Proof of application of $f(x)$ without disclosing input $x$ I have three nodes in a network: $\mathcal{S}$,$\mathcal{T}$,$\mathcal{R}$. 

$\mathcal{S}$ supplies data $x$ to $\mathcal{T}$. $x$ is signed so $\mathcal{T}$ knows it actually comes from $\mathcal{S}$. $\mathcal{T}$ computes $f(x)=y$ and sends $y$ to $\mathcal{R}$. $\mathcal{R}$ uses the result $y$ in some computation. $f$ Is implemented in code and the code is public. 

Question: Is there a way for $\mathcal{R}$ to know for sure that $y$ is the result of the correct application of $f$ to data supplied by $\mathcal{S}$, without disclosing $x$?

In other words: Can $\mathcal{T}$ prove that it correctly applied $f$ to trusted data when computing $y$, without disclosing $x$?
Use a zk-SNARK, proving the following statement:

Private data: $x$.
Public data: $y, pk, \sigma$

I know an $x$ such that $f(x) = y \land \textsf{Ver}(pk, x, \sigma)$

Where $\textsf{Ver}$ is the secure signature scheme verifier algorithm, $x$ is the secret input, $y$ is the output of $f$ applied on $x$, $\sigma$ is the signature of $\mathcal{S}$ on $x$, and $pk$ is the public key of $\mathcal{S}$.

As long as your signature scheme does not reveal your message contents within the signature $\sigma$, your scheme will be zero-knowledge. If it does, you can hash it prior to supplying it to the protocol:

Private data: $x, \sigma$.
Public data: $y, pk, \sigma'$

I know an $x$ such that $f(x) = y \land \textsf{Ver}(pk, x, \sigma) \land H(\sigma) = \sigma'$

Where $\sigma'$ is the hash of the signature.