I was reading over the specification for the Open Assets (colored coins) protocol. It seems that keeping track of Asset ownership requires looking up the
scriptPubKey for each input in a transaction, and possibly even recursively looking up the prevouts for inputs, in order to verify the chain of ownership. Full nodes can do this, as they process all blockchain data.
However, it's possible to make a transaction that looks like a valid Open Assets transaction, but that breaks the link in ownership somewhere along the way. More confirmations won't help convince SPV nodes that the transaction is a valid OA transaction, as miners do not enforce that all transactions structured as OA transactions are actually valid.
Can SPV nodes participate in the Open Asset protocol with any reasonable security?