- If an AI provider has control over the AI algorithm running in the secure enclave, they can easily have functions that provide them the plaintext through a separate channel. secure enclave does not prevent that

- The output can reveal information to the provider, which homomorphic encryption would have protected

- Inference is running on GPUs - so its moreso nvidia than amd/intel, but this is just a nit

So homomorphic encryption exists so the user doesn't need to do work to figure out if the provider could be adversarial.