Measurement-device-independent randomness generation with arbitrary quantum states

TL;DR

This paper presents a framework for device-independent quantum randomness generation that accommodates arbitrary input states and measurements, enabling high-rate randomness extraction even with untrusted detectors.

Contribution

It introduces a generalized analysis method for measurement-device-independent randomness generation with arbitrary quantum states and measurements, expanding previous schemes.

Findings

High randomness generation rates of over one bit per qubit.

Applicable to realistic implementations with untrusted detectors.

Framework accommodates arbitrary input states and measurements.

Abstract

Measurements of quantum systems can be used to generate classical data that is truly unpredictable for every observer. However, this true randomness needs to be discriminated from randomness due to ignorance or lack of control of the devices. We analyze the randomness gain of a measurement-device-independent setup, consisting of a well-characterized source of quantum states and a completely uncharacterized and untrusted detector. Our framework generalizes previous schemes as arbitrary input states and arbitrary measurements can be analyzed. Our method is used to suggest simple and realistic implementations that yield high randomness generation rates of more than one random bit per qubit for detectors of sufficient quality.

Equations

$$\displaystyle\rho_{XAE}=\sum_{x}p_{x}\big{|}{x}\big{>}\big{<}{x}\big{|}_{X}\otimes\rho_{AE}(x),$$

$${\mathcal{R}}_X$$

$$H_{\text{min}}(X|AE)=-{\log }_2(P_{\text{guess}}^{\ast }(X|AE)),$$

$$P_{\text{guess}}^{\ast }(X|AE)=\underset{\{F(x)\}}{\max }\sum _x{p}_x\text{tr}\left(F(x){\rho }_{AE}(x)\right).$$

$$\displaystyle\rho_{\textrm{in}}=\sum_{a}p_{a}\big{|}{a}\big{>}\big{<}{a}\big{|}_{A}\otimes\rho_{A^{\prime}}(a)\otimes\sigma_{E^{\prime}E},$$

$${\tau }_{AE}(x)=\frac{1}{p_x}{\text{tr}}_{A^{\prime }{E}^{\prime }}\left(G_{A^{\prime }{E}^{\prime }}(x)\otimes \text{mathbbm}{1}_{AE}{\rho }_{\text{in}}\right),$$

$$p_{x,e}=p_x\text{tr}\left(F_{AE}(e){\tau }_{AE}(x)\right).$$

$$p_{x,e}$$

$$=\text{tr}\left(G_{A^{\prime }{E}^{\prime }}(x)\otimes F_{AE}(e){\rho }_{\text{in}}\right),$$

$$\displaystyle F_{AE}(e)=\sum_{a}\big{|}{a}\big{>}\big{<}{a}\big{|}_{A}\otimes F_{E}(e|a),$$

$$F_E(e|a)\ge 0,\sum _e{F}_E(e|a)=\text{mathbbm}1\forall a.$$

$${\lambda }_{e|a}{\sigma }_{E^{\prime }E}(e,a)={\text{tr}}_{A^{\prime }A}\left(\sqrt{F_{AE}(e)}{\rho }_{\text{in}}(a){\sqrt{F_{AE}(e)}}^{†}\right),$$

$$\sum _e{\lambda }_{e|a}{\sigma }_{E^{\prime }}(e,a)={\sigma }_{E^{\prime }}\forall a,$$

$$p_{x,e}$$

$$=\sum _a{p}_a\text{tr}\left(G_{A^{\prime }{E}^{\prime }}(x){\rho }_{A^{\prime }}(a)\otimes {\lambda }_{e|a}{\sigma }_{E^{\prime }}(e,a)\right),$$

$$P_{\text{obs}}(x,a)$$

$$=p_a\text{tr}\left(G_{A^{\prime }{E}^{\prime }}(x){\rho }_{A^{\prime }}(a)\otimes {\sigma }_{E^{\prime }}\right).$$

$$P_{\text{guess}}^{\ast }(X|AE)=\underset{\{G,\hat{\sigma }\}}{\max }\sum _{x,a}{p}_a\text{tr}\left(G(x)\rho (a)\otimes \hat{\sigma }(x|a)\right)$$

$$\text{such that}G(x)\ge 0,\sum _{x}G(x)=\text{mathbbm}1,$$

$$\hat{\sigma }(e|a)\ge 0,\sum _e\text{tr}\left(\hat{\sigma }(e|a)\right)=1\forall a,$$

$$\sum _e\hat{\sigma }(e|a)=\sum _e\hat{\sigma }(e|1)\forall a,\text{and}$$

$$P_{\text{obs}}(x,a)=\sum _e{p}_a\text{tr}\left(G(x)\rho (a)\otimes \hat{\sigma }(e|a)\right)$$

$$M_{x,e|a}:={\lambda }_{e|a}{\text{tr}}_{E^{\prime }}\left(G_{A^{\prime }{E}^{\prime }}(x)\text{mathbbm}{1}_{A^{\prime }}\otimes {\sigma }_{E^{\prime }}(e,a)\right),$$

$$P_{\text{guess}}^{\ast }$$

$$\sum _{x,e}{M}_{x,e|a}$$

$$\sum _x{M}_{x,e|a}\propto \text{mathbbm}1,$$

$$\sum _e{M}_{x,e|a}=\sum _e{M}_{x,e|a^{\prime }},$$

$$P_{\text{guess}}^{\ast }(X|AE)\le \underset{\{M_{x,e|a}\}}{\max }\sum _{x,a}{p}_a\text{tr}\left(M_{x,x|a}\rho (a)\right)$$

$$\text{s.t.}{M}_{x,e|a}\ge 0,\sum _{x,e}{M}_{x,e|a}=\text{mathbbm}1\forall a,$$

$$\sum _x{M}_{x,e|a}={\left[\sum _x{M}_{x,e|a}\right]}_{11}\cdot \text{mathbbm}1\forall e,a,$$

$$\sum _e{M}_{x,e|a}=\sum _e{M}_{x,e|1}\forall x,a,\text{mbox}and$$

$$P_{\text{obs}}(x,a)=\sum _e{p}_a\text{tr}\left(M_{x,e|a}\rho (a)\right)$$

$$P_{\text{obs}}(x,a)$$

$$H_{\text{min}}(X|A)=-\log \sum _a\underset{x}{\max }{P}_{\text{obs}}(x,a).$$

$$M_k={\alpha }_k(\text{mathbbm}1+{\vec{m}}_k\cdot \vec{\sigma })\text{with}$$

$${\alpha }_k>0,\sum _k{\alpha }_k=1,\sum _k{\alpha }_k{\vec{m}}_k=0.$$

$$⟨+|M_k|+⟩\equiv {\alpha }_k(1+{\vec{m}}_k\cdot {\vec{e}}_1)=\frac{1}{n_o}\forall k=1,\dots ,n_o.$$

Full text

I Introduction

Random numbers are a fundamental resource for many information-theoretical tasks, in particular cryptography. For any task that requires secrecy, it is important that the random numbers are unpredictable for every observer, also a potential eavesdropper - a property, which is called true randomness frauch13 , or private randomness colbeck2009quantum . This notion crucially depends on the process creating the random numbers and its underlying physics, and not just the numbers themselves. In the deterministic classical world, randomness is the result of ignorance and hence a subjective property, which cannot be proven for a powerful adversary. In nature however, private randomness is made possible by the intrinsic unpredictability of quantum measurements: even if the whole system is known, outcomes cannot be predicted with certainty. Yet, even in quantum mechanics, true randomness cannot be certified without further assumptions. This is because realistic settings always exhibit a mixture of true quantum randomness and classical randomness. The latter may stem from uncontrolled environmental degrees of freedom, but needs to be attributed to an eavesdropper’s malicious tampering with the devices. The challenge consists of separating and quantifying these types of randomness, while keeping the assumptions experimentally viable.

The amount of certifiable randomness depends on the level of control over the devices law14 . Device-independent (DI) randomness generation protocols col11 ; pironio2010random ; arnon2016simple view all devices as black boxes, and certify randomness via the violation of a Bell-type inequality and thus require loophole-free Bell tests. While these have recently been demonstrated experimentally giustina2015significant ; shalm2015strong , DI randomness generation setups are far from practical.

More practical schemes are obtained by introducing additional assumptions, e.g. semi-device-independent randomness generation li2011semi ; brask2016high , or the quantum steering scenario passaro2015optimal and others. In this work, we discuss measurement-device-independent (MDI) randomness generation, of which a particular instance was introduced by ma15 and has recently been realized in experiment nie2016experimental . The MDI setup consists of two devices: a well-characterized state source and a completely uncharacterized detector. While previous work ma15 provides the randomness generation rate of a specific two-outcome single-qubit setup, we introduce and analyze a general framework which encompasses all MDI randomness generation setups, with an arbitrary state source and detector. This allows us to devise practical setups that yield up to twice the randomness of the previous work ma15 .

This paper is structured as follows. In Sec. II we introduce the general MDI randomness generation protocol. In Sec. III we discuss the eavesdropper’s degrees of freedom and state the optimization problem in terms of a semidefinite program. Finally, examples and practical applications of our result are provided in Sec. IV.

II Measurement device-independent randomness generation

II.1 Setup and Protocol

The MDI randomness generation setup consists of two devices (see Fig. 1). First, a source, able to emit a set of well-characterized quantum states of arbitrary (finite) dimension. In particular, for the input $a$ the state $\rho(a)$ is sent. Secondly, an uncharacterized detector which announces an outcome $x$ whenever a state was sent. The knowledge of the quantum states and the measurement results are used to characterize the detector.

We denote the user of the protocol Alice, and the adversary Eve. Alice sets up the devices in a secure laboratory which is shielded from any kind of information transfer to the outside world. It is verified that the sending box has no further degrees of freedom than to emit a quantum state upon receiving a specific input. The adversary Eve may have built the detector, but has no access to the laboratory afterwards.

The sent states $\rho(a)$ are selected via an initial string of random numbers. Because of that, we describe a randomness expansion scheme colbeck2009quantum ; col11 : a user with access to an initial random string $\mathbb{A}=(a_{1},a_{2},\dotsc)$ interacts round-wise with a device leading to a string $\mathbb{X}=(x_{1},x_{2},\dotsc)$, containing the in- and output of each round, respectively. The randomness expansion protocol then outputs a processed string $\tilde{\mathbb{X}}(\mathbb{X})$ which is close to uniform, conditioned on $\mathbb{A}$ as well as on any side information $E$ previously stored in the device.

The MDI randomness expansion protocol is as follows:

For every round, do Steps 2-3: 2. 2.

The sending box sends a state $\rho(a)$ of dimension $d$ with randomly chosen $a\in\{1,\dotsc,n_{s}\}$ to the measurement box. On average, this uses up $\sum_{a}p_{a}(-\log_{2}(p_{a}))$ bits of the initial randomness per round, where $p_{a}$ denotes the probability that $\rho(a)$ was sent. 3. 3.

After the state $\rho(a)$ has been sent, the measurement box outputs $x\in\{1,\dotsc,n_{o}\}$ distributed according to $p_{x}$. Potential losses can be announced as an extra no-detection outcome which is appended to the proper outcomes, or the device randomly attributes measurement results which contributes to the noise. The only requirement is that the detector gives an outcome in every round. 4. 4.

After many rounds, Alice estimates the observed measurement statistics $P_{\textrm{obs}}(x,a)=p_{a}P_{\textrm{obs}}(x|a)$, i.e. the probability that the pair $(x,a)$ occurs. From that the randomness gain per round $\mathcal{R}_{X}$ can be computed (see below). 5. 5.

Alice uses some further bits of the initial random string to post-process the raw output into a shorter string of fresh private random numbers.

In the last step of the protocol, the user applies a quantum-secure extraction protocol to transform the output string $\mathbb{X}$ to a string $\tilde{\mathbb{X}}$ that is close to uniform with respect to Eve and the input. This can be done via seeded extraction, e.g. two-universal hashing, for which some further random bits are needed. For details, see frauch13 and references therein.

II.2 Randomness quantification

For the extraction protocol it is necessary to quantify the minimal number of bits needed for Eve to reconstruct the measurement result from her side information, i.e. the conditional min-entropy renner2008security . The single-round degrees of freedom in randomness expansion can be described by a tripartite state $\rho_{XAE}$ on the single-round classical out- and input registers and Eve’s system, which reads

[TABLE]

where $\{\left|x\right>\}$ denotes a family of orthonormal states on $X$. The randomness contained in the random variable $X$, associated to $p_{x}$, is quantified by the conditional min-entropy

[TABLE]

that measures the unpredictability of $X$ with respect to the classical system $A$ and the quantum system $E$. For $cq$-states it is known koerenn that the min-entropy can be expressed via the optimal guessing probability

[TABLE]

defined as

[TABLE]

Here, $\{F(x)\}$ denotes a POVM on the system $AE$, i.e. a collection of positive-semidefinite operators $F(x)\geq 0$ fulfilling $\sum_{x=1}^{n_{o}}F(x)=\mathbbm{1}$.

III Analysis of randomness generation

III.1 Eavesdropping characterization

Before introducing the degrees of freedom in the MDI setup, we list the assumptions below.

The laboratory is shielded from any information transfer to the outside. 2. 2.

The sending device’s behavior is fully characterized to emit a single specific state $\rho(a)$ upon receiving the input $a$. 3. 3.

The measurement device employs an i.i.d. strategy, i.e. it behaves independently and identically in each round. 4. 4.

We consider the asymptotic limit, i.e. the measurement statistics is precisely known.

The first condition is necessary in any randomness expansion scheme, since otherwise the generated output could be transmitted to Eve directly. The second assumption is what differentiates MDI from fully device-independent schemes. The third condition corresponds in the language of QKD to individual attacks. In ma15 , the authors describe how to prove security of the MDI setup against collective attacks, solely by employing the security proof against individual attacks and convexity arguments. If the arguments given there hold, this proof would also be applicable in our analysis, extending the result to collective attacks. 111However, we are not sure whether the tensor product structure of the (effective) detector POVM across different rounds, employed in the proof, can be guaranteed for MDI collective attacks.

Given these assumptions, the eavesdropper’s most general strategy in the MDI setup is as follows. Eve has built the measurement apparatus that deviates from the honest device in two ways (see Fig. 2). First, to obtain correlations with the measurement outcome, she has hidden a system $E^{\prime}$ in the box. Her distant laboratory $E$ and the hidden system share a state $\sigma$ that may contain arbitrary amounts of entanglement. Secondly, upon receiving the incoming states $\rho(a)$, the measurement apparatus performs an unknown measurement $\{G(x)\}$ on it and part of $\sigma$, leading to the outcome $x$ in the lab. Eve aims to adjust her state and the performed measurements in such a way, that she is perfectly correlated with the lab outcome, while producing the measurement statistics expected from the device. Furthermore, the analysis includes the correlation of the output system $X$ with the input system $A$. Conditioning on the input ensures the outcome randomness to be “fresh”, i.e. independent of the initial randomness.

III.2 Degrees of freedom in the MDI setup

In order to characterize the general way how the state in Eq. (1) is obtained in the MDI setup, we introduce the relevant systems and operators below. Each system $S$ is associated to a Hilbert space $\mathcal{H}_{S}$, on which the operators act.

$A$ and $X$ denote classical registers that store the input $a$ and output $x$ of each round, respectively. 2. 2.

The incoming state $\rho(a)$ is associated to $A^{\prime}$. 3. 3.

Eve has equipped the measurement apparatus with an additional system $E^{\prime}$ that shares an arbitrary state $\sigma$ with her site $E$. 4. 4.

The measurement box performs an unknown POVM $\{G(x)\}$ with $n_{o}$ outcomes on the primed system $A^{\prime}E^{\prime}$ whose result is stored in $X$. 5. 5.

The optimal POVM from Eq. (4) on $AE$ is denoted by $\{F(e)\}$, with $e\in\{1,\dotsc,n_{o}\}$.

In the following, we formulate the security analysis as an optimization problem, whereby $A$ and $E$ try to guess $X$, while their operations are consistent with the classical data in the lab. The initial average global state reads

[TABLE]

while the register $X$ is initialized with an uncorrelated state. We denote by $\rho_{\textrm{in}}(a)$ the initial global state if $a$ has occurred. The box-measurement $\{G(x)\}$, which acts on $A^{\prime}E^{\prime}$, maps the state on $AE$ into an ensemble $\{p_{x},\tau_{AE}(x)\}$ given by

[TABLE]

where $\textrm{tr}_{S}$ denotes the partial trace over $S$. According to Eq. (4), these states are distinguished by a measurement $\{F(e)\}$. Its outcome $e=x$ represents the system $AE$’s guess of the output $x$ of the detector.

We denote the probability of the event $(x,e)$ as $p_{x,e}$, which is given by

[TABLE]

With that, the guessing probability from Eq. (4) can be formulated as $P^{*}_{\textrm{guess}}(X|AE)=\max\limits_{\{F(x)\}}\sum_{x}p_{x,x}$. By combining Eq. (6) and (7), we obtain

[TABLE]

where in the second line we have used that for all linear operators $L_{1}$ on $\mathcal{H}_{1}$, and $\Gamma_{12}$ on $\mathcal{H}_{1}\otimes\mathcal{H}_{2}$, it holds that $L_{1}\textrm{tr}_{2}\!\left(\Gamma_{12}\right)=\textrm{tr}_{2}\!\left(L_{1}\otimes\mathbbm{1}\Gamma_{12}\right)$. In Ref. tomaphd it was proven, that when conditioning on classical information, here given by the register $A$, the optimal measurement in Eq. (4) consists of choosing an optimal POVM on $E$ for each $a$, i.e.

[TABLE]

where $\{F_{E}(e|a)\}$ is a family of POVMs on $E$ (with outcome $e$), indexed by $a$, fulfilling

[TABLE]

Next, we consider the action of the measurement $F_{AE}(e)$ on the initial global state $\rho_{\textrm{in}}(a)$ for an observer with access to $A$. The state after measurement on $E^{\prime}E$ is given by

[TABLE]

where $\lambda_{e|a}$ denotes the probability to obtain the outcome $e$ given $a$, and $\sigma_{E^{\prime}E}(e,a)$ is the corresponding conditional state. Note, that the unitary degree of freedom of the post-measurement state will play no role in the following, as the system $E$ will be traced out. Since Eve’s outside laboratory has no access to the input, her description of the post-measurement state is given by $\sum_{a}p_{a}\lambda_{e|a}\sigma_{E^{\prime}E}(e,a)$. Note, that because of the preparation by measurement, it holds that $\sigma_{E^{\prime}}(e,a)=\textrm{tr}_{E}\!\left(\sigma_{E^{\prime}E}(e,a)\right)$ is independent of $a$, when averaged over $e$

[TABLE]

i.e. the index $a$ determines a particular ensemble $\{\lambda_{e|a},\sigma_{E^{\prime}}(e,a)\}$ of the state $\sigma_{E^{\prime}}$. This is because a local measurement, if the outcome cannot be communicated, does not influence a remote part of a state. It is known from quantum steering, that for a suitable global state, any local state can be prepared by a measurement on the other side hughston1993complete .

Altogether, we obtain

[TABLE]

where only the (primed) degrees of freedom in the measurement box need to be considered.

In our protocol we observe the statistics $P_{\textrm{obs}}(x,a)$, which constrains any valid strategy

[TABLE]

Here, the average over Eve’s outcomes was taken, because they are unobservable for the user, and we have used Eq. (12) and (III.2) in the second line.

III.3 The optimization problem

We summarize the results of the previous section, by stating the optimization problem for the guessing probability. Since we are left with only two subsystems in the detector $A^{\prime}E^{\prime}$, we omit the system subscript

[TABLE]

The optimization runs over ensembles $\{\hat{\sigma}(e|a)\}$ with $\hat{\sigma}(e|a)=\lambda_{e|a}\sigma(e,a)$ of arbitrary dimension and a POVM $\{G(x)\}$ acting on it and the incoming state. The fourth line represents the requirement from Eq. (12), and the last line ensures that the detector degrees of freedom give rise to the observed probability distribution. This optimization problem is not straightforwardly feasible, as it has a nonlinear target function with linear and semidefinite constraints. However, we observe that the degrees of freedom relevant for the guessing probability can be combined into a single effective measurement acting only on the known state $\rho(a)$. For that, we define an effective measurement $M_{x,e|a}$ on $\mathcal{H}_{A^{\prime}}$ via

[TABLE]

with which we can write

[TABLE]

by comparison with Eq. (15). We will instead optimize over a superset of the actual degrees of freedom relevant for the guessing probability, that consists of linear operators $M_{x,e|a}$ on $\mathcal{H}_{A^{\prime}}$ with semidefinite and linear constraints that follow from Eq. (16). This, in turn, will yield an upper bound to the guessing probability and consequently a lower bound to the randomness gain. These constraints are as follows. The operator defined by Eq. (16) is positive semidefinite, since all constituents are positive semidefinite, and furthermore fulfills for all $a$

[TABLE]

where we have used Eq. (12) in the first equality. Thus, it has the properties of a family of POVMs on $\mathcal{H}_{A^{\prime}}$, indexed by $a$, where the outcome $x$ goes to Alice and $e$ to Eve. Two further properties can be observed, which read

[TABLE]

where Eq. (19) follows directly from Eq. (16), and Eq. (20) follows from Eq. (12). Thus, strategies given by a POVM family $\{M_{x,e|a}\}$ with properties (19) and (20) include the actual strategy (15), but may not fully characterize it. The new formulation is characterized by only linear and semidefinite constraints and due to the linearity of the target function can be cast into the form of a semidefinite program (SDP).

Theorem 1**.**

The optimal guessing probability in any MDI randomness generation setup, subject to the assumptions explained in (III.1), is upper bounded by the solution of the following SDP

[TABLE]

The second line characterizes the operators $\{M_{x,e|a}\}$ as a POVM for each $a$. The third and fourth line ensure that the POVM family $\{M_{x,e|a}\}$ obeys the properties (19) and (20), respectively, which follow from the form of the effective measurement (16). The former property may be interpreted as a nonsignalling condition between the detector and Eve’s site, and the latter as a nonsignalling condition between the systems $A$ and $E$. The notation $[M]_{11}$ denotes the $(1,1)$-element of the matrix $M$. The last line ensures that the adversary’s operations actually give rise to the observed measurement statistics $P_{\textrm{obs}}$ in the laboratory. The outcome of the SDP provides via Eq. (2) and (3) a lower bound to the randomness generated per round $\mathcal{R}_{X}$ in the measurement-device-independent setup.

IV Results

For any MDI setup with arbitrary detector and state source, the observed probability vector can be read into the SDP (21) to determine the randomness of the output bits. In the following, we will discuss which sets of states $\{\rho(a)\}$ and observed distributions $p_{a}P_{\textrm{obs}}(x|a)$ are optimal in practical setups.

Our model of the detector behavior consists of a proposed ideal quantum measurement mixed with white noise

[TABLE]

where $P_{\textrm{id}}$ is the distribution of the ideal measurement, $\eta\in[0,1]$ is a quality parameter, $n_{o}$ is the number of outcomes, and $p_{a}$ is the input distribution.

In order to characterize the detector, we make use of the tomographically complete qubit state set $\{\left|+\right>,\left|0\right>,\left|1\right>,\left|+i\right>\}$, corresponding to the $\pm 1$-eigenstates of Pauli $\sigma_{z}$ and the $+1$-eigenstates of $\sigma_{x},\sigma_{y}$. We employ pure states since we wish to minimize the input randomness.

An upper bound of the MDI randomness gain is given by the classical conditional min-entropy of the in- and output distributions tomaphd

[TABLE]

In order to maximize this expression we need to have unbiased measurement outcomes $x$ for every input $a$. Since for an ideal quantum measurement we cannot ensure unbiased outcomes with respect to each of the input states, we make use of an input distribution $p_{a}$ that is almost sharp, i.e. the first state $\left|+\right>$ is sent with probability $q\equiv p_{1}\to 1$, and the other states are only sent rarely to characterize the detector. We call the parameter $q$ asymmetry of the distribution $p_{a}$. Furthermore, an asymmetric choice of inputs is desirable for randomness expansion in the asymptotic limit, as it reduces the input randomness, see Step 2 of the protocol in Sec. II.

To make the limit $q\to 1$ feasible in the SDP, we divide all rounds into test and generation rounds: in test rounds, states are sent according to a uniform distribution, and in generation rounds, only $\rho(1)$ is sent. The asymptotic limit is then defined as: number of rounds $N\to\infty$. Simultaneously we take the limit $q\to 1$ to ensure maximal asymmetry. Similarly to QKD Eve’s optimal strategy is now as follows: She provides a POVM that reproduces the expected measurement statistics in the test rounds, but aims at optimally predicting the outcomes of generation rounds, since test rounds have negligible contribution to the total guessing probability in the limit $q\to 1$.

In this asymmetric scenario, the optimal situation for randomness generation (expansion) corresponds to the measurement statistics of a POVM with three properties: i) the POVM is extremal d2005classical , i.e. it cannot be given as a mixture of two different POVMs haapasalo2012quantum . This ensures that its outcomes cannot be predicted by having access to a random variable (which determines the mixing) and thus maximizes randomness with respect to the measurement apparatus controlled by Eve. ii) the POVM has unbiased outcomes for the first input state i.e. the output distribution has maximal entropy. iii) the POVM has $d^{2}$ outcomes for the state space dimension $d$. This is because $d^{2}$ corresponds to the highest number of independent outcomes: any further POVM element can be written as a linear combination of previous ones, which amounts to classical post-processing that cannot increase the true randomness. Therefore, the maximally achievable randomness is $2\log d$ bits acin2016optimal .

We stress, that this POVM is realized in the optimal honest device, i.e. a device that implements a particular pre-defined POVM. The semidefinite program, on the other hand, finds the optimal measurement for Eve that gives rise to the measurement statistics expected from the honest device.

IV.1 Single qubit setups

From the previous section, it follows that a qubit measurement can have up to 4 independent outcomes. In the following, we compare the performance in randomness gain of different sets of sent states and numbers of outcomes. In practice, the configuration is chosen by taking into account which states and measurements are most readily available in the laboratory.

In general, qubit POVM elements can be decomposed as

[TABLE]

where $k=1,\dotsc,n_{o}$. To ensure unbiased measurement outcomes with respect to the most frequent state, we require

[TABLE]

Furthermore, we have the following extremality conditions d2005classical . The POVM elements are rank-one, which is ensured by normalized measurement directions $\lvert\vec{m}_{k}\rvert=1$. Additionally, the measurement operators are linearly independent. This is fulfilled, e.g. for four outcomes, if and only if the measurement directions form a tetrahedron, i.e. they cannot lie in a common plane.

Note, that not all $\alpha_{k}$ can be equal, since then the property (25) would force all vectors to lie in the plane defined by $\vec{m}_{k}\cdot\vec{e}_{1}=c$, which violates the extremality condition. A maximally symmetric 4-outcome configuration is given by

[TABLE]

which we will make use of in the following.

Also, we will later employ a 3-outcome extremal POVM given by

[TABLE]

The following graphic Fig. 3 compares the performance of different numbers of outcomes and sent states in the asymptotic limit as a function of the detector quality $\eta$. For $n_{s}=2$ ($n_{s}=4$), states are drawn from the first two (all) elements of the set $\{\left|+\right>,\left|0\right>,\left|1\right>,\left|+i\right>\}$. The measurement statistics is described by Eq. (22), where $P_{\textrm{id}}$ is the distribution, which we obtain if, for $n_{o}=4$, the honest device implements the 4-outcome measurement (IV.1), and for $n_{o}=2$ a $\sigma_{z}$-measurement. The optimization is performed with standard tools such as YALMIP lofberg2005yalmip , and SDPT3 toh1999sdpt3 as solver. We observe that states drawn from a tomographically complete set in test rounds are clearly advantageous, since these allow for a better detector characterization. Moreover, the figure shows that for fixed input states, the performance of an extremal 4-outcome measurement is, depending on the visibility, up to twice as good as the best projective measurement. In particular, the maximal local randomness of two bits is reached for a noiseless detector ($\eta=1$). For a detector quality of $\eta\geq 97\%$, the setup generates more than one random bit per qubit. In the special case of a one-qubit sending box with tomographically complete states in the asymptotic limit, and ideal statistics given by a $\sigma_{z}$-measurement, our bound is equal to the exact formula from previous work ma15 .

IV.1.1 Randomness for different relative angles

We are also able to study the angle-dependency between two states of the MDI randomness rate. Consider the case of the observed distribution (22), where $P_{\textrm{id}}$ corresponds to the statistics of a $\sigma_{x}$-measurement. For any $\alpha\in[0,1]$, the two sent states are drawn from the set $\{\left|\phi_{\alpha}\right>,\left|\psi_{\alpha}\right>\}$ with

[TABLE]

Fig. 4 depicts the randomness generation rate for several detector qualities as a function of $\alpha\in[0,1]$. For $\alpha=0$ both states are identical $\left|\phi_{0}\right>=\left|\psi_{0}\right>=\left|0\right>$, and for $\alpha=1$ they become orthogonal $\left|\phi_{1}\right>=\left|+\right>,\left|\psi_{1}\right>=\left|-\right>$. In both cases the randomness generation rate vanishes, as expected. However, we observe that for an infinitesimally small but non-vanishing angle, we achieve near-maximal randomness for $\eta=1$, indicating that any amount of non-orthogonality in this scenario forces Eve to provide the honest measurement. More specifically, the $\eta=1$-line coincides with the classical min-entropy from Eq. (23). However, the feature of much randomness for almost no quantumness comes at the cost of two requirements: i) precisely characterized states to ensure that they are not identical ii) precise determination of the observed measurement statistics $P_{\textrm{obs}}$, because the randomness rate is discontinuous at $\alpha=0$, where no randomness can be extracted.

IV.1.2 The role of the asymmetry

In the asymptotic limit, and for a tomographically complete set of sent states, a higher asymmetry amounts to a higher gain in randomness for all detector qualities. However, we make the intriguing observation that for two sent qubit states $\{\left|+\right>,\left|0\right>\}$, the optimal asymmetry depends on the detector quality. For that, we make use of an ideal statistics of a $\sigma_{z}$-measurement. Fig. 5 shows that for detector qualities $\eta\gtrsim 0.8$ maximal asymmetry $q\equiv p_{1}\to 1$ is optimal, whereas for lower qualities a more balanced input distribution performs better. Because $\left|0\right>$ is an eigenstate of the measurement, asymmetric input distributions with higher $\left|+\right>$-contribution have less classical correlation of the in- and output and thus yield higher randomness close to the ideal measurement. On the other hand, the graphic indicates that asymmetric distributions lead to higher correlations of the output and the detector degrees of freedom for an increasing noise level.

IV.2 Multiple qubit setups

IV.2.1 Performance comparison

Here, we compare setups consisting of a sending device with states of dimension $d$ and a measurement box with $n_{o}=d$ outcomes. In particular, the sent states are tensor products of $m$ single-qubit states which are drawn from either the first two, or all elements of the set $\{\left|+\right>,\left|0\right>,\left|1\right>,\left|+i\right>\}$. The measurement statistics is described by Eq. (22), where $P_{\textrm{id}}$ is the distribution where the honest device implements a $\sigma_{z}^{\otimes m}$-measurement. We consider the asymmetric limit, in which the first state $\left|+\right>^{\otimes m}$ is sent almost always. To account for experimental resources, we normalize the randomness gain to the state dimension: $\mathcal{R}_{X}/\log_{2}d$, which is the randomness rate per qubit.

Fig. 6 depicts the randomness rate per qubit for several numbers of sent qubits $m=1,2,3$ per round. States drawn from a tomographically complete set in test rounds are clearly advantageous, as the upper two lines show, since these allow for a better detector characterization. Within our noise model from Eq. (22), the normalized randomness gain is essentially independent of the number of sent qubits. More precisely, it slightly increases with dimension for four sent states per qubit (upper two lines), and slightly decreases with dimension for two sent states per qubit (lower three lines).

Furthermore, we have investigated entangled measurements, such as a Bell state measurement, concluding that these do not generate more randomness and thus provide no advantage for increased experimental complexity.

IV.2.2 Individual vs. coherent attacks for two copies

Next, we wish to compare the performance of a single qubit setup with a two-qubit setup, in which all observable quantities correspond to two independent copies of the single setup. This allows us to assess whether coherent attacks, which act simultaneously on both qubits, provide an advantage over individual attacks. The results from Fig. 6 cannot be used for that, since there the two-qubit probability distribution is not the doubling of the one-qubit distribution.

Fig. 7 shows the difference of normalized randomness generation $\Delta:=\mathcal{R}_{X}(\textrm{1-qubit})-\frac{1}{2}\mathcal{R}_{X}(\textrm{2-qubit})$ of a one-qubit setup with tomographically complete states, and a two-qubit doubling. The single qubit statistics is given again by Eq. (22). The positive difference indicates that coherent attacks lead to more predictive power for Eve in the MDI setup. However, this assertion only holds if Eve can announce results of different round measurements simultaneously. It is an open question how Eve’s predictive power behaves in a sequential setup, where she is forced to announce an outcome in each round, but the device can have a memory. This means, that measurements of different rounds are in tensor product form, and act in general on the post-measurement state of all previous rounds, as well as a fresh ancilla arnon2016simple .

V Conclusion and Outlook

In this paper, we have introduced a general framework for randomness generation (i.e. expansion) with a well-characterized source of arbitrary quantum states and untrusted detector with arbitrary measurements. We presented a randomness generation protocol and analyzed its achievable gain in randomness depending on the observed measurement statistics and sent states. A lower bound on the randomness rate is calculated by a numerically feasible semidefinite program.

As an application, we have discussed several examples of simple MDI setups and outlined optimal honest strategies. In particular, we devised a one-qubit MDI setup with four outcomes, which achieves more than one random bit per qubit for experimentally achievable detector efficiencies. These setups are practical compared to fully device-independent schemes, since no loophole-free Bell tests are required. Moreover, they achieve nonzero randomness generation even for low detector quality, whereas DI protocols abort in this scenario pironio2010random .

Generalizations of our result are possible by relaxing assumptions we have made. Of primary interest are attacks beyond the i.i.d. assumption. In this scenario, i.i.d. is relaxed to sequential (round-wise) interaction with the devices, including the possibility of a detector memory. For fully device-independent sequential randomness expansion, it has been shown arnon2016simple that for more than $10^{8}$ rounds, the rate for general attacks is essentially the same as for i.i.d. attacks. We expect a similar behavior to hold in the case of MDI randomness expansion. The extension to a finite number of rounds is expected to be straightforwardly implementable in the SDP in Eq. (21). In analogy to parameter estimation in QKD, one can replace equality in the last constraint by an appropriate semidefinite constraint which includes the statistical deviation.

By comparison with previous work ma15 , we noticed that for the setup treated there, our lower bound to the randomness rate coincides with their exact rate. It is an open question whether this is the case in all MDI setups, which we leave for future work.

Remark: During completion of this work we became aware of recent related work vsupic2017measurement , in which a comparable semidefinite program was used to calculate the MDI randomness rate in a two-qubit setup with tomographically complete states.

VI Acknowledgments

The authors thank Matthias Kleinmann for discussion. FB acknowledges financial support from Evangelisches Studienwerk Villigst and from Strategischer Forschungsfonds (SFF) of the University of Düsseldorf. We acknowledge financial support from the German Federal Ministry of Education and Research (BMBF).