> Nowhere was the user data decrypted and in particular the cloud provider does not have access to either the orignal image nor is it able to decrypt the prediction it computed.

That's from the post. Is that what you meant by creating a model whose results only the owner of the data can understand?