Google Showcases HEIR, an Encrypted-AI Compiler, With Four Private-Inference Demos

Google is showcasing HEIR, an open-source compiler toolchain that converts pretrained AI models built for ordinary data to operate on encrypted inputs. The project aims to let a provider produce an AI result without accessing the underlying user data.

The trade-off behind encrypted inference

Google describes a tension in conventional data protection. End-to-end encryption can protect information from breaches, but it can also stop a service from performing functions that require examining it, such as spam or virus detection. Processing data locally avoids sending it to a provider, but device capacity can be limited and sending proprietary models to devices can risk exposing them.

Homomorphic encryption permits computation directly on ciphertext, meaning encrypted data, with an encrypted result returned to the user. Google says this would allow a recommendation service to use a person’s features without learning them, although the technique still carries a nontrivial cost overhead.

From specialist work to a compiler layer

Manually adapting an existing program for homomorphic encryption efficiently requires cryptography expertise, Google says. HEIR, short for Homomorphic Encryption Intermediate Representation, is designed to take on part of that conversion: it changes pretrained models that work on unencrypted data so they can accept encrypted inputs.

Four demonstrations define the present scope

Google compiled four private-inference applications with HEIR and presented latency figures for a single-threaded CPU. Source code for all four examples is available in the project’s GitHub repository.

• A content-recommendation model developed with Belfort Labs, LG and New York University.
• A credit-card fraud detector developed with Niobium and hardshell.ai.
• Kitsune-based anomaly detection for encrypted network traffic, intended to identify anomalies without exposing packet contents to the provider.
• A hotword detector that Google says could recognize hotwords while protecting audio recordings.

Hardware latency is the next proof point

Google says it has partnered with homomorphic-encryption accelerator companies Belfort, Niobium, Cornami and Optalysys. It plans to demonstrate the accelerators’ latency benefits in the future; those results will be the more relevant performance evidence beyond the CPU demonstrations.

HEIR also serves as a research platform. Google says four peer-reviewed publications had been built on it by the August 14 announcement, alongside collaborations with universities including Georgia Tech, Carnegie Mellon and Purdue.