Definition
Classical commitment schemes fall into three families: (1) hash-based — H(m, r) over the value m and a random salt r; (2) Pedersen — group-theoretic g^m · h^r; (3) Kate/KZG — polynomial commitments.
In ZK systems, you commit to values, hand the verifier the commitments, and use a zero-knowledge proof to open only the slices you need. Commitments are the input-privacy backbone of ZK.
Binding resists post-hoc tampering, hiding blocks pre-disclosure leakage. Together they enable lock-in-now, reveal-on-demand workflows.
Lemma implementation
Lemma's attribute, model, and provenance commitments use Pedersen or KZG families. To enable per-attribute disclosure, attributes are bound through a vector or polynomial commitment that lets each attribute open independently.
Selective disclosure rides on top of commitment openings; the provenance chain is realized as a commitment chain.
Poseidon-based commitments keep in-circuit disclosure cost minimal.