What is a homomorphic commitment and why does it enable selective disclosure?

A Pedersen commitment C = v·G + r·H binds a prover to a private value v using a random blinding factor r, without revealing v. Because the scheme is additively homomorphic, a proof can show the committed value satisfies a public threshold or range without ever decommitting - the prover discloses only the fact checked, not the underlying number.

What kinds of claims can be proven without revealing the underlying value?

Four built-in circuits cover balance-range proofs (a balance falls within [min, max]), balance-sufficiency proofs (a balance meets or exceeds a required amount), Merkle-membership proofs (an item is included in a set), and KYC-attestation proofs (specific identity claims hold) - each keeping its private witness data out of any transmitted or stored record.

Why are the audit receipts described as deterministic and reproducible?

Each receipt's commitment is computed as a hash over the public claim, the private witness, and a salt, with no additional run-to-run randomness in the commitment itself. Given the same disclosed inputs, a third party can regenerate the identical commitment and independently confirm the receipt during a later audit or replay check.

Privacy with Selective Disclosure

Executive Summary

JIL Sovereign's selective-disclosure privacy layer lets a party prove a private numeric value - a balance, an income figure, a claim amount - satisfies a public predicate (a minimum threshold, a bounded range, set membership) without ever revealing the value itself. The mechanism rests on a homomorphic commitment: a value is committed as C = v·G + r·H using a random blinding factor r, so the commitment reveals nothing about v on its own, yet supports arithmetic relationships between commitments without decommitting any individual value.

Four built-in circuits cover the disclosure patterns most compliance and settlement flows actually need: range proofs, sufficiency proofs, Merkle-membership proofs, and KYC-attestation proofs - each independently selectable across multiple proof systems (Bulletproofs for range proofs; Groth16 or PLONK for the others) depending on the tradeoff between proof size, verification cost, and setup requirements a given circuit calls for. Every receipt's commitment is deterministic given its disclosed inputs, so a third party can independently regenerate and confirm it during a later audit without rerunning the original private computation.

Core Innovation: A single privacy layer combining additively homomorphic value commitments with a multi-proof-system circuit library, so threshold, range, membership, and attestation predicates over a hidden value are all provable through one consistent commitment scheme - with deterministic, third-party-reproducible receipts for later audit.

Problem Statement

Most "selective disclosure" credential schemes disclose an attribute in the clear the moment it is revealed - all-or-nothing per field - or hide a value entirely but support only equality checks against it, not threshold ("balance is at least X") or range ("balance falls between X and Y") predicates over a value that stays hidden and whose commitment can be reused across multiple independent proofs without ever being opened. That gap forces products needing threshold-style compliance checks (minimum-balance gates, income-threshold accreditation, sufficiency-before-transfer checks) to either expose the underlying figure to a counterparty or forgo cryptographic proof entirely and rely on a trusted attestation.

Built-in circuits: balance range, balance sufficiency, Merkle membership, KYC attestation

Selectable proof systems per balance circuit (Bulletproofs / PLONK / Groth16)

Private witness bytes transmitted or stored in a proof record

Why Existing Solutions Are Insufficient

Shielded-pool schemes (Zcash-style): hide the entire value inside the pool but do not expose a general-purpose threshold or range predicate a counterparty can independently verify against a public parameter.
Ring-signature anonymity sets (Monero-style): provide sender/receiver ambiguity, not a commitment-based proof that a specific hidden value satisfies a specific public threshold.
Plain KYC attestation services: require disclosing the underlying data (income, balance, identity documents) to the verifying party directly, defeating the purpose of selective disclosure.
Anonymous-credential systems (Idemix/U-Prove-style): support selective attribute disclosure but generally lack a homomorphic threshold/range predicate over a hidden numeric balance reusable across multiple independent proofs from the same commitment.

Technical Architecture

Homomorphic Commitment Layer

A private value v is committed as C = v·G + r·H for a random blinding factor r and two independent generator points G, H. Because the scheme is additively homomorphic, commitments to different values with different blinding factors can be combined arithmetically - enabling a circuit to prove a relationship between committed quantities (for example, that a committed balance meets a public threshold) without ever decommitting the individual value, and without the prover needing to reveal the blinding factor to anyone but the proof circuit itself.

Circuit Library

Circuit	Public Inputs	Private Inputs	Predicate Proven
`balance_range`	min_balance, max_balance, commitment	actual_balance, blinding_factor	Balance falls within [min, max]
`balance_sufficient`	required_amount, commitment	actual_balance, blinding_factor	Balance ≥ required amount
`merkle_membership`	merkle_root	leaf_value, merkle_path, path_indices	Item is included in a committed set
`kyc_attestation`	attestation_hash, issuer_public_key, timestamp	kyc_data, issuer_signature	Specific identity claims hold, issuer-signed

Multi-Proof-System Selection Per Circuit

Each circuit declares which proof systems it supports, and a request may specify a preferred system or fall back to the circuit's default. Range and sufficiency proofs favor Bulletproofs (no trusted setup, compact for range statements) while membership and attestation proofs favor PLONK or Groth16 depending on constraint-count and setup tradeoffs - the same underlying commitment feeds whichever proof system is selected for the specific predicate being proven.

Deterministic, Reproducible Receipts

A disclosure receipt's commitment is computed as a hash over the disclosed public claim, the private witness, and a per-receipt salt, then bound into a receipt via a detached signature over the receipt id, commitment, timestamp, and salt. Because the commitment computation has no additional run-to-run randomness beyond the salt itself - which is retained and can be disclosed at audit time - a third party holding the same public claim, witness, and salt can independently regenerate the identical commitment, giving a reproducible basis for replay verification rather than a one-time, unauditable assertion.

Gate-Enforced Verification

Before a gated transaction or claim proceeds, the corresponding proof is verified against its public commitment and threshold/range inputs; only the public claim and the pass/fail verification result are ever transmitted to the enforcing party or retained in a stored record - the private witness never leaves the prover's environment.

Selective Disclosure in Practice

Circuit	Representative Use
`balance_sufficient`	Proving a wallet can cover a transfer or pre-clearance minimum without disclosing its total balance
`balance_range`	Proving a balance falls within a reporting or eligibility band without disclosing the exact figure
`merkle_membership`	Proving inclusion in a reserve set or an allowlist without revealing every other member
`kyc_attestation`	Proving specific compliance claims hold without disclosing the underlying identity data to the verifying counterparty

Prior Art Differentiation

Approach	Threshold/Range Over Hidden Value?	Homomorphic Commitment?	Multi-Proof-System?	Reproducible Audit Receipt?
Shielded pools (Zcash-style)	No general predicate	Partial (note commitments)	No	No
Ring signatures (Monero-style)	No	No	No	No
Plain KYC attestation services	N/A - discloses raw data	No	No	No
Anonymous credentials (Idemix/U-Prove)	Attribute disclosure, not numeric threshold	No	No	No
JIL Sovereign Selective Disclosure	Yes, range and sufficiency circuits	Yes, Pedersen commitment	Yes, Bulletproofs/Groth16/PLONK	Yes, deterministic salt-based commitment

Patent Claim

Independent Claim 79: A computer-implemented method for privacy-preserving numeric attestation comprising: generating a homomorphic commitment to a private numeric value using a blinding factor, such that the committed value can be proven to satisfy a public threshold or range predicate without revealing the value itself; selecting, on a per-circuit basis, a zero-knowledge proof system from among a plurality of supported proof systems according to the predicate being proven; computing a deterministic disclosure receipt over the disclosed public claim, the private witness, and a retained salt, such that the receipt is independently reproducible by a third party holding the same disclosed inputs; and enforcing, as a precondition to a gated transaction or claim, verification of the resulting proof against its public commitment and threshold or range inputs while excluding the private witness from any transmitted or stored record.