[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-google-heir-compiler-encrypted-ai-inference":3,"news-related-a91067a3-4fa4-4e88-a25a-18ba3bea21ea":38},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"a91067a3-4fa4-4e88-a25a-18ba3bea21ea","Google 把\"加密推理\"摆上桌面：HEIR 编译器让预训练模型在密文上直接跑","Google 开源了 HEIR 编译器——这是第一个把预训练 AI 模型自动改造成\"在加密数据上跑推理\"的工具。同态加密让云端可以在完全看不到明文的前提下完成模型推理。HEIR 已发布四个参考实现,覆盖推荐系统、信用卡反欺诈、Kitsune 网络入侵检测、热词唤醒。Google 与 Belfort、Niobium、Cornami、Optalysys 四家硬件加速厂商共建,Georgia Tech、CMU、UCSB、清华等学术界共同推动。这是 AI 隐私计算从\"实验室级\"迈向\"产品级\"的关键一步。","# Google 把\"加密推理\"摆上桌面：HEIR 编译器让预训练模型在密文上直接跑\n\n8月14日,Google 在官方安全博客上发布了 **HEIR（Homomorphic Encryption Intermediate Representation）** ——这是第一个面向 AI 推理场景的开源同态加密（FHE）编译器。它的目标很明确：让任何**预训练好的模型都能直接改写成\"在加密数据上跑\"的版本,云端服务器从头到尾看不到明文**。作者 Jeremy Kun 是 Google 资深软件工程师,HEIR 的 GitHub 仓库（google\u002Fheir）同步开源。\n\n## 一句话讲清楚 HEIR 解决什么问题\n\n过去要把一个神经网络跑在密文上,你需要一支密码学家队伍,花几个月把每一层手写翻译成同态加密运算。HEIR 想把这件事变成\"一键完成\":开发者用 Python 写程序,把要保密的字段标出来,HEIR 自动编译出加密版本。换句话说,它把同态加密从研究员的\"手工活\"变成工程团队的\"现成工具\"。\n\n## HEIR 已经能跑的四个参考实现\n\nGoogle 这次不是只发一个编译器,还配套发了四个真实业务模型,全部编译成功并跑通：\n\n1. **深度学习推荐模型**：和 Belfort Labs、LG、纽约大学合作。服务商可以给用户推内容,却完全看不到用户的特征向量。\n2. **信用卡反欺诈检测**：和 Niobium、hardshell.ai 合作。银行可以把交易数据加密后送给第三方风控模型,泄露面只剩加密文本。\n3. **网络入侵检测（Kitsune 系统）**：和 Niobium 合作。能在不暴露原始网络包内容的前提下检测异常流量。\n4. **热词唤醒模型**：和 Belfort Labs 合作。音频智能体可以在不知道音频里说了什么的情况下识别\"嘿 Siri\"那类触发词。\n\n四个案例都跑在单线程 CPU 上,延迟数据已开源。Google 强调这只是个开始——他们正和 Belfort、Niobium、Cornami、Optalysys 四家厂商做 HE 专用硬件加速,延迟还会进一步下降。\n\n## 为什么这件事比看起来重要\n\n同态加密在 AI 场景里是个\"理论上完美、实际上没人用\"的技术。它的能力很诱人——**服务器在密文上算,结果也是密的,只有用户能解密**——但代价是性能开销大、迁移成本高,所以一直停在论文里。HEIR 想做的就是把成本曲线压下来。\n\nGoogle 把这件事的学术合作网络公开列了出来:Georgia Tech、CMU、UCSB、Illinois Institute of Technology、Purdue、Edinburgh、清华——四个已发表的学术工作挂在 HEIR 之上。这意味着 HEIR 不只是 Google 一家的工具,而是变成整个学界的\"通用底座\"。\n\n## 这件事对我意味着什么\n\n**对 AI 工程师**：未来 6-12 个月,你可能会看到\"隐私推理\"开始作为一个独立的产品类目出现。HEIR 让\"我的模型权重我不想交给云\"和\"用户数据我不想给云\"这两个需求有了统一的答案。\n\n**对企业**：医疗、金融、政务这种被合规卡死的领域,以前只能用本地化部署（成本高）或联邦学习（架构复杂）。HEIR 这种\"加密推理\"是第三条路——把模型放到云端,但服务器对内容一无所知。\n\n**对个人**：你的下一个 AI 助手未必需要知道你说了什么。它可以在密文里替你做完所有事。\n\n**对行业**：当 Anthropic \u002F OpenAI \u002F Google 都在做\"记忆+个性化\"时,加密推理反而可能成为某些场景的差异化点——\"不读你数据,也能服务好你\"。\n\n## 还差什么\n\nGoogle 自己也承认,HEIR 不是银弹。目前的延迟开销仍然不小,真正的\"产品级\"部署还需要等硬件加速器成熟。但方向已经清晰：**未来几年,AI 推理会和加密技术深度耦合,而不是像今天这样几乎完全裸跑**。HEIR 是这条路径上的第一个被官方开源、覆盖完整工程链路的尝试。\n\n## 写在最后\n\n同态加密在 AI 推理上的故事讲了很多年,真正落地一直缺一个能把工程门槛打下来的工具。Google 这次发布的 HEIR,加上配套的四个真实业务模型和硬件合作矩阵,是这套故事第一次有了\"现在就能上手试\"的形态。\n\n隐私和 AI 不是对立的两端。HEIR 的存在本身就证明了——你完全可以让一个强大的模型跑在它看不见的数据上,而且这件事正在变得工程化,不再是 PPT。\n\n> 数据来源:Google Blog（blog.google\u002Fsecurity\u002Fhow-google-is-making-private-ai-practical-with-homomorphic-encryption\u002F）、AI Weekly、Google HEIR 项目页（heir.dev）","https:\u002F\u002Fblog.google\u002Fsecurity\u002Fhow-google-is-making-private-ai-practical-with-homomorphic-encryption\u002F","d884df39-706a-45db-b7ed-371f12e54f1f",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"5e628969-6d2a-437f-998a-104e4b16cfb1","ai-progress",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"40269b40-7942-4650-9672-ed2e6524d37a","ai-technology",{"id":19,"name":20,"slug":20,"description":14,"color":14},"0a93ec8e-ea39-4693-81de-563ca8c173f7","inference",{"id":22,"name":23,"slug":23,"description":14,"color":14},"b9bd9039-fcdb-41a8-b85b-fc1587def2b9","open-source",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"b111eb69-13c0-4983-a660-cb397115296b","en","Google's HEIR runs pretrained models on encrypted data","Google has open-sourced HEIR, the first compiler that rewrites pretrained AI models to run inference on encrypted inputs. Homomorphic encryption lets the cloud compute on data it cannot see. HEIR ships with four reference applications covering recommendation, credit card fraud, Kitsune anomaly detection, and hotword detection. Google co-developed it with Belfort, Niobium, Cornami, and Optalysys; Georgia Tech, CMU, UCSB, and Tsinghua are academic collaborators. It marks a clear step from \"lab-grade\" to \"product-grade\" private AI inference.","# Google puts encrypted inference on the table: HEIR compiler lets pretrained networks run on ciphertext\n\nOn August 14, Google published **HEIR (Homomorphic Encryption Intermediate Representation)** on its official security blog — the first open-source compiler aimed squarely at AI inference. Its goal: take any **pretrained model** and automatically convert it into a version that runs on encrypted data, so the cloud server never sees the plaintext at any point in the pipeline. The author is Jeremy Kun, Staff Software Engineer at Google. The compiler itself is open-sourced under google\u002Fheir on GitHub.\n\n## What HEIR actually fixes\n\nTo get a neural network running on ciphertext used to mean months of manual rewriting by a team of cryptographers. HEIR turns that into a \"one-click\" operation: write your program in Python, annotate which fields are confidential, and HEIR compiles the encrypted version for you. In other words, it lifts FHE from a cryptographer's craft project to an off-the-shelf engineering component.\n\n## Four reference applications that already work\n\nGoogle did not stop at the compiler. It also released four real-world models, all compiled and verified:\n\n1. **Deep Learning Recommendation Model** — joint work with Belfort Labs, LG, and NYU. Service providers can recommend content without seeing any user feature vector.\n2. **Credit card fraud detection** — with Niobium and hardshell.ai. Banks can encrypt transactions and send them to a third-party fraud model, leaving only ciphertext exposed.\n3. **Network intrusion detection (Kitsune)** — with Niobium. The system can flag anomalies on encrypted network traffic without ever seeing packet contents.\n4. **Hotword detection model** — with Belfort Labs. An audio-triggered AI agent can recognize \"Hey Siri\"-style wake words without learning what was actually said.\n\nAll four were run on a single-threaded CPU, with latency numbers published. Google is explicit that this is a starting point — the company is working with Belfort, Niobium, Cornami, and Optalysys on dedicated FHE hardware accelerators that will push latency down further.\n\n## Why this matters more than it looks\n\nHomomorphic encryption for AI has long been \"theoretically perfect, practically unused\". The capability is seductive — **the server computes on ciphertext and returns ciphertext; only the user can decrypt** — but the performance cost and migration burden have kept it locked inside research papers. HEIR is designed to push that cost curve down.\n\nGoogle publicly lists its academic collaboration network: Georgia Tech, CMU, UCSB, Illinois Institute of Technology, Purdue, the University of Edinburgh, and Tsinghua University. Four peer-reviewed publications are already built on top of HEIR. That means HEIR is no longer just a Google tool; it is becoming a shared substrate for the whole research community.\n\n## What this means for you\n\n**For AI engineers**: expect \"private inference\" to become a distinct product category in the next 6–12 months. HEIR makes it possible for the first time to answer both \"I don't want to ship my model weights to the cloud\" and \"the user doesn't want their data seen by the cloud\" with a single stack.\n\n**For enterprises**: healthcare, finance, and government — the sectors most constrained by compliance — used to be stuck choosing between on-prem deployment (expensive) and federated learning (architecturally complex). Encrypted inference is a third path: put the model in the cloud, but let the server know nothing about the inputs.\n\n**For individuals**: your next AI assistant may not need to know what you said. It can complete tasks on ciphertext and still help you.\n\n**For the industry**: while Anthropic, OpenAI, and Google push \"memory and personalization\", encrypted inference may become a counter-position — \"we don't read your data, and we still serve you well\".\n\n## What is still missing\n\nGoogle itself is clear that HEIR is not a silver bullet. The current latency overhead is still meaningful, and \"product-grade\" deployment still depends on the hardware accelerator roadmap. But the direction is set: **over the next few years, AI inference will be tightly coupled with encryption rather than running almost naked, as it does today**. HEIR is the first serious open-source attempt that turns that direction into something you can actually try today.\n\n## Closing\n\nThe story of FHE on AI inference has been told for years; what it was missing was a tool that broke the engineering barrier. HEIR, backed by Google's four reference applications and a hardware partnership matrix, is the first time that story has had a \"you can pick it up and try it now\" shape.\n\nPrivacy and AI are not opposing ends. HEIR's existence is itself proof — you can let a powerful model run on what it cannot read, and that capability is becoming engineering-grade rather than PowerPoint-grade.\n\n> Sources: Google Blog (blog.google\u002Fsecurity\u002Fhow-google-is-making-private-ai-practical-with-homomorphic-encryption\u002F), AI Weekly, Google HEIR project page (heir.dev).","google-heir-compiler-encrypted-ai-inference","2026-08-14T14:00:00Z","2026-08-17T03:20:50.650234Z","2026-08-17T03:20:50.650243Z",true,"agent",96,{"items":39},[40,45,50,55,60,65],{"id":41,"title":42,"news_slug":43,"published_at":44},"1311adb6-dc19-41a7-a188-6760d9e53672","HF Summer 2026 报告:13 个下载量 Top 25 模型是 2022 年的老面孔","hugging-face-summer-2026-attention-adoption","2026-08-24T08:00:00+00:00",{"id":46,"title":47,"news_slug":48,"published_at":49},"deac2d55-76a6-40d2-8ef7-36aed2ad0105","Linux 7.2 把 AI 拉进内核开发:Sashiko 让补丁数量翻倍,Torvalds 接受「新常态」","linux-7-2-sashiko-ai-kernel-review","2026-08-20T12:00:00+00:00",{"id":51,"title":52,"news_slug":53,"published_at":54},"22a1a718-0eb6-46e5-8ee8-825400de11d1","DeepMind WeatherNext 在 Nature 发论文：用 28 km 粗分辨率做出多一天的飓风预警,代码权重全部开源","deepmind-weathernext-cyclones-nature-open-source","2026-08-10T02:00:00+00:00",{"id":56,"title":57,"news_slug":58,"published_at":59},"777afb24-262f-45cc-961f-d5d49ad42883","AgentOPSD 用递归贝叶斯信念破解多轮 Agent 强化学习的信用分配：清华\u002F浙大\u002F美团让 GRPO 学会看哪个 turn 决定胜负","agentopsd-recursive-belief-credit-assignment","2026-08-07T02:00:00+00:00",{"id":61,"title":62,"news_slug":63,"published_at":64},"9ef626d9-05dd-4e67-9069-093f90a3fd5c","Rust 主仓库正式引入 LLM 政策：把\"必须人为可读、不可代写\"写进 PR 流程","rust-lang-rust-llm-policy-adoption","2026-08-07T00:00:00+00:00",{"id":66,"title":67,"news_slug":68,"published_at":69},"b2c169c6-5150-4423-8073-bf480a2d8745","腾讯 UniPert-G2CP 登《Cell》主刊：把基因扰动和化学扰动塞进同一个语义空间","tencent-unipert-g2cp-cell-virtual-cell","2026-07-31T07:49:00+00:00"]