Google releases tool for AI that computes on data it cannot see
With the open tool HEIR, AI can analyse encrypted data without unlocking it – the server never sees the content. A breakthrough for privacy, but still slow and early.
Most AI news is about models that see and understand ever more. This week brought one pointing the other way: Google has released an open-source tool called HEIR that makes it possible to let artificial intelligence analyse data without unlocking it. The data stays encrypted the whole way – even while the AI works on it – and only the owner can read the result.
Computing on what you cannot see
The technology behind it is called fully homomorphic encryption (FHE). Normally, data must be decrypted before a computer can do anything with it. FHE turns this around: the machine can compute directly on encrypted data. You send in something encrypted, the AI model processes it without seeing the content, and you get the answer back encrypted – which only you can unlock. The server learns nothing, neither about what you sent in nor about the answer.
In principle it removes the need to trust the provider: it becomes mathematically impossible for the service to see your data. It is an old cryptographic dream, theoretically possible since a breakthrough in 2009, but in practice almost unusable – because it has been extremely hard to program.
Why a "compiler tool" is the news
That is exactly why HEIR matters. The tool automates the complicated job of turning an ordinary AI model into a version that can run on encrypted data – a task that until now required specialists with a PhD in cryptography. Google wants HEIR to become an industry standard, and has therefore made it freely available. Historically, this is how new technology becomes useful: not when the breakthrough happens, but when tools arrive that let ordinary developers use it.
Still slow – and early
There is nonetheless reason for restraint. Google’s own demonstration took around 16 seconds to analyse one small dataset with a tiny three-layer AI network. In general, homomorphic encryption is still 100 to 1,000 times slower than ordinary data processing. That means the technology today suits small, bounded analyses of highly sensitive data – not a full real-time AI chatbot. Running a large language model encrypted is still several years away.
Where it matters most
The first use cases are precisely the industries currently shut out of the AI wave by regulation: health, finance, law and the public sector, where data is so sensitive it cannot be sent to an ordinary cloud service. There, "AI that never sees the data" could be the difference between having to say no to the technology – and being able to use it safely. In a time when ever more AI is about collecting and seeing, this is a rare step in the opposite direction: toward an AI built not to know too much.
