Known-bit quantum money forgery ($p_{\mathrm{pass}}^{\mathrm{opt}}=(1+1/\sqrt{2})/2$)

If a known classical bit is independently encoded in a secret uniformly chosen X or Z eigenbasis, the averaged verification operator is $A_b=I/2+(-1{)}^b(X+Z)/4$. Its largest eigenvalue is the displayed optimal acceptance probability for a counterfeit prepared without the original qubit. The maximizing state bisects the two candidate Bloch directions. For $n$ independent secret bases, the maximal all-pass probability is the $n$th power, because the total acceptance operator is a tensor product. Randomly choosing one of the legitimate encodings instead passes with probability $3/4$ per bit.