Suppose $A$ knows $a$ and $B$ knows $b$, is it possible to efficiently compute $g^{ab}$ without leaking $g^a$ and $g^b$ to each other? I know the garbled circuit solution, but is there any more efficient method?
It's not possible because if $B$ knows $b$ and $g^{ab}$, then she can compute $\left(g^{ab}\right)^{b^{-1} \bmod N} = g^a$ (where $N$ is the order of $g$, which is normally prime so that $b^{-1} \bmod N$ exists).

EDIT: As noted by poncho in the comments, this assumes we are in a typical discrete logarithm setting, where the order of the group is prime to avoid attacks on the discrete logarithm by Pohlig-Hellman. In other settings such as RSA it may not be feasible to compute $N$ in the first place, but on the other hand having a group of non-prime order makes the discrete logarithm easier to attack...