Obfuscate an "I'll reveal if you do" function
If there is _______________ obfuscation scheme for such $\hspace{.03 in}f$s then there is a scheme

that does what you describe, where _______________ is either "a differing-inputs"

or "an extractability", depending on how you define "doesn't know Alice's secret".

Note that if there is no a-priori bound on the length of $x$, then the $\hspace{.03 in}f$s will have to be Turing machines with unbounded input length rather than just circuits. $\:$ In order to obfuscate such programs with the latter paper's candidate construction, one needs (publicly verifiable) SNARKs instead of just SNARGs.

However, if there is an a-priori bound on the length of $x$ or the commitment scheme's

verification function is sufficiently parallelizable (for example, if it follows a Merkle tree),

then one can replace the FHE scheme with a leveled FHE scheme.

On the other hand, this paper gives an argument against

the plausibility of the types of obfuscation that I linked to.

I see a lot of papers mentioning that standard assumptions suffice for the existence of a pseudorandom generator with linear stretch in NC1, although I cannot actually find any good candidate for that. $\:$ If there is one, then by chaining it to make the stretch sufficiently large and applying Naor's construction to the resulting PRG, one gets a commitment scheme whose verification function is in NC1. $\:$ Observe that

the $\hspace{.03 in}f$s are computable by just ANDing the output of the verification function with each bit of $y$.

Thus, if there is a pseudo-random generator with linear stretch in NC1 and a

_______________ obfuscation scheme for NC1, then there is a scheme whose

commitment is slightly interactive but otherwise does what you describe.