# Groth-Sahai proofs and the hidden-bits model

In the Groth-Sahai proof system, the authors mention (section 1.2) that one of the reasons behind the inefficiency of previous NIZK proof systems is their reliance on the hidden-bits model. Then, they state that other previous work avoided this by using bilinear pairings (but still used a reduction to CSAT, which is not the focus of their proposal.) Thus, I understand that, in their system, they follow the bilinear pairing approach to avoid the inefficiency stemming from the hidden-bits model.

Then, in the description of their framework (section 5), they use a Common Reference String (CRS) that includes some carefully chosen group elements and mappings. Among these mappings, there is $\iota_1,p_1,\iota_2,p_2,\iota_t,p_t$, where the $\iota$'s allow moving from the "witness domain" to the "commitment domain" and the $p$'s the other way around. The security of their proposal relies on the hardness of applying the $p$ mappings without an appropriate trapdoor.

Now, my doubt is: How is this avoiding the hidden-bits model? I mean, there is a predefined CRS with public information, which is later used by a prover to "hide" information from a verifier, since the verifier cannot apply the inverse mappings (the $p$'s). Which is precisely the hidden-bits model if I'm not mistaken.

Is it just that, with the statement in section 1.2, they rather meant that they create an "efficient version" of the hidden-bits model? Have I just got something messed up?