Your circuit will contain auxiliary output bits. That way it's reversible knowing all output bits, but irreversible knowing only the actual hash output. Quite

Your circuit will contain auxiliary output bits. That way it's reversible knowing all output bits, but irreversible knowing only the actual hash output. Quite similar to how SHA3/Keccak is built from a reversible permutation, but becomes irreversible one the output it truncated.