A blur filter does the exact same thing to every pixel.

The server would know that you're doing a blur, but it would have no idea what the contents of the image are.

Your data is encrypted. Your program is not encrypted.

If you want to hide your program, then things will get much slower yet again.

Sorry if I'm being too thick here, but a blur filter needs information about the neighbour pixels. It can't operate on a single pixel alone (well it changes things pixel by pixel, but needs the neighbour pixels as input). If I can extract these neighbour pixels from the encrypted image, why can't I extract the image itself?

Each pixel is encrypted separately. FHE lets the server take two encrypted numbers and add or multiply them to make a new encrypted number. There is no way for the server to ever know what any of those numbers actually are.