谷歌发布同态加密编译器HEIR最新进展

谷歌公布了同态加密编译器项目HEIR的最新进展 1。HEIR是一款能将输入程序转换为直接在加密数据上运行的编译器，可将预训练的机器学习模型编译为完全隐私的推理程序，用户数据和中间计算结果均不暴露给计算机 1。

该项目展示了多项实际应用演示，包括信用卡欺诈检测、网络异常检测等场景 1。以信用卡欺诈检测为例，在单线程CPU上使用同态加密进行推理耗时2秒，相比明文推理的0.5毫秒约慢4000倍；通过H100 GPU加速后可降至500毫秒，相比明文推理的10毫秒约慢50倍 1。其他演示的推理延迟分别为：网络异常检测30秒、criteo模型5分钟、hotword模型20分钟 1。

当前项目仍存在关键瓶颈。评估密钥材料规模庞大，单个演示需40GB存储空间，而大型语言模型可能需要数百GB，导致存储和GPU内存成本高昂；如要服务一百万用户，仅存储评估密钥就需512个20TB硬盘 1。

HEIR的发展路线图包括实现密码学直接编译、GPU/TPU支持、支持新加密方案（包括Gentry-Lee、Poulpy、Gao-Zheng算法）、建立基准测试框架（fhe-benchmarking.org）以及学术研究支持 1。根据项目分析，同态加密推理最适用于2020年前的较小模型、隐私需求关键的应用、用户规模有限的服务，以及无需服务器查看计算输出的任务场景 1。

Google has unveiled the latest progress on HEIR, a homomorphic encryption compiler designed to transform input programs into executables that run directly on encrypted data 1. The compiler enables the deployment of pre-trained machine learning models for fully private inference, where user data and intermediate computational values remain concealed from the computing system 1.

The project showcases multiple demonstration applications, including credit card fraud detection and network anomaly detection, to validate the feasibility of homomorphic encryption inference 1. In the fraud detection demo, homomorphic encryption inference on a single-threaded CPU takes approximately 2 seconds compared to 0.5 milliseconds for plaintext processing—roughly 4,000 times slower—though GPU acceleration on an H100 reduces this to 500 milliseconds, bringing the slowdown to approximately 50 times 1. Other demonstrations show inference latencies of 30 seconds for network anomaly detection, 5 minutes for Criteo, and 20 minutes for hotword detection 1.

Current limitations center on the scale of evaluation key material, which requires 40 gigabytes per user for the demonstrated models and potentially hundreds of gigabytes for large language models 1. This constraint creates significant storage and GPU memory costs; a service supporting one million users would require 512 twenty-terabyte disk drives solely to store evaluation keys 1. HEIR's roadmap includes direct cryptographic compilation, GPU and TPU support, integration of new encryption schemes such as Gentry-Lee, Poulpy, and Gao-Zheng, the establishment of a benchmarking framework at fhe-benchmarking.org, and continued research support 1. The compiler is positioned as most suitable for pre-2020 smaller models, applications where privacy is critical, scenarios with limited user populations, and tasks where server visibility of outputs is unnecessary 1.