid tier and no sign-up. Google frames HEIR as a research and development platform as much as a product, and the repository runs monthly meetings, weekly office hours and public GitHub discussions that anyone can join.

Do I need to be a cryptography expert to use HEIR?

Google's stated goal for HEIR is that you do not. The documented entry point is to write a normal program in Python, annotate which types hold secret values, and let HEIR compile everything else. Google says its vision is to make HEIR a one-click solution so non-experts can add encrypted inference to production applications, though that vision is not finished yet.

How fast is encrypted inference with HEIR today?

The latency figures Google published for the HEIR demos come from a single-threaded CPU, so they are a floor rather than a best case. Google says it plans to show the speed benefits of dedicated hardware in the near future, working with accelerator partners Belfort Labs, Niobium, Cornami and Optalysys. No historical speed comparison is given in the post.

What has actually been built with HEIR so far?

Google showed four private inference applications compiled with HEIR: a deep learning recommendation model with Belfort Labs, LG and NYU; credit card fraud detection with Niobium and hardshell.ai; network intrusion detection using the Kitsune system with Niobium; and a hotword detector with Belfort Labs. Four peer-reviewed publications have also been built on HEIR.

How does HEIR fit with Google's other privacy tools?

HEIR is the newest addition to Google's Private Computing Toolkit, which already covers differential privacy, private set membership, private information retrieval and secure enclaves. Those techniques protect data in different ways; homomorphic encryption is the one that lets a server compute on data it can never read, which is why Google positions HEIR as the piece that unlocks private AI inference.

Google · 2026-08-14 · major

HEIR — Google's compiler runs AI models on encrypted data

HEIR is Google's open-source compiler that turns a pre-trained AI model into one that runs on encrypted inputs, without decrypting them. Google shipped four demo apps: recommendations, card fraud, intrusion detection and hotword spotting.

Google's HEIR compiler takes a normal trained model and rebuilds it to run on data the server can never read.

Quick facts

Maker	Google
What it is	Open-source compiler for homomorphic encryption
Built on	MLIR
HE schemes	BGV, BFV, CKKS
Backends	OpenFHE, Lattigo
License	Apache-2.0
Demo apps	4 (recommendations, card fraud, intrusion detection, hotword)

What is it?

HEIR (Homomorphic Encryption Intermediate Representation) is an open-source compiler toolchain that converts pre-trained AI models so they operate on encrypted inputs instead of plain ones. Google announced it on 14 August 2026 as the newest piece of its Private Computing Toolkit. Alongside the announcement Google published four working private inference demos built with the compiler.

How does it work?

Homomorphic encryption lets a computation run directly on encrypted data, so the server returns an encrypted answer it was never able to read. The compiler behind that trick is built on MLIR, and it supports the BGV, BFV and CKKS schemes across the OpenFHE and Lattigo backend libraries. The developer-facing path is a Python one: write the program, mark which types are secret, and HEIR compiles the rest.

Why does it matter?

Encrypted inference has been possible for years but has needed a cryptographer to hand-tune each application, which is why almost nobody shipped it. By moving that expertise into a compiler, HEIR lowers the entry cost for teams that want to run a model on data they are not allowed to see — health records, payment streams, private audio. The four demos show the shape of that: fraud scoring and intrusion detection on traffic the server cannot inspect.

Who is it for?

privacy engineers, ML infrastructure teams, cryptography researchers

Frequently asked questions

Is HEIR free to use?: HEIR is free and open source under the Apache-2.0 license, with the code on GitHub at github.com/google/heir. There is no paid tier and no sign-up. Google frames HEIR as a research and development platform as much as a product, and the repository runs monthly meetings, weekly office hours and public GitHub discussions that anyone can join.
Do I need to be a cryptography expert to use HEIR?: Google's stated goal for HEIR is that you do not. The documented entry point is to write a normal program in Python, annotate which types hold secret values, and let HEIR compile everything else. Google says its vision is to make HEIR a one-click solution so non-experts can add encrypted inference to production applications, though that vision is not finished yet.
How fast is encrypted inference with HEIR today?: The latency figures Google published for the HEIR demos come from a single-threaded CPU, so they are a floor rather than a best case. Google says it plans to show the speed benefits of dedicated hardware in the near future, working with accelerator partners Belfort Labs, Niobium, Cornami and Optalysys. No historical speed comparison is given in the post.
What has actually been built with HEIR so far?: Google showed four private inference applications compiled with HEIR: a deep learning recommendation model with Belfort Labs, LG and NYU; credit card fraud detection with Niobium and hardshell.ai; network intrusion detection using the Kitsune system with Niobium; and a hotword detector with Belfort Labs. Four peer-reviewed publications have also been built on HEIR.
How does HEIR fit with Google's other privacy tools?: HEIR is the newest addition to Google's Private Computing Toolkit, which already covers differential privacy, private set membership, private information retrieval and secure enclaves. Those techniques protect data in different ways; homomorphic encryption is the one that lets a server compute on data it can never read, which is why Google positions HEIR as the piece that unlocks private AI inference.

Try it

Start at https://heir.dev or clone github.com/google/heir