  We define the notion of a proof of knowledge in the setting where the
verifier is classical, but the prover is quantum, and where the witness that
the prover holds is in general a quantum state. We establish simple properties
of our definition, including that, if a nondestructive classical proof of
quantum knowledge exists for some state, then that state can be cloned by an
unbounded adversary, and that, under certain conditions on the parameters in
our definition, a proof of knowledge protocol for a hard-to-clone state can be
used as a (destructive) quantum money verification protocol. In addition, we
provide two examples of protocols (both inspired by private-key classical
verification protocols for quantum money schemes) which we can show to be
proofs of quantum knowledge under our definition. In so doing, we introduce
techniques for the analysis of such protocols which build on results from the
literature on nonlocal games. Finally, we show that, under our definition, the
verification protocol introduced by Mahadev (FOCS 2018) is a classical argument
of quantum knowledge for QMA relations. In all cases, we construct an explicit
quantum extractor that is able to produce a quantum witness given black-box
quantum (rewinding) access to the prover, the latter of which includes the
ability to coherently execute the prover's black-box circuit controlled on a
superposition of messages from the verifier.
