Joined 2 months ago
[1] https://sgx.fail/
If you believe the underlying cryptographic hardness assumption of LWE/RLWE/etc, then yes Google cannot see any of the input or output of the model.
[1] https://sgx.fail/