# Visor: Privacy-Preserving Video Analytics as a Cloud Service

arXiv: https://arxiv.org/abs/2006.09628 · HTML: https://mlsanity.com/paper/2006.09628/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Jun 2020.

## Built on by (most cited first, 7 of 7)

- [GEMEL: Model Merging for Memory-Efficient, Real-Time Video Analytics at the Edge](https://mlsanity.com/paper/2201.07705/) (2022)
- [Privacy-Preserving Video Classification with Convolutional Neural Networks](https://mlsanity.com/paper/2102.03513/) (2021)
- [Boggart: Towards General-Purpose Acceleration of Retrospective Video Analytics](https://mlsanity.com/paper/2106.15315/) (2021)
- [VeriSplit: Secure and Practical Offloading of Machine Learning Inferences across IoT Devices](https://mlsanity.com/paper/2406.00586/) (2024)
- [A Survey of Performance Optimization in Neural Network-Based Video Analytics Systems](https://mlsanity.com/paper/2105.14195/) (2021)
- [Morse-STF: Improved Protocols for Privacy-Preserving Machine Learning](https://mlsanity.com/paper/2109.11726/) (2021)
- [SecureV2X: An Efficient and Privacy-Preserving System for Vehicle-to-Everything (V2X) Applications](https://mlsanity.com/paper/2508.19115/) (2025)

## Abstract (arXiv)

Video-analytics-as-a-service is becoming an important offering for cloud providers. A key concern in such services is privacy of the videos being analyzed. While trusted execution environments (TEEs) are promising options for preventing the direct leakage of private video content, they remain vulnerable to side-channel attacks. We present Visor, a system that provides confidentiality for the user's video stream as well as the ML models in the presence of a compromised cloud platform and untrusted co-tenants. Visor executes video pipelines in a hybrid TEE that spans both the CPU and GPU. It protects the pipeline against side-channel attacks induced by data-dependent access patterns of video modules, and also addresses leakage in the CPU-GPU communication channel. Visor is up to 1000× faster than na"ive oblivious solutions, and its overheads relative to a non-oblivious baseline are limited to 2×--6×.