Google Unveils HEIR: A Compiler for Private AI on Encrypted Data

Google has introduced HEIR (Homomorphic Encryption Intermediate Representation) — an open-source compiler that makes cryptographically secure neural network inference possible. The project is the latest addition to the company's Private Computing Toolkit and tackles a long-standing dilemma of digital privacy.

The problem

Ordinary end-to-end encryption protects data from leaks, but at the same time it strips the provider of any ability to work with it: you can neither filter out spam nor detect a virus without “peeking” inside the contents. This is especially acute in healthcare and finance, where data sharing is tightly regulated. On-device processing is no cure-all either — it runs up against the limits of the device's power, while sending a proprietary model to the client risks leaking the model itself.

How homomorphic encryption works

Homomorphic encryption makes it possible to perform computations directly on encrypted data: the server processes the ciphertexts and returns an encrypted result, never once seeing the original information. This way, a cloud service can deliver content recommendations without knowing the user's preferences. According to Google, this is not just theory — one of the demonstrations does exactly that.

The technology carries noticeable overhead, but, as the authors note, the question of privacy turns into a question of cost — and the cost of homomorphic computation is falling fast. Unlike hardware-based solutions, the guarantees here are purely cryptographic. The main difficulty lies elsewhere: rewriting a program for homomorphic encryption by hand is a task only a team of cryptographers can manage.

What HEIR does

This is precisely the problem the compiler takes on. HEIR can turn pretrained models that work with plaintext data into models that operate on encrypted inputs. Google's goal is to bring the solution down to a “single button,” so that encrypted inference can be adopted even by non-specialists.

Since the statement of intent back in 2023, a community has formed around the project. Google is collaborating with developers of hardware accelerators — Belfort, Niobium, Cornami and Optalysys — while research on top of HEIR is being carried out at Georgia Tech, Carnegie Mellon, UC Santa Barbara, Purdue, the University of Edinburgh, Tsinghua University and others. Four peer-reviewed publications have already been built on the platform.

Four demonstrations

Google has showcased four private-inference applications compiled through HEIR (latency measurements are given for a single-threaded CPU, and the sources are available on GitHub):

• a deep-learning recommendation model — in collaboration with Belfort Labs, LG and New York University;
• a bank card fraud detector — with Niobium and hardshell.ai;
• Kitsune, a network-traffic anomaly detection system that catches threats without revealing packet contents;
• a keyword spotter that lets a voice agent respond to commands without giving away the audio recording itself.

The Google team says it aims to make homomorphic encryption easy to develop with, fast to run and ubiquitous across the industry.

Source: Hacker News