Indeed, it's in-transit-encrypted so snoopers won't be able to see it, but it's not E2E encrypted nor in-process encrypted, the one's doing the inference could obviously see the input/output.