  Video-analytics-as-a-service is becoming an important offering for cloud
providers. A key concern in such services is privacy of the videos being
analyzed. While trusted execution environments (TEEs) are promising options for
preventing the direct leakage of private video content, they remain vulnerable
to side-channel attacks.
  We present Visor, a system that provides confidentiality for the user's video
stream as well as the ML models in the presence of a compromised cloud platform
and untrusted co-tenants. Visor executes video pipelines in a hybrid TEE that
spans both the CPU and GPU. It protects the pipeline against side-channel
attacks induced by data-dependent access patterns of video modules, and also
addresses leakage in the CPU-GPU communication channel. Visor is up to
$1000\times$ faster than na\"ive oblivious solutions, and its overheads
relative to a non-oblivious baseline are limited to $2\times$--$6\times$.
