Sandboxes are speed bumps. Even the serious ones have spectator sports for compromising them (eg pwn2own vs Chrome). In addition, proprietary GPU sw stacks are

Sandboxes are speed bumps. Even the serious ones have spectator sports for compromising them (eg pwn2own vs Chrome). In addition, proprietary GPU sw stacks are notoriously crashy and lacking in robustness against hostile inputs, which the inference engine must have access to and can't be walled off by the sandbox.