Comment by valicord

Given that the inference engine is dealing with untrusted inputs by definition, presumably you would want to sandbox it anyway. I don't think it matters whether it's the inputs that are untrusted or the outputs.