Zero-knowledge proof for the product of additive Paillier ciphers Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. 

Alice computes $E(\sum x_i)$ from the product of the cipher values she received.
Alice sends $E(\sum x_i)$ to Bob for decryption, but she needs to prove that she used all the cipher values she received to form the product $E(\sum x_i)$ for Bob to return the plain text $\sum x_i$.

What should each entity: $i$ send along with their share $E(x_i)$ for Bob to be able to do such verification, and how could he do it?

Note: $x_i$ values are not merely $0$ or $1$. They can take any integer value.
Assuming entities do want Bob to decrypt the sum, but not be able to decrypt individual ciphertexts: enitites would send commitments to plaintext to Bob while sending ciphertexts to Alice. Commitment scheme should be additively homomorphic such that Bob could open the result (over commitments collected) with plaintex decrypted as verification. This would prevent Alice from manipulating ciphertexts collected (assuming honest entities).

Please note plaintext is not an integer in Paillier scheme modulo $n^2$, but a ring element modulo $n$.