Quantum Money from Knots

• The paper introduces a public-key quantum money scheme using knot invariants, encoding banknotes as superpositions over grid diagrams sharing the same Alexander polynomial.
• It details a minting process that prepares weighted superpositions over planar grid diagrams and employs a Markov-chain based quantum test to verify state stationarity.
• The scheme’s security hinges on the computational difficulty of reconstructing the coherent superposition, due to the complexity of knot equivalence and mixing properties under Reidemeister moves.

Searching arXiv for the cited knot-based quantum money literature and closely related follow-up work. Quantum money from knots is a candidate public-key quantum money scheme in which a banknote consists of a classical serial number and a quantum state that is a superposition over many combinatorial descriptions of oriented links sharing a common knot invariant, specifically the Alexander polynomial. In the original proposal of Farhi et al., the banknote is not a single knot diagram but a weighted superposition over planar grid diagrams, while public verification combines an invariant check with a quantum test for stationarity under topology-preserving local moves. Subsequent work treated this construction as an early and influential example of public-key quantum money built from structured equivalence classes, recasting its core ideas through component-mixer abstractions, hidden-subspace contrasts, and invariant-based security frameworks (Farhi et al., 2010).

1. Origins and conceptual setting

Quantum money is a cryptographic protocol in which a mint produces a quantum state, no one else can copy the state, and anyone with a quantum computer can verify that the state came from the mint. The knot-based proposal is a concrete public-key candidate: the serial number is classical and public, while the quantum part is intended to be hard to duplicate because producing another state that passes verification appears to require solving difficult problems about link equivalence and about coherently traversing large equivalence classes of diagrams (Farhi et al., 2010).

The construction uses topology as the source of structure. Two oriented links are considered equivalent when one can be smoothly deformed into the other without cutting, and diagrammatically this equivalence is generated by Reidemeister moves. The proposal does not encode money into a single privileged representative of a link type; instead, it encodes money into a coherent superposition over many representatives. This shifts the cryptographic burden from hiding a classical secret to preparing and recognizing a highly structured quantum orbit state.

A central design feature is that the public serial number is deliberately coarse. The Alexander polynomial is easy to compute and invariant under link equivalence, but many inequivalent diagrams can share it. A plausible implication is that the serial number reveals only partial information about the note, while the quantum state is meant to occupy a much richer equivalence-laden space than the serial number alone specifies (Farhi et al., 2010).

2. Combinatorial encoding and minting procedure

The proposal works with planar grid diagrams rather than arbitrary link diagrams because they admit a finite combinatorial encoding. A planar grid diagram of dimension $d$ is a $d\times d$ grid containing exactly one $X$ and one $O$ in each row and each column, with no cell containing both. Horizontal segments connect $O$ to $X$ within each row, vertical segments connect $X$ to $O$ within each column, and vertical strands always cross over horizontal ones. Such a diagram $G$ is encoded by a pair of disjoint permutations,

$G=(\pi_X,\pi_O), \qquad \pi_X,\pi_O\in S_d,$

where disjoint means $d\times d$0 for all $d\times d$1, and the $d\times d$2's and $d\times d$3's are placed at coordinates $d\times d$4 and $d\times d$5 (Farhi et al., 2010).

The mint chooses a security parameter $d\times d$6, prepares a weighted superposition over all valid grid diagrams up to dimension $d\times d$7, and arranges the weighting so that the induced distribution of dimensions is approximately Gaussian with mean $d\times d$8, truncated to $d\times d$9. After coherently computing the Alexander polynomial $X$0 and measuring it, the state collapses to a superposition over all diagrams with that polynomial. The resulting money state is

$X$1

with $X$2 as the public serial number encoded by the coefficient list of the polynomial. If $X$3, the state is discarded and minting restarts, since splittable links have Alexander polynomial $X$4 and are excluded (Farhi et al., 2010).

The knot invariant used as serial number is computed from the diagram by constructing a matrix from local crossing relations and then taking a normalized determinant. The protocol uses the polynomial as a list of coefficients rather than a value at a point, and the paper states that it can be computed in polynomial time from the diagram. This makes the invariant suitable for public labeling even though it is far from a complete knot invariant (Farhi et al., 2010).

3. Public verification by topology-preserving random walks

Verification has two conceptually distinct parts. First, the purported note must have support only on valid grid-diagram encodings with the claimed Alexander polynomial. Second, the amplitudes must have the correct uniformity structure across diagrams related by allowed grid moves. The public verifier therefore performs the following sequence: it checks that the state is a superposition of valid encodings of grid diagrams, measures the Alexander polynomial and accepts only if the result is the claimed serial number $X$5, projects onto grid dimensions in

$X$6

and then applies a Markov-chain-based quantum verification test (Farhi et al., 2010).

The verifier’s main technical device is an auxiliary register that converts the dimension-dependent weighting into a uniform superposition over pairs $X$7. A unitary $X$8 is defined by

$X$9

Applying $O$0 to the money state yields

$O$1

which is literally uniform over admissible pairs $O$2 satisfying the serial-number constraint (Farhi et al., 2010).

A classical Markov chain is then defined on these pairs. Its transitions either change the auxiliary label $O$3 or perform a legal grid move on $O$4, including cyclic permutations of rows or columns, legal transpositions of adjacent rows or columns, and stabilization or destabilization in one of four orientations. The Markov matrix is

$O$5

where each $O$6 is a permutation of the configuration space of valid pairs $O$7. Quantum mechanically, the verifier adds a move-label register initialized in the uniform superposition, applies the controlled move operator

$O$8

and repeatedly measures the projector

$O$9

If all $O$0 outcomes are $O$1, the note is accepted; the verifier then uncomputes the ancillas and returns the state essentially undamaged (Farhi et al., 2010).

For a genuine note, the idealized description gives perfect passage through this test, because the target state is invariant under the controlled random moves: each $O$2 only permutes uniformly weighted basis states inside the valid set. For an arbitrary input $O$3, if $O$4, then after $O$5 rounds the acceptance probability is

$O$6

This identifies verification as a quantum test for stationarity under random topology-preserving rewritings of the diagram (Farhi et al., 2010).

4. Security intuition, attack surfaces, and known limitations

The proposal is explicit that public-key quantum money cannot rely on information-theoretic no-cloning alone. Because verification is public, the scheme cannot be unconditionally secure and instead relies on computational assumptions. The original paper states that the construction is not proved secure; it is presented as a concrete candidate scheme expected to resist computationally bounded adversaries (Farhi et al., 2010).

Its security intuition is tied to the difficulty of reconstructing the correct coherent superposition after extracting partial classical information. If an adversary measures a valid note and obtains a particular grid diagram $O$7 with Alexander polynomial $O$8, the obvious counterfeit target is the correctly weighted superposition over all diagrams equivalent to $O$9. The paper argues that an algorithm for this would effectively solve the grid-diagram equivalence problem in a strong coherent form, which is believed hard on average. The intended barrier is therefore not merely finding collisions of the Alexander polynomial, but coherently producing a state that survives the Markov-chain stationarity test (Farhi et al., 2010).

Several attack avenues are discussed. One concern is the dimension cutoff $X$0: there may be “boundary” diagrams near maximal dimension from which allowed moves do not mix broadly, so the verifier includes the central dimension-window projection as a safeguard. A second concern is spectral: if the Markov chain mixes poorly even away from the boundary, there may exist other eigenstates of $X$1 with eigenvalues close to $X$2, and such states could pass verification with nonnegligible probability. A third concern is cloning-style attacks analogous to those that affected earlier product-state schemes. The paper does not exhibit successful attacks of these forms, but it treats them as real caveats rather than dismissing them (Farhi et al., 2010).

Later work sharpened this criticism. Aaronson and Christiano, in presenting hidden-subspace money, wrote that the main disadvantage of the knot-based scheme is that no one can say much about its security other than that it had not yet been broken and that known strategies fail; they also stated that even characterizing which quantum states the verification procedure accepts remains a difficult open problem (Aaronson et al., 2012). This comparison did not refute the knot proposal, but it raised the evidentiary standard by contrasting it with a scheme whose verifier is exactly the rank-one projector

$X$3

and whose black-box security can be proved in a classical-oracle model (Aaronson et al., 2012).

5. Abstractions and reinterpretations after the original proposal

A major line of follow-up work abstracted the knot construction into hidden-partition and invariant-based frameworks. Lutomirski introduced the notion of a component mixer: a black-box family of invertible maps acting within hidden components of a partition and mixing nearly uniformly inside each component. In this abstraction, the money state associated to a component is the uniform superposition over that component, and the attack of measuring a note and trying to rebuild it becomes the problem of generating the component superposition from a classical representative. Lutomirski did not prove full security of knot-based money, but he did prove that if component superposition is hard, then the corresponding simple counterfeiting task is also hard; since same-component reduces to component superposition, hardness of same-component also gives hardness evidence for simple counterfeiting (Lutomirski, 2011).

Aaronson and Christiano’s hidden-subspace scheme served simultaneously as a sibling construction and as a critique. Their public-key money state is the uniform superposition over a hidden $X$4-dimensional subspace $X$5, and verification consists of two complementary tests, one in the standard basis and one in the Hadamard basis, with

$X$6

They explicitly described their scheme as simpler than previous public-key proposals, including the knot-based one, and used that simplicity to obtain perfect completeness and formal soundness guarantees in oracle and conjectural explicit models (Aaronson et al., 2012).

A later framework, called invariant money, explicitly extracted the common architecture behind knot money. In that formulation one has sets $X$7 and $X$8, an efficiently computable invariant $X$9, and efficiently computable invertible permutations $X$0 satisfying

$X$1

Honest money is obtained by preparing the uniform superposition over $X$2, measuring the invariant, and thereby collapsing onto the fiber over a serial number $X$3. Verification first checks the invariant value and then projects onto the subspace of states that are constant on each orbit induced by the permutations. The framework proves that if the random walk over each orbit mixes, then approximate verification can implement the ideal orbit-uniform projector; under path-finding and knowledge-of-path assumptions, the same architecture yields quantum lightning rather than merely public-key money (Liu et al., 2022).

This invariant-money framework identified the knot instantiation directly: $X$4 is essentially the set of knot diagrams, the permutations are Reidemeister moves, and the invariant is the Alexander polynomial. At the same time, it emphasized that the required mixing property is not known for the knot construction and that a formal proof of such mixing would likely require progress on longstanding knot-theoretic problems. It also noted that a uniform mixing process for knots could only work in polynomial time if the number of Reidemeister moves between all equivalent knots of a certain size were bounded, whereas the only known bound quoted there is a “tower of exponentials” function (Liu et al., 2022).

6. Knot-theoretic extensions and mathematical infrastructure

Work subsequent to the original proposal enlarged the mathematical backdrop for knot-based verification predicates, even when it did not produce money schemes directly. A 2025 paper on quantum cocycle invariants from Yang–Baxter cohomology is explicit that it is not a quantum-money proposal and does not discuss cryptographic protocols directly. Its contribution is to deform Yang–Baxter operators by $X$5-cocycles and use the resulting enhanced operators to produce knot invariants. In that framework, a Yang–Baxter $X$6-cocycle $X$7 gives an infinitesimal deformation

$X$8

that preserves the Yang–Baxter equation exactly when $X$9 is closed, and the $O$0-coefficient of the resulting Turaev invariant is the quantum cocycle invariant. The same paper shows that quandle cocycle invariants fit inside this deformation theory and that the Jones and Alexander polynomials arise as higher-order Laurent deformations (Saito et al., 4 Sep 2025).

For knot-based quantum money, the importance of that result is indirect. The paper itself states that its most relevant use for a query like “Quantum Money from Knots” is as technical background for verification primitives based on knot or braid data rather than as a direct source of unclonable quantum states. A plausible implication is that such deformation-based invariants could enrich the family of publicly computable observables available to hypothetical knot-based verifiers, especially because the framework unifies quandle cocycle invariants, Jones, and Alexander inside a common Yang–Baxter-cohomological language (Saito et al., 4 Sep 2025).

A different line of background work developed a dictionary between quantum-information structures and knot- and manifold-based topology. In particular, $O$1-dimensional POVMs defined from finite-index subgroups of $O$2 were identified with $O$3-fold coverings over the trefoil knot, and related constructions were explored for the figure-of-eight knot, the Whitehead link, Borromean rings, and manifolds obtained by Dehn fillings. That work does not define banknote states, verification algorithms, or no-cloning theorems, but it supplies candidate topological encodings of quantum states and measurements via knot complements and covering manifolds (Planat et al., 2018).

Taken together, these later developments place quantum money from knots within a broader research program. The original proposal contributed a concrete public-key candidate based on superpositions over grid diagrams with a fixed Alexander polynomial and verification by a Markov-chain stationarity test. Follow-up work clarified the hidden-partition structure underlying the scheme, compared it with cleaner algebraic alternatives, and supplied increasingly precise criteria—mixing, accepted-state characterization, path-finding hardness, and knowledge-of-path assumptions—for what a convincing knot-based quantum money construction would need to establish (Farhi et al., 2010).