让下一篇重要论文，不再错过。

原文摘要

Prior studies on quantum money from knots, and the invariant money framework that generalizes it, anchor their security on the hardness of path-finding. However, we show that the hardness of path-finding is proven to be necessary for security under certain conditions. In other conditions, this assumption is not a direct anchoring hardness problem such that breaking it allows an adversary to forge a banknote directly. In particular, for quantum money from knots, even when the path-finding assumption does not hold, an adversary still cannot directly forge a banknote. The adversary needs to additionally prepare the uniform superposition over the paths it finds, which we show is as hard as the original problem. Existing security proofs supplement path-finding hardness with knowledge-of-path assumptions. While this combination is sufficient, it may not be necessary. We identify an assumption pair, preparation assumption and transfer assumption, that is both necessary and sufficient for the security of every invariant money scheme. Breaking either assumption directly enables a forgery. The preparation assumption says that no efficient algorithm, given the serial number of a banknote and one object measured from it, prepares a state that verification accepts. While quantum money security gives a forger one quantum state and asks for two that pass, our assumption concerns a problem that takes only classical inputs and asks for one quantum state that passes. This assumption is equivalent to security against forgers that measure their banknote first. Given that its inputs are classical, it is falsifiable and can be attacked and bounded like other computational problems. The transfer assumption covers forgers that keep the banknote coherent, stating that every such forger only has an advantage over the measure-first adversary by at most a polynomial factor.