# HEIR

> An MLIR-based compiler toolchain that rewrites a program or model so it runs on homomorphically encrypted data, targeting OpenFHE, Lattigo, tfhe-rs and Jaxite

- Category: Evaluation & Production Ops / Guardrails & Security
- Language: MLIR
- Licence: Apache-2.0
- Repository: https://github.com/google/heir
- Website: https://heir.dev
- Canonical page: https://ai-tldr.dev/tools/heir/
- Updated: 2026-08-14

## In short

HEIR (Homomorphic Encryption Intermediate Representation) is an MLIR-based toolchain for building homomorphic-encryption compilers. It sits in the Guardrails & Security category of the Evaluation & Production Ops tools and is open-source, written in MLIR and licensed Apache-2.0. To get started: install the Python package.

## Overview

HEIR (Homomorphic Encryption Intermediate Representation) is an MLIR-based toolchain for building homomorphic-encryption compilers. Homomorphic encryption lets a server compute on data it cannot read: the input arrives encrypted, the arithmetic happens on ciphertext, and only the client holding the key can decrypt the result. Writing that arithmetic by hand is the hard part — schemes such as BGV, BFV, CKKS and CGGI each have their own noise budgets, packing tricks and parameter choices. HEIR takes an ordinary program and lowers it through a series of MLIR dialects into code for one of those schemes, so the encryption expertise lives in the compiler instead of in your application.

The project sits on top of the MLIR compiler infrastructure from LLVM, and emits code for several backend libraries: OpenFHE and Lattigo cover the BGV, BFV and CKKS schemes, while tfhe-rs and Jaxite cover CGGI. There are three documented ways to use it — Bazel with the `rules_heir` module, the `heir_py` Python package on top of an OpenFHE install, or building from source and driving the `heir-opt` and `heir-translate` binaries yourself, then integrating the generated backend code into your own project.

HEIR is developed in the open with a monthly community meeting, weekly office hours and a `#heir` channel on the FHE.org Discord, and its design is described in the arXiv paper "HEIR: A Universal Compiler for Homomorphic Encryption". The repository carries a disclaimer that it is not an officially supported Google product, so treat it as a research-grade toolchain rather than a managed service.

## What it does

- Compiles programs down to homomorphic-encryption arithmetic through a stack of MLIR dialects, so scheme-specific detail stays in the compiler
- Backends for OpenFHE and Lattigo (BGV, BFV, CKKS) plus tfhe-rs and Jaxite (CGGI)
- Three entry points: Bazel via rules_heir, the heir-py Python package, or the heir-opt / heir-translate binaries built from source
- Built on MLIR, so passes and dialects compose with the wider LLVM compiler ecosystem
- Open development: monthly meetings, weekly office hours, labelled good-first-issues and a research-synthesis track for porting new FHE papers

## Getting started

The quickest path is the Python package on top of an OpenFHE install; the fullest is a source build with Bazel. HEIR depends on LLVM from source, so a clean build can take around 30 minutes.

1. Install the Python package

   Install OpenFHE first, then the heir-py package from PyPI. The Getting Started guide at heir.dev walks through the prerequisites.

```bash
pip install heir-py
```

2. Build the compiler from source

   The project uses Bazel. Install bazelisk to manage the Bazel version automatically, then build the main pass-running tool.

```bash
bazel build //tools:heir-opt
```

3. Run an end-to-end test

   The repository ships end-to-end examples per backend and scheme — this one exercises the Halevi-Shoup matrix-vector product on OpenFHE CKKS.

```bash
bazel test //tests/Examples/openfhe/ckks/halevi_shoup_matvec:all
```

4. Speed up clean builds

   Because HEIR builds LLVM from source, the docs recommend remote caching with BuildBuddy — add your API key to .bazelrc.user in the workspace root to cut a clean build to roughly five minutes.

```text
common --remote_header=x-buildbuddy-api-key=<YOUR_API_KEY>
common --config=remote
```

## When to use it

- Run inference for a trained model on inputs the server is never allowed to decrypt, such as medical or financial records
- Prototype a privacy-preserving feature — fraud scoring, recommendations, intrusion detection — without hand-writing scheme-level ciphertext arithmetic
- Compare the same computation across FHE schemes and backend libraries by retargeting the compiler instead of rewriting the code
- Port a technique from a new FHE paper into a reusable compiler pass rather than a one-off implementation

## Version history

- 2026-08-14: Google presented HEIR as its open-source compiler for running trained AI models on homomorphically encrypted inputs, published alongside four demo applications: recommendations, card fraud, intrusion detection and hotword spotting.