Analysis · Google Security Blog ·

Google expands HEIR toolkit for encrypted AI inference

Google highlighted new progress on HEIR, its open-source compiler that lets AI models run inference on encrypted data, including a hotword detector that never sees the raw recording.

Based on reporting by Google Security Blog — analysis by dalili

Google's security team highlighted new progress on HEIR, the Homomorphic Encryption Intermediate Representation, an open-source compiler toolchain first introduced in 2023 that lets developers convert existing AI models into versions that run inference directly on encrypted data. Fully homomorphic encryption allows computation on data without ever decrypting it, so a service provider can process a request without being able to see the underlying content at any point.

Among the examples Google detailed is a hotword detector built with Belfort Labs, which lets an audio-triggered AI agent recognize a wake word while the underlying audio recording itself stays encrypted throughout the entire process. The broader goal is to close a long-standing gap in privacy tools: standard end-to-end encryption protects data from breaches but also blocks a service from running features that depend on reading that data, such as spam or malware detection, an especially sharp trade-off in regulated sectors like healthcare and finance where strict rules limit data sharing between institutions.

HEIR is built on MLIR, the same multi-level compiler infrastructure used across major machine learning frameworks, and supports multiple homomorphic encryption schemes and backends including OpenFHE and Lattigo, with code generation for GPUs, TPUs, and custom hardware accelerators. As AI systems increasingly process sensitive personal and enterprise data, Google is positioning HEIR as infrastructure for developers, hardware designers, and cryptography researchers to build production-strength privacy-preserving software without each team having to solve the underlying cryptography from scratch.

Key takeaways

  • Google highlighted new progress on HEIR, an open-source compiler that lets AI models run inference directly on encrypted data without ever decrypting it
  • A hotword detector built with Belfort Labs recognizes wake words while the underlying audio recording stays encrypted throughout
  • HEIR is built on MLIR and supports multiple encryption schemes with code generation for GPUs, TPUs, and custom hardware

Why it matters

As AI assistants listen to more of daily life, a compiler that lets a wake-word detector or spam filter work without ever seeing the raw data addresses one of the field's sharpest tensions: useful AI features usually require reading personal data, and this line of research is aimed at removing that requirement entirely.