Google's shipping private-inference product does not use homomorphic encryption, despite widespread reporting that suggests otherwise. Private AI Compute runs Gemini models inside sealed hardware enclaves on Google's own chips, which is confidential computing. Google's homomorphic encryption work is a separate project called HEIR, and its own repository states plainly that it is "not an officially supported Google product." The distinction is not pedantic. It is the entire security guarantee.
Key facts
- What ships: Private AI Compute, using remote attestation, Titan Intelligence Enclaves and custom TPUs, with named workloads including Magic Cue on Pixel 10 and Recorder summarization.
- What does not ship: HEIR, described by Google as "A compiler for homomorphic encryption," and labelled in the repository as not an officially supported product.
- The missing number: no Google source publishes an end-to-end slowdown figure comparing plaintext inference against homomorphic inference on a real workload.
- Primary sources: the Private AI Compute announcement and its technical brief.
Two very different privacy technologies keep getting collapsed into one headline, so it is worth separating them properly.
Confidential computing is the shipped one. Your encrypted data travels to a server and is decrypted inside a region of hardware designed so that even the machine's operator cannot inspect it. Remote attestation lets your device verify, cryptographically, that the code running inside that region is the code it expects before any data is sent. Google's version uses what it calls Titan Intelligence Enclaves, running on its custom tensor processing chips, with Gemini models inside.
The analogy is a bank vault with a glass ceiling. Your valuables are genuinely unwrapped inside, and the bank has built the room so nobody can reach in. You are protected, but you are protected by the room's construction and by the bank's honesty about having built it correctly. If the vault has a flaw, or the attestation lies, the protection evaporates.
Homomorphic encryption is the other one, and it is a fundamentally stronger claim. It allows computation directly on encrypted data, so the server produces an encrypted answer without ever seeing the question. There is no vault to break into, because nothing is ever unwrapped. The analogy is handing someone a locked glovebox with your materials sealed inside, letting them work through gloves built into the walls, and taking back a result they never saw. You are trusting mathematics rather than hardware, which is the reason cryptographers care about it so much.
Google's homomorphic work is real, and it is HEIR. The project describes itself as a compiler for homomorphic encryption: a developer writes a high-level program with annotations marking which values are secret, and HEIR compiles that down to the underlying encryption libraries, targeting backends including OpenFHE, Lattigo, tfhe-rs and Jaxite. That matters, because the historical barrier to homomorphic encryption is not just speed but usability. Writing programs directly against these libraries requires deep cryptographic expertise, and a compiler is exactly the right layer to attack that. The reference work is available at arXiv:2508.11095.
But HEIR is a toolchain, not an inference API, and Google says so. Nothing in the Private AI Compute materials claims homomorphic encryption, and nothing in the HEIR materials claims production deployment.
The gap that matters most is one number that nobody publishes: how much slower is a real private-inference workload under homomorphic encryption than in plaintext? Google's materials frame HEIR as a platform for research and benchmarking rather than making a runtime claim, and the Private AI Compute post does not discuss homomorphic runtimes at all. That single figure is what decides whether encrypted inference is a near-term product story or a decade-out one, and its absence should be read as an answer in itself. The Hacker News discussion on Google's earlier homomorphic encryption primer, at 458 points and 159 comments, is technically literate and mostly circling that exact question.
Why does the conflation matter in practice? Because the two technologies fail differently and a user's decision should depend on which one they are getting. Under confidential computing, the threat model includes hardware vulnerabilities, firmware, supply chain, and the operator's own integrity, and a break exposes plaintext. Under homomorphic encryption, a break requires defeating the cryptography itself. Telling a user the second thing while shipping the first overstates the guarantee by a wide margin, and it is the kind of overstatement that only becomes visible after an incident.
The honest caveat is that confidential computing is not weak. For the overwhelming majority of realistic threats, an attested enclave on a purpose-built chip is a substantial improvement over ordinary cloud inference, and it has the enormous practical advantage of running at roughly normal speed. Google shipping it in consumer features on a phone is a genuine step forward for on-device-adjacent privacy. The accurate framing is simply the modest one: Google ships private AI today using trusted hardware, and is separately building the compiler that might make encrypted inference practical later.
Background reading: our new lesson on encrypted inference, and the related guarantee offered by differential privacy.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)