Is the quantum/AI threat model fundamentally different for monero?

<!-- SC_OFF --><div class="md"><p>[Shower thought]</p> <p>People are very worried about reverse-computing private keys from public keys on chains like BTC. </p> <p>Example attack - find a wallet with 1000 BTC, and point your powerful quantum computer or crazy powerful AI model at it and reverse the public key derivation (obtain the private key)</p> <p>With monero, this is different for a few reasons:</p> <p>- you can't be sure how much a UTXO is worth. You may use tons of resources brute-forcing a key that has $5 or $100M behind it</p> <p>- once you've brute forced a key, you <em>then</em> can check if it has been spent, because of key images. So you may find a UTXO that's already become spent</p> <p>I guess with powerful compute resources, one could also reverse the key-image generation, right? So without stealing any coins, someone could damage the privacy of Monero in a major way, potentially de-anonymizing all transactions.</p> <p>Thoughts? </p> </div><!-- SC_ON --> submitted by <a href="https://www.reddit.com/user/Turbulent-Impress301"> /u/Turbulent-Impress301 </a> <br/> <span><a href="https://www.reddit.com/r/Monero/comments/1xcqwqs/is_the_quantumai_threat_model_fundamentally