“HEIR can convert pre-trained AI models that operate on unencrypted data to operate on encrypted inputs.”
The compiler toolchain is real and open source, which is more than most privacy announcements deliver. The four shipping applications tell you the actual scope: fraud detection, intrusion detection, a recommendation model, and a hotword detector. None of those are the products where Google reads your data. Encrypting inference on the fraud model does nothing about the ad graph, and that is the part they are not offering to encrypt.