It's a good idea but it seems quite easy to invert the first layer mapping. And the output of the last layer you can easily steal just by doing whatever would've been done in the client.