On 2026-08-14 I published an article on the Google Security blog with an update on HEIR, our homomorphic encryption (HE) compiler. This companion article has no limits on word count or jargon, so I can be honest. HEIR converts an input program to one that operates directly on encrypted data, ensuring the computer running it gets no information about the cleartext data.

The blog post focuses on HEIR's ability to compile pre-trained ML models, giving four examples of small but nontrivial models. This enables perfectly private inference. I'll discuss when this is useful later. First, I want to give a concrete sense of how HEIR works and outline the project's roadmap.

The simplest example is the credit card fraud detector, a three-layer feed-forward network with sigmoid activations. Running it on encrypted inputs took about 2 seconds on a single-threaded CPU, compared to 0.5 ms for cleartext, a 4,000x slowdown. The computation involves two matrix-vector products and two sigmoid evaluations.

There are many caveats to this demo worth briefly mentioning, but the core point is that HEIR can compile these models, and the performance, while slow, is a starting point for further optimization.