Surprisingly, such functions do exist and are used in public-key digital signatures.
We assume only Bob knows Bob's private key.
Bob derives a public key from it, and publishes the public key --
we assume everyone knows Bob's public key.
Let's say I've got a function f that takes a single number and returns
Yes, Bob has a signing function that knows Bob's private key. That signing function takes a single number -- typically the hash of some plaintext message -- and returns a number called a public-key digital signature.
And I have another function verifyf which takes the input I gave to f
and the number returned by f which returns true if the output is the
same as f would have returned given the input.
Yes, since everyone knows Bob's public key, anyone one the world can use the signature verifying algorithm, which takes the input Bob gave to f -- the hash of some plaintext message; and the number returned by f -- the public-key digital signature -- and also Bob's public key, which everyone knows.
The signature verifying algorithm either accepts or rejects the message as an authentic message from Bob.
If you know the input and output to f and the function to verify then
it is possible to work out what the implementation of f is.
A signed message from Bob typically contains the plaintext message used as input to Bob's signing function, and also that function's output -- the digital signature.
Most of the details of a signing algorithm are already public,
but even if the adversary gets a signed message from Bob, it is widely considered practically impossible to work out exactly what Bob's public key is, or to forge some other message that tricks someone into thinking that other forged message came from Bob.
https://crypto.stackexchange.com/ and https://security.stackexchange.com/ may be better places for asking more detailed questions about such functions.
(I see that D.W. already gave basically the same answer, except without rambling on quite so long :-).