## 2 Related Works  
There have been many works addressing one or more of the requirements mentioned above in outsourcing function computation. The schemes in [10; 11; 12] realize function privacy and input privacy based on FHE [2] or GCs [4]. However, they can only achieve private verification and not public verification. Additionally, the expensiveness of cryptographic primitives, such as GCs and FHE, limits their practical relevance. The schemes in [13; 14; 15] use lightweight algorithms for encryption and decryption instead of FHE to construct schemes with input privacy and function privacy. They reduce the system costs but still do not realize public verification.  
Figure 1: Outsourcing computation model of functions.  
The scheme in [16] shares the function model and input data among multiple servers using additive secret sharing [20] rather than encryption, and the results are obtained through the cooperation of these servers. Although it protects both function privacy and input privacy, it only provides private verification and not public verification. It also requires a strong assumption of non-collusion for the servers or the private data will be leaked.  
Some works construct publicly verifiable computation schemes for specific functions. For instance, the works in [7; 17; 18; 19] have constructed publicly verifiable computation schemes that are efficient for specific functions, such as univariate polynomial functions and matrix functions. In [8], a publicly verifiable computation scheme for Boolean functions was constructed based on key policy attribute-based encryption (KP-ABE) [21]. However, this scheme does not offer input or function privacy. Moreover, ref. [9] proposed a publicly verifiable scheme with privacy protection, but it can only protect one element between function privacy and input privacy, i.e., either a publicly verifiable computation scheme with function privacy or a publicly verifiable computation scheme with input privacy.  
Table 1 summarizes the requirements achieved in the surveyed literature, which can inform the research findings of our proposed scheme.  
To improve efficiency, our work employs a partial homomorphic encryption scheme. The cloud server needs to perform a transformation on the ciphertexts from two different clients before computing. Several works have addressed this transformation on ciphertexts. For instance, [PERSON] et al. [22] proposed a scheme that requires a participant to possess a strong private key that can decrypt any ciphertext in order to complete the transformation on ciphertexts. However, this approach poses a threat to data privacy and makes the data owner lose the right to control their data.  
In contrast, our work ensures that the function owner retains control over their function, thereby strengthening data privacy. In [23], [PERSON] et al. split the strong private key in the BCP [24] scheme among multiple participants to decentralize the decryption power of the strong private key. However, their approach did not consider how to split the key securely. Additionally, their ciphertext transformation requires more cooperation among participants, which increases communication costs and decreases computing efficiency.  
In contrast, our approach involves fewer participants, has lower communication costs and offers higher computing efficiency. In [25], [PERSON] et al. proposed a homomorphic proxy re-encryption scheme that supports homomorphic operations for re-encrypted ciphertexts. However, this scheme requires a large number of computations of the discrete logarithm and group operations in bilinear groups, which increases the computational cost. Our approach is based on a lean homomorphic proxy re-encryption scheme, which makes computations more efficient.