Comment by rjeli

There’s a nice writeup on group hashes here: https://cronokirby.com/posts/2021/07/on_multi_set_hashing/

In particular, if you choose a group where discrete log is hard (such as prime order elliptic curves), multiset hashing falls out for free