Parallel Device-Independent Quantum Key Distribution

TL;DR

This paper proves the first parallel security protocol for device-independent quantum key distribution, reducing time-steps and security constraints, and achieving linear key rates with tolerable device imprecision.

Contribution

It introduces a parallel execution security proof for DI-QKD, enhancing efficiency and robustness over previous sequential protocols.

Findings

First parallel security proof for DI-QKD

Reduces number of time-steps for key generation

Achieves linear key rate with device imprecision tolerance

Abstract

A prominent application of quantum cryptography is the distribution of cryptographic keys that are provably secure. Recently, such security proofs were extended by Vazirani and Vidick (Physical Review Letters, 113, 140501, 2014) to the device-independent (DI) scenario, where the users do not need to trust the integrity of the underlying quantum devices. The protocols analyzed by them and by subsequent authors all require a sequential execution of N multiplayer games, where N is the security parameter. In this work, we prove unconditional security of a protocol where all games are executed in parallel. Besides decreasing the number of time-steps necessary for key generation, this result reduces the security requirements for DI-QKD by allowing arbitrary information leakage of each user's inputs within his or her lab. To the best of our knowledge, this is the first parallel security proof for a fully device-independent QKD protocol. Our protocol tolerates a constant level of device imprecision and achieves a linear key rate.

Equations

$$\mathbf{P}(SUCC)<\delta$$

$$H_{min}^{\delta }(\text{AliceKey}\mid \text{Eve},SUCC)-H_0^{\delta }(\text{AliceKey}\mid \text{BobKey},SUCC)$$

$$\Delta (p,q)$$

$$Z\mapsto \sum _{r\in \mathcal{R}}|r⟩⟨r|\cdot ⟨q|Z|q⟩.$$

$${\Gamma }^V$$

$${\Gamma }_T$$

$$f(x)$$

$$\Delta ({\Gamma }_1,{\Gamma }_2)$$

$$F({\Gamma }_1,{\Gamma }_2)$$

$$P({\Gamma }_1,{\Gamma }_2)$$

$$\Delta ({\Lambda }_1,{\Lambda }_2)$$

$$F({\Lambda }_1,{\Lambda }_2)$$

$$P({\Lambda }_1,{\Lambda }_2)$$

$$p:\prod _i{\mathcal{X}}^i\to [0,1]$$

$$L:\prod _i{\mathcal{X}}^i\times \prod _i{\mathcal{A}}^i\to \{0,1\}.$$

$$M_{\mathbf{a}\mid \mathbf{x}}=M_{a^1\mid x^1}^1\otimes \dots \otimes M_{a^n\mid x^n}^n$$

$$\mathbf{P}(W_1=W_2=\dots =W_k=1)$$

$$h_{min}(Q\mid R{)}_{\Gamma }$$

$$h_2(Q\mid R{)}_{\Gamma }$$

$$h_{min}^{\delta }(Q\mid R{)}_{\Gamma }$$

$$h(T{)}_{\Lambda }$$

$$h(Q\mid R)$$

$$h(S{)}_p$$

$$h_0(S\mid T{)}_q$$

$$h_0^{\delta }(S\mid T{)}_q$$

$$H_{min}(Z\mid Q{)}_B$$

$$H_{min}(Z\mid Q{)}_{{\Gamma }_B}$$

$$H_{min}^{\delta }(R\mid S{)}_{\Gamma }\ge H_2(R\mid S{)}_{\Gamma }-\log (2/{\delta }^2).\text{qed}$$

$${\mathbf{P}}_{{\Gamma }^3}(J=J^{\prime })$$

$${\left({\Gamma }^2\right)}^{J{V}^{\prime }}$$

$${\left({\Gamma }^3\right)}^{J{J}^{\prime }}$$

$$h_2(J\mid V^{\prime }{)}_{{\Gamma }^2}$$

$$=$$

Full text

1 Introduction

Key Distribution (KD) is a task where two parties establish a common secret by communicating through a public channel. It is a necessary step for symmetric key cryptography (i.e., for protocols that require a shared secret) in a setting where a secure communication channel is initially not available. Thus KD is a primitive foundational to information security.

Information theoretically secure KD is impossible for classical protocols (i.e., protocols that exchange bits). Thus all classical solutions must necessarily rely on computational assumptions. Widely used protocols, such as the Diffie-Hellman-Merkle key exchange protocol [11] and those making use of digital signatures (e.g., as in the implementation of Secure Sockets Layer) all rely on the computational security of public key cryptography. The hardness assumptions underlying all known public key cryptography are mathematically unproven. The practical security of these solutions are being challenged on the one hand by the rapidly increasing and widely available high performance computing power, and on the other hand, by new insights into the design flaws. For example, Adrian et al. [1] recently showed how Diffie-Hellman-Merkle could fail in practice. A further threat to all widely used public-key-based KD protocols is that they are not secure against quantum cryptanalysis. With universal quantum computer within sight [10] and quantum-resilient protocols yet to emerge, these challenges call for alternative and fundamentally more secure solutions for KD.

Quantum mechanics provides such a solution. The quantum key distribution (QKD) protocol of Bennett and Brassard [7] and its several subsequent variants have been proved to be unconditionally secure (i.e., against a computationally all-powerful adversary) [19, 18, 26, 25, 6]. Experimental networks implementing QKD have been developed and deployed with increasingly large scales. With the rapid advances of quantum information technologies, QKD protocols may be widely adopted in the near future.

A major challenge for QKD (and other quantum information tasks) is that quantum information is extremely fragile. How could a user of a QKD protocol be sure that the quantum devices are operating according to the specifications? This consideration motivates the field of device-independent (DI) quantum cryptography, pioneered by Ekert [13] and Mayers and Yao [20]. The goal of DI quantum cryptography is to develop protocols and prove security in a strictly black-box fashion, with the only trusted assumption being that quantum physics is correct and complete, and that the users have the ability to restrict information transmission. The field has seen enormous success in recent years, including the achievement of fully device-independent and robust security proofs for QKD [30, 21, 3, 12, 2].

All the known secure DI-QKD protocols are sequential in the following sense. Alice and Bob share a two-part quantum device $D=(D_{1},D_{2})$, each of which is treated as a black box which accepts classical inputs and returns classical outputs. Alice creates a random input $X_{1}$, gives it to her device $D_{1}$, and receives an output $A_{1}$. Meanwhile, Bob gives a random input $Y_{1}$ to his device $D_{2}$ and receives an output $B_{1}$. This process is repeated sequentially $N$ times to obtain $X_{1},\ldots,X_{N},Y_{1},\ldots,Y_{N},A_{1},\ldots,A_{N},B_{1},\ldots,B_{N}$. (These data are then used to determine whether a certain Bell inequality has been violated, and if so, these registers are then postprocessed using information reconciliation and privacy amplification to obtain the final shared key.) The sequential assumption means specifically that output $A_{i}$ is recorded before the device gains knowledge of $X_{i+1}$.

The question addressed by the current paper is the following: is the sequential assumption in DI-QKD necessary? We show that, in fact, it can be removed: we prove robust DI-QKD in a more general model where there is no time-ordering assumption on the generation of the outputs $A=(A_{1},\ldots,A_{N})$ and $B=(B_{1},\ldots,B_{N})$. The devices may be treated as black boxes which receive their input sequences $X=(X_{1},\ldots,X_{N})$ and $Y=(Y_{1},\ldots,Y_{N})$ all at once and return output sequences $A_{1},\ldots,A_{N}$ and $B_{1},\ldots,B_{N}$ all at once (parallel repetition). In particular, we do not require the assumption that $A_{i}$ is independent of $X_{i+1}$. The only necessary assumption is that the inputs $X_{1},\ldots,X_{N}$ are uniformly random conditioned on any information outside of Alice’s lab, and the inputs $Y_{1},\ldots,Y_{N}$ are uniformly random conditioned on any information outside of Bob’s lab.

Broadening the model for device-independence allows for more flexible implementations of quantum key distribution — in particular, our result shows that before quantum key distribution takes place, arbitrary interaction can be allowed between each player’s input sequence and his or her device. (Indeed, the input sequences can even be re-used from previous experiments, provided that they are completely unknown to the other player and the adversary when the protocol begins.) Our model also allows for any of the Bell experiments in the DI-QKD procedure to be performed simultaneously, which may open the door to faster implementations.

Our work addresses a general theoretical question: what are the minimal assumptions necessary to generate a uniformly random secret between two players? The main result shows that, if we can assume perfect private randomness and trusted classical computation for each player, then Bell nonlocality itself is enough to generate shared keys of arbitrary length.

1.1 The protocol and technical statements

All DI protocols use nonlocal games as building blocks. For our protocol, we use the Magic Square game.

Definition 1.1**.**

The Magic Square game (MSG) is a two-player game in which the input alphabet for both players is $\mathcal{X}=\mathcal{Y}=\{1,2,3\}$, the output alphabet for the first player is $\mathcal{A}=\{000,011,101,110\}$ (the set of all $3$ bit strings of even parity), and the output alphabet for the second player is $\mathcal{B}=\{001,010,100,111\}$ (the set of all $3$ bit strings of odd parity). The inputs are chosen according to a uniform distribution, and the game is won if the inputs $x,y$ and the outputs $a,b$ satisfy $a_{y}=b_{x}$.

The Magic Square game has optimal quantum winning probability $1$ and optimal classical winning probability $8/9$.

For our device model, we assume that Alice and Bob possess an untrusted two-part quantum device $D=(D_{1},D_{2})$. The device $D_{1}$ receives input from the set $\mathcal{X}^{N}$, where $N$ is a positive integer, and gives an output in the set $\mathcal{A}^{N}$. The device $D_{2}$ receives input from the set $\mathcal{Y}^{N}$ and yields output in the set $\mathcal{B}^{N}$.

Our parallel DI-QKD protocol, MagicQKD, is given in Figure 1. Alice and Bob are the parties who wish to share a key, and Eve is an adversary. It is assumed that the untrusted devices $(D_{1},D_{2})$ are initially in a pure state with Eve’s side information $E$ (which is the worst-case scenario) and that Eve has access to any communications between Alice and Bob during the protocol. The security parameter $N$ is the number of instances of Magic Square played. The parameter $\epsilon$ is a positive rational number. In our proof we show that there is some fixed positive value $\epsilon:=\epsilon_{0}$ (not given explicitly) such that the protocol achieves a positive linear rate of key distribution as $N$ tends to infinity.

Our security proof is based on the following assumptions for the protocol MagicQKD.

1. Assumption 1.

The behavior of the devices $D_{1},D_{2}$ and the system $E$ is modeled by quantum physics. 2. Assumption 2.

Alice and Bob have the ability to generate perfect private randomness at steps $1$, $2$, and $3$. 3. Assumption 3.

Any information broadcast by Alice is perfectly received by both Bob and Eve, and any information broadcast by Bob is perfectly received by both Alice and Eve. 4. Assumption 4.

Aside from broadcasts by the players, no information is transmitted from Alice’s laboratory (which contains $D_{1},X,A,R$) or from Bob’s laboratories (which contains $D_{2},Y,B,S$) once the protocol has started.

Let AliceKey denote the raw key $R_{1},\ldots,R_{\epsilon N}$ possessed by Alice at the end of the protocol MagicQKD, let BobKey denote the raw key $S_{1},\ldots,S_{\epsilon N}$ possessed by Bob, and let Eve denote all information possessed by Eve at the conclusion of the protocol (including her side information $E$ and any information obtained by eavesdropping). Let $\Gamma$ denote the final state of MagicQKD, and let $SUCC$ denote the event that the protocol succeeds. Then, the smooth min-entropy $H^{\delta}_{min}(\textit{AliceKey}\mid\textit{Eve},SUCC)$ measures the number of uniformly random bits that can be extracted from AliceKey in Eve’s presence, while the smooth zero-entropy $H_{0}^{\delta}(\textit{AliceKey}\mid\textit{BobKey},SUCC)$ measures the least number of bits that Alice needs to publicly reveal in order for Bob to perform information reconciliation and reconstruct AliceKey (see section 3 for details). Therefore, to show security for a quantum key distribution protocol, it suffices to show that the difference between the former quantity and the latter quantity is lower bounded by $\Omega(N)$, for some negligible error term $\delta:=\delta(N)$.

Our main result is the following.

Theorem 1.2**.**

There exists a constant $\epsilon:=\epsilon_{0}>0$ and functions $\delta:=\delta(N)\in 2^{-\Omega(N)}$ and $R(N)\in\Omega(N)$ such that the following always holds for protocol MagicQKD: either

[TABLE]

or

[TABLE]

The proof of this theorem is given in Subsection 5.2. This theorem establishes both robustness and a linear rate for MagicQKD. (The data $\epsilon_{0},\delta,R$ are are not given explicitly and are left for future work.)

We note that in the protocol we have assumed that all entanglement shared by the devices $(D_{1},D_{2})$ is shared before the protocol begins. Practically this may be difficult, since it may require a quantum memory size that grows with $N$. A model which requires less quantum memory is shown in Figure 2, where the entanglement is periodically updated during step $1$ of MagicQKD from an outside entanglement source. (The source and its channels are both untrusted, and the only assumption is that the communication is one-way.) Fortunately this case is also covered by our analysis: a device which behaves as in Figure 2 is equivalent to one in which all transmissions from the entanglement source are sent in advance, and are stored in the components $D_{1}$ and $D_{2}$. This illustrates the generality of the parallel model.

If we measure time by the number of prepare-and-measure steps executed by the devices, then a speed-up over sequential DI-QKD occurs in Figure 2 if the devices are capable of winning multiple rounds of the Magic Square game at a single iteration. Quantifying how this speed-up affects the key rate (and also how it increases demands on the devices) is a topic for further research.

1.2 Security analysis and proof techniques

In order to achieve secure parallel DI-QKD, there are two challenges that must be met simultaneously. The first is that the parallel scenario opens up the possibility of correlated cheating strategies by the devices (with correlations going both “forward” and “backward” between rounds) and one must show a linear amount of entropy in the key bits despite such strategies. The second is that the linear rate of entropy in the raw key must not only be positive; it must be larger than the amount of entropy that is lost during information reconciliation.

To meet these challenges we made two specific choices in MagicQKD, which differentiate our protocol from protocols for sequential DI-QKD. The first is that we use the Magic Square game, which has special properties for parallel DI-QKD (discussed below). The second is that the raw keys are only computed from a randomly chosen subset of the rounds. This allows us to decrease the amount of information that is revealed to Eve during the protocol, and is a necessary assumption for our security proof.

The central challenge when moving from the sequential setting to the parallel setting is the possibility of new correlations in the behavior of $D_{1}$ and $D_{2}$ on separate games. These correlations can have counter-intuitive properties: for example, Fortnow gave an example of a two-player game $G$ such that $w_{c}(G^{2})>w_{c}(G)^{2}$, where $w_{c}$ denotes the optimal score for classical players and $G^{2}$ denotes the game $G$ repeated twice in parallel (see Appendix A in [15]). The same could not be true in the sequential setting – the optimal score for $G$ repeated twice in sequence must be exactly $w_{c}(G)^{2}$. Thus the parallel assumption opens up new demands for cheating and requires new techniques.

A technique that has been highly successful for the parallel repetition problem is based on bounding the amount of information that players learn about one another’s inputs when we condition on events that depend on a limited number of other games [24]. This technique was brought into the quantum context in [8, 16, 9, 4], and allows the proofs of exponentially vanishing upper bounds for the quantum winning probability of $G^{N}$ for certain broad classes of games. A useful consequence of this technique, which is implicit in [8, 16, 9, 4], is that for some games $G$ the behavior of parallel players on a randomly chosen subset of rounds cannot be much better than the behavior of sequential players.

We apply this technique for parallel repetition to prove security for MagicQKD. Specifically, we show that the collision entropy $H_{2}(\textit{AliceKey}\mid\textit{Eve})$ (which, as a well known fact, provides a lower bound on $H_{min}^{\epsilon}(\textit{AliceKey}\mid\textit{Eve})$) can be expressed in terms of the winning probability of the “doubled” version of the Magic Square game (MGuess) shown in Figure 5. In this expanded game, players Alice, Bob, Alice*′, and Bob′* try to win the Magic Square game while also trying to guess one another’s inputs and outputs. By the techniques of [8, 16, 9, 4], the probability of winning this doubled game on $\epsilon N$ randomly chosen rounds in an $N$-fold parallel repetition is not much more than the probability of winning $\epsilon N$ instances of the games independently. This fact is the basis for our security claim.

We also make use of a technique from sequential device-independent quantum cryptography [21, 12]: each time players who are generating random numbers fail at a single instance of a game, we introduce additional artificial randomness to compensate for the failure (here represented by the register $T$ in Figure 6). This artificial randomness (which is useful for induction) is used only for intermediate steps in the proof and is removed before the final security claim. This aspect of the proof is important for proving noise tolerance in MagicQKD.

We note that our proof makes use of all of the following properties of the Magic Square game: (1) it is perfectly winnable by a quantum strategy, (2) its input distribution is uniform, and (3) an optimal strategy yields perfectly correlated random bits between Alice and Bob. (As a consequence of (3), there is a positive rate of min-entropy in the raw key bits in MagicQKD, while the communication cost for information reconciliation tends to [math] when the noise tolerance is lowered, thus enabling a positive key rate.) The Magic Square game is the simplest game that we know of which satisfies all of these properties. A natural next step is to study which other games can be used for parallel DI-QKD.

After our result was publicized, Thomas Vidick [31] sketched an alternate proof of DI-QKD, using a strengthened parallel repetition result that appeared after our result [5]. Vidick’s approach uses the class of “anchored” games introduced in 2015 [4]. With this approach one can replace Alice*′* and Bob*′* in MGuess with a single party, and a lower bound on $H_{min}$ (rather than $H_{2}$) follows via parallel repetition. The protocol in [31] is a version of our protocol which retains the crucial features discussed above. A comparison between the rates achieved by these two approaches is a topic for further research.

Organization.

Section 2 establishes notation for our proofs. Section 3 provides the basis for our interpretation of collision entropy as the winning probability of a “doubled” game. Section 4 defines the doubled Magic Square game and proves an upper bound on its winning probability. Section 5 gives the proof of the central security claims. The appendix proves supporting propositions, including the parallel repetition result derived from [8, 16, 9, 4].

2 Notation and Preliminaries

Some of the notation in this section is based on [27]. If $T$ is a finite set, let $\textrm{Perm}(T)$ denote the set of permutations of $T$. If $t\in T$, then we write can $T\smallsetminus\{t\}$ to denote the complement of $t$, or if the set $T$ is understood from the context, we simply write $\widehat{t}$ for $T\smallsetminus\{t\}$.

Let $\mathcal{D}(T)$ denote the set of probability distributions on the finite set $T$, and let $\mathcal{S}(T)$ denote the set of subnormalized probability distributions. If $p,q\in\mathcal{S}(T)$ are subnormalized distributions let

[TABLE]

where $x:=\sum_{t\in T}p(t)$ and $y:=\sum_{t\in T}q(t)$ respectively. The function $\Delta$ is a metric on $\mathcal{S}(T)$.

If $x_{1},\ldots,x_{N}$ and $y_{1},\ldots,y_{N}$ are binary sequences, let $\textrm{Ham}(\mathbf{x},\mathbf{y})$ denote the Hamming distance between $\mathbf{x}$ and $\mathbf{y}$. The following lemma will be useful in a later proof. For any $t\in[0,1]$, let $H(t)$ denote the Shannon entropy quantity: $H(t)=-t\log t-(1-t)\log(1-t)$.

Proposition 2.1**.**

For any $c\in[0,1/2]$ and any positive integer $N$, let $L_{c,N}$ denote the number of $N$-length binary strings whose sum is less than or equal to $cN$. Then, $L_{c,N}\leq 2^{NH(c)}$.

Proof.

We have $L_{c,N}=\sum_{0\leq i\leq cN}{{N}\choose{i}}$. The desired inequality is given in Theorem 1.4.5 in [29]. ∎

2.1 Quantum states and operations

A quantum register (or simply register) is a finite-dimensional complex Hilbert space with a fixed orthonormal basis. We use Roman letters (e.g., $B$) to denote quantum registers. Given two quantum registers $Q,Q^{\prime}$, we will sometimes write $QQ^{\prime}$ for the tensor product $Q\otimes Q^{\prime}$.

If $\mathcal{S}$ is a finite set, an $\mathcal{S}$-valued quantum register is quantum register that has a fixed isomorphism with $\mathbb{C}^{\mathcal{S}}$. If $Q$ is a quantum register, let $\mathcal{L}(Q),\mathcal{H}(Q),\mathcal{P}(Q),\mathcal{S}(Q)$, and $\mathcal{D}(Q)$, denote, respectively, the sets of linear, Hermitian, positive semidefinite, subnormalized positive semidefinite (trace $\leq 1$) and normalized positive semidefinite operators on $Q$. A state of $Q$ is an element of $\mathcal{D}(Q)$. Elements of $\mathcal{S}(Q)$ are referred to as subnormalized states of $Q$. A reflection is a Hermitian operator whose eigenvalues are contained in $\{-1,1\}$.

For any quantum register $Q$, the symbol $I^{Q}$ denotes the identity operator on $I$, and $U^{Q}$ denotes the completely mixed state $I^{Q}/(\textnormal{dim}(Q))$.

If $Q,Q^{\prime}$ are quantum registers, the set $\mathcal{L}(Q)$ has a natural embedding into $\mathcal{L}(Q\otimes Q^{\prime})$ by tensoring with $I_{Q^{\prime}}$. We use this embedding implicitly: if $T\in\mathcal{L}(Q)$ and $\Phi\in\mathcal{D}(Q\otimes Q^{\prime})$, then $T(\Phi)$ denotes $(T\otimes I_{Q^{\prime}})\Phi$.

Note that if $Q$ is a $\mathcal{Q}$-valued register and $R$ is an $\mathcal{R}$-valued register, then any function $f\colon\mathcal{Q}\to\mathcal{R}$ determines a process from $Q$ to $R$ via

[TABLE]

We may denote this process by the same letter, $f$.

A copy of a register $Q$ is a register $Q^{\prime}$ with the same dimension with a fixed isomorphism $Q^{\prime}\cong Q$. If $\Gamma\in\mathcal{P}(\Gamma)$ is a state, then the canonical purification of $\Gamma$ is the projector $\Phi$ on $Q\otimes Q^{\prime}$ onto the one-dimensional space spanned by $\left(\sqrt{\Gamma}\otimes I_{Q^{\prime}}\right)\left(\sum_{i}e_{i}\otimes e_{i}\right)\in Q\otimes Q^{\prime}$, where the sum is taken over all standard basis elements $e_{i}$. We then have $\Phi^{Q}=\Gamma$ and $\Phi^{Q^{\prime}}=\Gamma^{\top}=\overline{\Gamma}$ under the fixed isomorphism $Q\cong Q^{\prime}$.

A measurement on a register $Q$ is an indexed set $\{M_{i}\}_{i\in\mathcal{I}}\subseteq\mathcal{P}(Q)$ which sums to the identity. A measurement strategy on $Q$ is a collection of measurements on $Q$ that all have the same index set.

We will use lower case Greek letters (e.g., $\gamma$) to denote complex vectors, and either uppercase Greek letters (e.g., $\Gamma$) or Roman letters to denote Hermitian operators on finite-dimensional Hilbert spaces. If $\Gamma$ is a Hermitian operator on a tensor product space $W\otimes V$, then $\Gamma^{V}$ denotes the operator

[TABLE]

Alternatively we may write $\Gamma^{\widehat{W}}$ for $\textnormal{Tr}_{W}\Gamma$. If $T$ is a projector on $W$, let

[TABLE]

and if $\textnormal{Tr}(\Gamma_{T})\neq 0$, let $\Gamma_{\mid T}=\Gamma_{T}/\textnormal{Tr}(\Gamma_{T})$.

If $R$ is a register whose values are real numbers, and $\psi$ is a classical state of $R$, then $\mathbb{E}_{\psi}[R]$ denotes the expected value of $R$. If $\mu$ is a probability distribution on a finite set $\mathbb{Z}$, and $f\colon\mathbb{Z}\to\mathbb{R}$ is a function, then $\mathbb{E}_{z\leftarrow\mu}[f(z)]$ denotes the expected value of $f(z)$ under $\mu$.

If $\Phi$ is a positive semidefinite operator, then $\Phi^{r}$ denotes the operator that arises from applying the function

[TABLE]

to the eigenvalues of $\Phi$.

We make free use of the following shorthands. If $x_{1},\ldots,x_{N}$ is a sequence, then the boldface letter $\mathbf{x}$ denotes $(x_{1},\ldots,x_{N})$. If $X_{1},\ldots,X_{N}$ are quantum registers, then $X$ denotes $X_{1}X_{2}\cdots X_{N}$. We write $X_{i\ldots j}$ for the registers $X_{i}X_{i+1}\cdots X_{j}$. If $\{Y_{i}^{j}\}$ is an array of registers, then $Y_{i}=\{Y_{i}^{j}\}_{j}$ and $Y^{j}=\{Y_{i}^{j}\}_{i}$. The expression $X_{\widehat{i}}$ denotes the set $\{X_{k}\}_{k\neq i}$.

2.2 Distance measures

If $\Gamma_{1},\Gamma_{2}\in\mathcal{D}(Q)$ for some quantum register $Q$, let

[TABLE]

For $\Lambda_{1},\Lambda_{2}\in\mathcal{S}(Q)$, let $\left[\Lambda_{i}\right]$ denote the density operator111That is, the operator on $Q\oplus\mathbb{C}$ given by \left[\begin{array}[]{cc}\Lambda_{i}\\ &1-\textnormal{Tr}(\Lambda_{i})\end{array}\right]. $\Lambda_{i}\oplus(1-\textnormal{Tr}(\Lambda_{i}))$. Let

[TABLE]

The functions $P$ (purified distance) and $\Delta$ (generalized trace distance) are metrics on $\mathcal{S}(Q)$, and $\Delta\leq P\leq\sqrt{2\Delta}$. If $\Lambda_{1}$ and $\Lambda_{2}$ are both pure, then $P=\Delta$. Both quantities $P$ and $\Delta$ satisfy data processing inequalities. (See Chapter 3 in [27]).

2.3 Games

An $n$-player nonlocal game $G$ with input alphabets $\mathcal{X}^{1},\ldots,\mathcal{X}^{n}$ and output alphabets $\mathcal{A}^{1},\ldots,\mathcal{A}^{n}$ is a probability distribution

[TABLE]

together with a predicate

[TABLE]

Such a game is free if $p$ is a uniform distribution. Let $G^{N}$ denote the $N$-fold parallel repetition of $G$ (i.e., the game with input alphabets $(\mathcal{X}^{i})^{N}$, output alphabets $(\mathcal{A}^{i})^{N}$, probability distribution $p(\mathbf{x})=p(\mathbf{x}_{1})\cdot\ldots\cdot p(\mathbf{x}_{n})$, and predicate $L(\mathbf{x},\mathbf{a})=\bigwedge_{i=1}^{N}L(\mathbf{x}_{i},\mathbf{a}_{i})$).

A measurement strategy for a game $G$ is a family $\{\{M_{\mathbf{a}\mid\mathbf{x}}\}_{\mathbf{a}}\}_{\mathbf{x}}$ of $\mathcal{A}$-valued measurements, indexed by $\mathcal{X}$, on a quantum register $Q=Q_{1}\otimes\cdots\otimes Q_{n}$, where each measurement operator $M_{\mathbf{a}\mid\mathbf{x}}$ is given by

[TABLE]

where $\{M^{i}_{a^{i}\mid x^{i}}\}_{a^{i}}$ is a measurement on $Q^{i}$.

It is helpful to describe a parallel repeated game as a process. In Figure 3, we introduce the parallel repetition process $\textrm{Par}(N,G,\mathbf{M},\Phi)$ associated to a game $G$. The process Par includes a final step which shuffles the different instances of the game according to a randomly chosen permutation.

For any $G$, let $w(G)$ denote the supremum quantum score of $G$ (i.e., the supremum of $\mathbf{P}(W_{1}=1)$ in $\textrm{Par}(1,G,\mathbf{M},\Phi)$ taken over all initial states $\Phi\in\mathcal{D}(C)$ and all measurements strategies $\mathbf{M}$).

We will typically refer to states arising from processes as follows: the initial state will be denoted by $\Gamma^{0}$, and $\Gamma^{i}$ will refer to the state that occurs after step $i$. The symbol $\Gamma$ will denote the final state.

The following proposition asserts that if $G$ is a free game, then the winning probability in a small number of rounds in Par is not much better than that which could be achieved by sequential players. This fact is implicit in the entropy approach to parallel repetition given in [8, 16, 9, 4]. Since we are not aware of a statement in the literature in the form that we will need, we have given a proof in Appendix C (see Theorem C.6).

Proposition 2.2**.**

Suppose that $G$ is a free nonlocal game. Then, the registers $W_{1},\ldots,W_{N}$ at the conclusion of process Par satisfy

[TABLE]

for any $k\in\{1,2,\ldots,N\}$. ∎

For our purposes, it is crucial not only that the bound in (19) is an exponential function, but also that its base approaches $w(G)$ as $k/N$ approaches zero.

3 Entropy quantities

Definition 3.1**.**

Let $QR$ be a bipartite quantum register, and let $\Gamma$ be a subnormalized state of $QR$. Then,

[TABLE]

Let

[TABLE]

where $\Gamma^{\prime}$ varies over all subnormalized states of $QR$ that are within distance $\delta$ from $\Gamma$ under the purified distance metric $P$.

Note that we can equivalently let the minimization in (22) be taken only over the the states of $QR$ that have trace no larger than $\textnormal{Tr}(\Gamma)$, since if $\textnormal{Tr}(\Gamma^{\prime})$ were larger than $\textnormal{Tr}(\Gamma)$, then the scalar multiple $[\textnormal{Tr}(\Gamma)/\textnormal{Tr}(\Gamma^{\prime})]\Gamma^{\prime}$ would be at least as close to $\Gamma$ as was the original state $\Gamma^{\prime}$ (see Lemma A.1).

Definition 3.2**.**

For any subnormalized state $\Lambda$ of a quantum register $T$, let

[TABLE]

and let

[TABLE]

Additionally, we define some entropy quantities for probability distributions.

Definition 3.3**.**

If $p$ is a probability distribution on a set $S$, let

[TABLE]

If $q$ is a subnormalized probability distribution on a set $S\times T$, let

[TABLE]

Let

[TABLE]

where $q^{\prime}$ varies over all subnormalized probability distributions on $S\times T$ such that $\Delta(q,q^{\prime})\leq\delta$.

Similar to the definition of smooth min-entropy, in (27), we can equivalently assume that the minimization is taken over distributions that are dominated by $q$ (i.e., $q^{\prime}\leq q$). For all the entropy quantities specified so far in this subsection, we let $H_{*}^{*}(\cdot\mid\cdot)=-\log h_{*}^{*}(\cdot\mid\cdot)$. (Thus, for example, $H_{min}^{\delta}(Z\mid Y)=-\log h^{\delta}_{min}(Z\mid Y)$.)

If $\Gamma$ is a classical-quantum state of a bipartite register $ZQ$, and $B$ is a subset of the range $\mathcal{Z}$ of $Z$, then $\Gamma_{B}:=\Gamma_{P_{B}}$, where $P\colon\mathbb{C}^{\mathcal{Z}}\to\mathbb{C}^{\mathcal{Z}}$ denotes the projector onto the subspace spanned by $B$, and let $\Gamma_{\mid B}=\Gamma_{\mid P_{B}}$. When the state is implicit from the context, we may write

[TABLE]

to denote, respectively,

[TABLE]

and we can use similar notation for the other conditional entropies defined above.

Some of the applications of these quantities are as follows. Assume that $Z$ is a classical register. The quantity $H_{min}(Z\mid Y)$ (quantum conditional min-entropy) is a measure of the number of bits that can be extracted from $Z$ in the presence of an adversary who possesses $Y$ (see, e.g., [28]). The quantity $H(Z\mid Y)$ (von Neumann entropy) measures the number of bits that can be extracted in the case in which multiple copies of the state $ZY$ are available (see Chapter 11 in [23]). The quantity $H_{2}(Z\mid Y)$ is the conditional collision entropy. In the case where $Y$ is a trivial register, the quantity $H_{2}(Z\mid Y)$ is the negative logarithm of the probability that two independent samples of $Z$ will agree. An interpretation of the case where $Y$ is nontrivial will be explained in the next subsection.

If $Z,Y$ are classical registers with a joint distribution $q$, then the quantity $H_{0}(Z\mid Y)$ is a measure of the minimum number of bits needed to reconstruct the state $Y$ from $Z$. This can be understood as follows: let $M>H_{0}(Z\mid Y)$, and let $R=\{r\colon\mathcal{Z}\to(\mathbb{Z}_{2})^{M}\}$ be a $2$-universal hash function family.222That is, $R$ is a family of functions such that for any distinct $y_{1},y_{2}\in Y$, the probability that $r(y_{1})=r(y_{2})$ is no more than $2^{-M}$ when $r$ is chosen uniformly at random from $R$. Suppose that Alice possesses $Z=z$ and Bob possesses $Y=y$, and Alice chooses $r\in R$ uniformly at random and reveals $r$ and $r(z)$ to Bob. Then, except with probability at most $2^{M-H_{0}(Z\mid Y)}$, there will be only one value in the set $\left\{z\mid q(z,y)>0\right\}$ which maps to $r(z)$ under $r$, and thus Bob can uniquely determine $z$.

Collision entropy and min-entropy are related by the following proposition (see subsection 6.4.1 in [27]):

Proposition 3.4**.**

For any quantum registers $RS$, any normalized classical-quantum state $\Gamma$ of $RS$, and any $\delta>0$,

[TABLE]

3.1 An operational interpretation of collision entropy for measurements on a pure entangled state

If $\Gamma$ is a classical-quantum state of a register $ZY$, then a common way to describe $h_{2}(Z\mid Y)_{\Gamma}$ is that it is the likelihood that an adversary who possesses $Y$ can guess $Z$ via the pretty good measurement $\{(\Gamma^{Y})^{-1/2}\Gamma_{Z=z}(\Gamma^{Y})^{-1/2}\}_{z}$. We present an alternative interpretation which is useful for measuring the randomness obtained from measurements on an entangled state. The following proposition refers to the process Guess shown in Figure 4.

Proposition 3.5**.**

Let $\Gamma^{1},\Gamma^{2},\Gamma^{3}$ denote the states that occur after steps 1, 2, and 3, respectively, in the process $\textrm{Guess}(\Phi,\{P_{j}\}_{j})$. Then,

[TABLE]

Proof.

The states $\left(\Gamma^{2}\right)^{JV^{\prime}}$ and $\left(\Gamma^{3}\right)^{JJ^{\prime}}$ are given by

[TABLE]

and thus

[TABLE]

as desired. ∎

4 The Magic Square Guessing Game

In this section we consider the $6$-player game described in Figure 5. In this game, two pairs of players (Alice and Bob, and Alice*′* and Bob*′) each play the Magic Square game and their inputs and outputs are compared. There are also additional players Charlie and Charlie′* who receive a random bit and always produce the same output letter. (Note that none of the outputs Bob*′, Charlie, and Charlie′* are used in the scoring rule — these players are present merely because their inputs are used in the scoring rule.)

In the game, Alice and Bob are attempting to win the Magic Square game, while Alice*′* and Bob*′* are simultaneously attempting to guess Alice’s input, Bob’s input, and Alice’s key bit. However, a failure by Alice and Bob at winning the Magic Square game is forgiven if it happens that Charlie and Charlie*′* have the same output. (This last rule has the effect of making the game easier to win. It underlies the robustness property of our security proof for MagicQKD.)

It is obvious that $w(\textrm{MGuess})\leq 1/9$, since the probability that Alice’s and Bob’s inputs match those of Alice*′* and Bob*′* is $1/9$. We will prove that in fact $w(\textrm{MGuess})$ is less than $1/9$ minus a positive constant. This will be crucial for establishing a nonzero key rate for MagicQKD.

The proof of the next proposition is given in the appendix. Roughly speaking, the proposition holds because rigidity for the Magic Square game [32] implies that any near-optimal strategy by Alice and Bob involves Alice and Bob performing approximate Pauli measurements on two approximate EPR pairs shared between them. The outcomes of such measurements are not guessable by an outside party (even with entanglement). Therefore it is impossible for Alice and Bob to achieve a near-perfect score at the Magic Square game while at the same time allowing Alice*′* to guess Alice’s outcomes.

Proposition 4.1**.**

Let MGuess denote the game in Figure 5. Then,

[TABLE]

Proof.

See Appendix B. ∎

5 Security Proof

In the current section we give the proof of Theorem 1.2. Our approach can be roughly understood as follows: our upper bound on the winning probability of MGuess implies, using parallel repetition, that the collision entropy of Alice’s and Bob’s inputs $X_{1\ldots\epsilon N}Y_{1\ldots\epsilon N}$ together with Alice’s key bits $R_{1\ldots\epsilon N}$ is substantially more than that of Alice’s and Bob’s inputs alone (for small $\epsilon$). It follows that, even when we condition on $X_{1\ldots\epsilon N}Y_{1\ldots\epsilon N}$ and all of the adversary’s other information, an amount of entropy that is linear in $N$ remains in $R_{1\ldots\epsilon N}$ (Proposition 5.5). On the other hand, a classical statistical argument shows that the rate of noise between Alice’s key bits $R_{1\ldots\epsilon N}$ and Bob’s key bits $S_{1\ldots\epsilon N}$ vanishes as $\epsilon\to 0$ (Proposition 5.6). Combining these facts allows us to deduce inequality (2).

5.1 An Intermediate Protocol

In order to show that Alice’s raw key in MagicQKD is sufficiently random, we begin by analyzing the entropy produced by the related protocol MagicKey in Figure 6. In MagicKey, we use an idea from our previous work on randomness expansion [21, 22]: when Alice and Bob fail to win the Magic Square game, we compensate by artificially introducing randomness. In [12], this artificial randomness is represented by additional registers that have some prescribed entropy, and we adopt the same style here (by including the registers $T_{1},\ldots,T_{N}$). We use these auxilliary registers to establish a lower bound on collision entropy, and the registers will subsequently be dropped.

We begin with the following proposition, which addresses the amount of collision entropy that is collectively contained in Alice’s and Bob’s inputs, Alice’s key register, and the auxiliary registers $T_{i}$.

Theorem 5.1**.**

Let $\Gamma$ be the final state of MagicKey. Then,

[TABLE]

Note that in the above statement, we are conditioning not only on the register $E$ but also on the permutation register $F$.

Proof.

We prove this result via an application of Proposition 3.5. Upon an appropriate unitary embedding, we may also assume $E=C^{\prime}D^{\prime}$, where $C^{\prime},D^{\prime}$ are copies of $C,D$, and that $\Phi$ is the canonical purification of $\Phi^{CD}$. Suppose that the process $\textrm{Par}(N,\textrm{MGuess},\mathbf{M},\Phi)$ is executed with the measurement strategy333Here the tensor product respects the following ordering of the players: Alice, Bob, Charlie, Alice*′, Bob′, Charlie′. Charlie and Charlie′* have trivial output, and we treat them as simply performing a unary measurement on a one-dimensional register.

[TABLE]

For any $m$-subset $Z$ of $\{1,2,\ldots,N\}$, the probability that $\bigwedge_{i\in Z}W_{i}=1$ after step 4 in the process $\textrm{Par}(N,\textrm{MGuess},\mathbf{M},\Phi)$ is the same as the value of

[TABLE]

after step 6 in MagicKey. The average of the former quantity over all $(\epsilon N)$-subsets is equal to the value of $\mathbf{P}(W_{1}\wedge W_{2}\wedge\cdots\wedge W_{\epsilon N})$ at the conclusion of $\textrm{Par}(N,\textrm{MGuess},\mathbf{M},\Phi)$, while the average of the latter quantity is equal to the expression on the lefthand side of (38). The desired result follows from Theorem 2.2. ∎

Next we deduce an upper bound on smooth min-entropy, focusing just on the registers $R_{1\ldots\epsilon N}T_{1\ldots\epsilon N}$. For compatibility with later derivations, we will take the error parameter to be $2\exp(-\epsilon^{4}N)$.

Corollary 5.2**.**

The following inequality holds:

[TABLE]

Proof.

By Proposition 3.4, we have

[TABLE]

By Proposition 4.1, $\log[1/w(\textrm{MGuess})]>\log(1/9)$, and this bound can be simplified to

[TABLE]

When we condition on the registers $X_{1\ldots\epsilon N}Y_{1\ldots\epsilon}$, whose support has size $9^{\epsilon N}=2^{N\epsilon\log 9}$, we obtain the bound (41). ∎

In the next subsection, we will address conditioning on the event $SUCC$. For the time being it is helpful to condition on a related event. For any $\delta>0$, let $WIN(\delta)$ denote the event that the bit strings $R_{1\ldots\epsilon N}$ and $S_{1\ldots\epsilon N}$ differ in at most $\delta(\epsilon N)$ places. (That is, $WIN(\delta)$ denotes the event that the proportion of wins among the first $\epsilon N$ rounds is at least $1-\delta$.) Consider the event $WIN(2\epsilon)$. We have

[TABLE]

We assert that a lower bound in the same form holds when the registers $T_{1\ldots\epsilon N}$ are omitted.

Corollary 5.3**.**

The subnormalized state $\Gamma_{WIN(2\epsilon)}$ satisfies

[TABLE]

Proof.

The distribution of the registers $T_{1\ldots\epsilon N}$ under the subnormalized state $\Gamma_{WIN(2\epsilon)}$ is supported only on binary strings of Hamming weight less than $2\epsilon^{2}N$. Thus, by Proposition 2.1, these registers are supported on a set of size less than or equal to $2^{H(2\epsilon)\epsilon N}$. Therefore we can drop the registers $T_{1\ldots\epsilon N}$ from the lefthand side of (42) and and deduct $H(2\epsilon)\epsilon N$ from its righthand side, and the inequality is preserved. Since the term $H(2\epsilon)\epsilon N$ is dominated by $\Omega(\epsilon)N$, it may be ignored and the desired result follows. ∎

5.2 Device-Independent Quantum Key Distribution

We now turn our attention toward the protocol MagicQKD (Figure 1). We will prove that MagicQKD generates a positive key rate. Our final statement will use the registers

[TABLE]

The registers $Eve$ denote the information possessed by Eve at the conclusion of MagicQKD.

We begin by translating Corollary 5.3 into a statement about the success event for MagicQKD. Let $SUCC$ denote the event that MagicQKD succeeds, and let $SUCC^{\prime}$ denote the event that MagicQKD succeeds and the event $WIN(2\epsilon)$ occurs.

Lemma 5.4**.**

The events $SUCC^{\prime}$ and $SUCC$ satisfy

[TABLE]

Proof.

We assume $\mathbf{P}(\neg WIN(2\epsilon))>0$ (since otherwise the desired assertion is obvious). We have

[TABLE]

We consider the second factor in (49). Let $W_{i}$ denote the indicator variable for the event that the $i$th game is won. After conditioning on $\neg WIN(2\epsilon)$, the only way that $SUCC$ can occur is if the average of the variables $W_{1},\ldots,W_{\epsilon^{2}N}$ exceeds that of $W_{1}\ldots,W_{\epsilon N}$ by at least $\epsilon$. By ([14], Theorem 1 and Section 6), if an $\epsilon^{2}N$-subset $S$ is chosen at random from a set of Boolean values $T$ of size $\epsilon N$, then the probability that the average of $S$ will exceed that of $T$ by more than $\epsilon$ is at most $e^{-2\epsilon^{2}(\epsilon^{2}N)}$. This yields the desired bound. ∎

As a consequence of Lemma 5.4, we have $\Delta(\Gamma_{SUCC},\Gamma_{SUCC^{\prime}})\leq 2\exp(-2\epsilon^{4}N)$, and therefore $P(\Gamma_{SUCC},\Gamma_{SUCC^{\prime}})\leq\sqrt{4\exp(-2\epsilon^{4}N)}=2\exp(-\epsilon^{4}N)$. Since $SUCC^{\prime}\Longrightarrow WIN(2\epsilon)$, $\Gamma_{SUCC^{\prime}}$ also satisfies inequality (43) from Corollary 5.3. We therefore have by the triangle inequality that the state $\Gamma_{SUCC}$ satisfies

[TABLE]

Conditioning also on the registers $R_{1\ldots\epsilon^{2}N}S_{1\ldots\epsilon^{2}N}$ decreases the quantity on the lefthand side of (50) by at most $2\epsilon^{2}N\leq o(\epsilon)N$, and thus we obtain the following result.

Proposition 5.5**.**

The state $\Gamma_{SUCC}$ at the conclusion of MagicQKD satisfies

[TABLE]

Meanwhile, by definition, the registers AliceKey and BobKey in the state $\Gamma_{SUCC^{\prime}}$ differ in at most $2\epsilon^{2}N$ places, and thus by Proposition 2.1, we have

[TABLE]

Applying Lemma 5.4 yields the following.

Proposition 5.6**.**

The state $\Gamma_{SUCC}$ at the conclusion of MagicQKD satisfies

[TABLE]

We can now prove our main result.

Proof of Theorem 1.2.

Let

[TABLE]

If $\mathbf{P}(SUCC)\geq\delta$, then, by Propositions A.3 and A.4 in the appendix,

[TABLE]

where in lines (57)–(58), we used the fact that the terms $\delta^{3}/2$ and $\delta^{2}$ are at least as large as the respective error terms in Propositions 5.5 and 5.6. We now simply fix $\epsilon:=\epsilon_{0}>0$ to be sufficiently small that the function denoted by $\Omega(\epsilon)$ in (59) is positive, and the proof is complete. ∎

6 Acknowledgments

This research was supported in part by the U. S. National Science Foundation (NSF) under Awards 1526928, 1500095, and 1717523, when Y. S. was at University of Michigan. Work by R. J. on this research was supported by the Singapore Ministry of Education and the National Research Foundation, through the Tier 3 Grant “Random numbers from quantum processes” MOE2012-T3-1-009 and NRF RF Award NRF-NRFF2013-13. This paper is partly a contribution of the U. S. National Institute of Standards and Technology (NIST), and is not subject to copyright in the United States.

Appendix A Supporting Proofs for Entropy Measures

The following two lemmas bound the amount that the purified distance $P(\sigma,\lambda)$ can increase under scalar multiplication of the two states $\sigma,\lambda$. We address a case where the scalar multiplication makes the trace of the two states equal, and also a case where scalar multiplication normalizes the larger of the two states.

Lemma A.1**.**

Let $Q$ be a quantum register, let $\lambda,\sigma\in\mathcal{S}(Q)$, and let $r=\textnormal{Tr}(\lambda),s=\textnormal{Tr}(\sigma)$. Suppose that $s\geq r>0$. Then,

[TABLE]

Proof.

Let $\Lambda,\Sigma$ be the normalizations of $\lambda,\sigma$. Using the Cauchy-Schwartz inequality, we have the following.

[TABLE]

Inequality (60) follows. ∎

Lemma A.2**.**

Under the assumptions of Lemma A.1, the following inequality also holds.

[TABLE]

Proof.

Note that the quantity

[TABLE]

is linear in $c$. We have

[TABLE]

as desired. ∎

Now we use Lemma A.2 to address how smooth min-entropy behaves under normalization.

Proposition A.3**.**

Let $\sigma\in\mathcal{S}(QR)$ be a nonzero state, let $\Sigma$ be its normalization, and let $\delta>0$. Then,

[TABLE]

Proof.

Let $s=\textnormal{Tr}(\sigma)$. Find a state $\sigma^{\prime}$ satisfying satisfying $\textnormal{Tr}(\sigma^{\prime})\leq s$ and $P(\sigma^{\prime},\sigma)\leq\delta^{2}s/2$ such that

[TABLE]

(See the discussion following Definition 3.1.) The conditional min-entropy of $\sigma^{\prime}/s$ is then given by the expression on the righthand side of (68), and by Lemma A.2,

[TABLE]

Inequality (68) follows. ∎

The next proposition similarly addresses how $H_{0}^{\delta}$ behaves under normalization.

Proposition A.4**.**

Let $q$ be a nonzero subnormalized probability distribution on $S\times T$, where $S,T$ are finite sets, and let $s$ be the norm of $q$. Let $\delta>0$. Then,

[TABLE]

Proof.

This is immediate from the linearity of the distance function $\Delta$. ∎

Appendix B Proof of Proposition 4.1

Our proof builds off of steps from the proof of rigidity for the Magic Square game [32]. We will reproduce the fact that any near-optimal strategy for the Magic Square must involve approximately anti-commuting measurements, and use that fact to deduce inequality (37).

Let $\{F_{x}^{a}\},\{G_{y}^{b}\},\{{F^{\prime}}_{x}^{a}\}$ be the measurements used by Alice, Bob, and Alice*′*, respectively, which we will assume (without loss of generality) to be projective, and let $\Phi$ denote their shared state, which we will assume to be pure: $\Phi=\phi\phi^{*}$. For $i,j\in\{1,2,3\}$, let $F_{ij}$ denote the reflection operator

[TABLE]

define $F^{\prime}_{ij}$ similarly in terms of $\{{F^{\prime}}_{x}^{a}\}$, and let

[TABLE]

Note that $F_{ij}$ and $F_{ik}$ always commute and $F_{i1}F_{i2}F_{i3}=I$, that $G_{ij}$ and $G_{kj}$ always commute and $G_{1j}G_{2j}G_{3j}=-I$, and similar relationships hold for $F^{\prime}_{ij}$.

Let

[TABLE]

and

[TABLE]

Note that

[TABLE]

and also

[TABLE]

Thus,

[TABLE]

and to complete the proof it suffices to find a general lower bound for $\max\left\{\epsilon,\delta/2\right\}$.

Note that for any $i,j\in\{1,2,3\}$,

[TABLE]

and thus

[TABLE]

By similar reasoning,

[TABLE]

We exploit the approximate anti-commutativity relations for $\{F_{ij}\}$ which are proven in [32]. We have the following.

[TABLE]

By the concavity of the square root function, this yields

[TABLE]

We also have the following, in which we make use of the approximate compatibility of the measurements $\{F_{ij}\}$ and the measurements $\{F^{\prime}_{ij}\}$.

[TABLE]

Combining (91) via the triangle inequality with (87) (and using the fact that $(F_{22}F_{11}\otimes I)\phi$ is a unit vector) yields

[TABLE]

By symmetry, we likewise have the following for any $i,j,i^{\prime},j^{\prime}\in\{1,2,3\}$ with $i\neq i^{\prime},j\neq j^{\prime}$:

[TABLE]

Averaging all such inequalities and exploiting the concavity of the square root function, we obtain

[TABLE]

which implies

[TABLE]

From (95), we can compute a lower bound on $\max\{\epsilon,\delta/2\}$. If $\epsilon\leq\delta/2$, then,

[TABLE]

which yields

[TABLE]

while if $\epsilon\geq\delta/2$, similar reasoning yields

[TABLE]

Therefore,

[TABLE]

Substituting this value into (82), we find

[TABLE]

as desired.

Appendix C Randomly chosen rounds in parallel repetition of a free game

In this appendix, we prove that in a parallel repetition of a free game, the performance of the players on a small number of randomly chosen rounds is not much better than their performance would have been in a sequential scenario. Our proof is a rearrangement of elements from [8, 16, 9, 4].

For any state $\rho$ of a bipartite system $QR$, the mutual information between $Q$ and $R$ and is given by

[TABLE]

Let $S(\rho\|\sigma)=\textnormal{Tr}[\rho\log\rho]-\textnormal{Tr}[\rho\log\sigma]$ denote the relative entropy function. The following relationship holds:

[TABLE]

Also, the relative entropy function is related to the purified distance as follows: if $\alpha,\beta$ are density operators, then

[TABLE]

(This follows from, e.g., Lemma 5 in [17].)

Throughout this section, we assume that a free game $G=(\mathcal{X},\mathcal{A},p,L)$, with $w(G)>0$, has been fixed. (Thus we avoid any need to note the influence of $G$ on error terms.)

C.1 Preliminaries

Our first result asserts (roughly) that if a state $\gamma$ of a bipartite system $TQ$ is dominated by a small scalar multiple of a state that is uniform on $T$, then $H(T\mid Q)_{\gamma}$ must be close to $\log\left|T\right|$.

Lemma C.1**.**

Let $\gamma$ be a classical-quantum state of a bipartite system $TQ$ such that

[TABLE]

where $\lambda$ denotes a real number. Then,

[TABLE]

Proof.

We have $H(T\mid Q)_{\gamma}=H(T)_{\gamma}-I(T:Q)_{\gamma}$. It is obvious that the quantity $H(T)_{\gamma}$ is at least $\log\left|T\right|-\log(1/\lambda)$ since the eigenvalues of $\gamma^{T}$ do not exceed $\lambda/\left|T\right|$. Thus we need only prove that $I(T:Q)_{\gamma}\leq\log(1/\lambda)$.

We can write

[TABLE]

Note that the quantity

[TABLE]

is equal to $S(U_{T}\|\gamma^{T})$, which is nonnegative, and therefore

[TABLE]

We therefore have the following, using the fact that the logarithm function is operator monotone:

[TABLE]

as desired. ∎

By definition, if two pure bipartite states $\psi,\phi\in\mathcal{D}(Q\otimes R)$ are such that $P(\psi^{Q},\phi^{Q})=\delta$, then there is a unitary automorphism of $R$ which maps $\phi$ to a state that is within $\Delta$-distance $\delta$ from $\psi$. The next lemma asserts that if these bipartite states have some additional structure, then we can find such a unitary automorphism that is similarly structured.

Lemma C.2**.**

Suppose that $S,S^{\prime},Q,R$ are registers, where $S$ is a copy of $S^{\prime}$, and that $\psi,\phi$ are pure states on $SS^{\prime}QR$ that are supported on $\textnormal{Span}\{e\otimes e\}\otimes Q\otimes R$, where $e$ varies over the standard basis elements of $S,S^{\prime}$. Let $\delta=P(\psi^{SQ},\phi^{SQ})$. Then, there exists an $S^{\prime}$-controlled unitary operator $U$ on $S^{\prime}\otimes R$ such that $\Delta(U\psi,\phi)=\delta$.

Proof.

Write $\psi=uu^{*},\phi=vv^{*}$ with

[TABLE]

where $e,f,g$ vary over the standard basis elements of $S,Q,R$, respectively. The fidelity $F(\psi^{SQ},\phi^{SQ})$ is then given by the expression

[TABLE]

where $M^{e}=[m_{fg}^{e}]_{fg}$ and $N^{e}=[n_{fg}^{e}]_{fg}$ denote linear operators from $R$ to $Q$. Find unitary operators $U^{e}\colon R\to R$ such that

[TABLE]

Then, the controlled operator $\sum_{e}ee^{*}\otimes U^{e}$ on $S^{\prime}\otimes R$ satisfies the desired condition. ∎

Now we prove a proposition about states that approximate the behavior of players in a free nonlocal game. (The statement of this proposition is based in particular on the statement of Lemma 4.3 in [9].)

Proposition C.3**.**

Let $X,X^{\prime}$ denote $\mathcal{X}$-valued registers, let $A$ denote an $\mathcal{A}$-valued register, and let $Q=Q^{1}Q^{2}\cdots Q^{n}$ denote a $n$-partite register. Let $\psi$ be a pure state of $XX^{\prime}QA$ given by $\psi=uu^{*}$,

[TABLE]

where $\mu$ is a probability distribution on $\mathcal{X}$ and each $u_{x}$ is a unit vector in $QA$, and suppose that

[TABLE]

for all $k\in\{1,2,\ldots,n\}$. Then,

[TABLE]

Proof.

Case 1: Assume that $\delta=0$.

Then, the state of $X^{k}(X{X^{\prime}}QA)^{\widehat{k}}$ is uniform on $X^{k}$. Making use of Lemma C.2, we can find unitary automorphisms $U^{k}_{x^{k}\to y^{k}}$ on $Q^{k}A^{k}$ for any $x^{k},y^{k}\in\mathcal{X}^{k}$ such that

[TABLE]

The expected score $\mathbb{E}_{\psi}\left[L(X,A)\right]$ can be achieved at the game $G$ by having the $n$-players share some state of the form $u_{x}u_{x}^{*}$ with $x\in\mathcal{X}$, receiving an input sequence $y^{1}\ldots y^{n}\in\mathcal{X}$, each applying the unitary $U^{k}_{x^{k}\to y^{k}}$ to their subsystem, and then measuring $A^{k}$ to determine their output. This is a valid quantum strategy, and so $\mathbb{E}_{\psi}\left[L(X,A)\right]$ cannot exceed $w(G)$.

Case 2: General case.

Note that

[TABLE]

or equivalently,

[TABLE]

Therefore

[TABLE]

Also, since $H(X^{k})_{\psi}\geq\log\left|\mathcal{X}^{k}\right|-\delta$ and $I(X^{k}:X^{1\ldots(k-1)})\leq\delta$, the chain rule implies $H(X)_{\psi}\geq\log\left|\mathcal{X}\right|-O(\delta)$, and therefore the distribution of $\mu$ is within purified distance $O(\sqrt{\delta})$ from a uniform distribution. Thus,

[TABLE]

We will reduce to Case 1 via the use of a “decoupling” procedure. Let $Y,Y^{\prime}$ denote $\mathcal{X}$-valued registers. Let $\Psi$ be the state of $XX^{\prime}YY^{\prime}AQ$ such that $XX^{\prime}AQ$ are in state $\psi$ and each register $Y^{k}{Y^{\prime}}^{k}$ is in a Bell state. Consider the following two-step process carried out on the state $\Psi$ by player $k$. For simplicity, let $\textit{Player}^{k}=(XX^{\prime}YY^{\prime}AQ)^{k}$.

(Swap.) Swap the state of the registers $X^{k}{X^{\prime}}^{k}$ with the state of the registers $Y^{k}{Y^{\prime}}^{k}$. 2. 2.

(Recover.) The state of the registers $X^{k}\textit{Player}^{\widehat{k}}$ is now

[TABLE]

Using inequality (126) and Lemma C.2, apply an ${X^{\prime}}^{k}$-controlled unitary operator $V^{k}$ to the register $(X^{\prime}YY^{\prime}AQ)^{k}$ to bring the registers $\textit{Player}^{1\ldots n}$ to a state that is within purified distance $O(\sqrt{\delta})$ from state $\Psi$.

Denote this process (which takes place on the registers $\textit{Player}^{k}$) by the symbol $\mathcal{U}^{k}$. The state $\mathcal{U}^{k}(\Psi)$ is within purified distance $O(\sqrt{\delta})$ from $\Psi$. At the same time — since the registers $X^{k}\textit{Player}^{\widehat{k}}$ are not used in step 2 — we have $H(X^{k}\mid\textit{Player}^{\widehat{k}})=\log\left|\mathcal{X}\right|$ under the state $\mathcal{U}^{k}(\Psi)$.

Applying the data processing inequality and the triangle inequality, the state

[TABLE]

is within $\Delta$-distance $O(\sqrt{\delta})$ from $\Psi$, and it also satisfies

[TABLE]

for all $k$. The desired result therefore follows from Case 1. ∎

C.2 The Pure Parallel Repetition Process

We study the parallel repetition process given in Figure 7 (PureParallel). This PureParallel process is similar to the process Par in Figure 3, except that it assumes the strategy used by the players involves a pure state and projective measurements, and that they obtain their input symbols from a maximally entangled state.

For each $i\in\{1,2,\ldots,n\}$ and $t\in\{1,2,\ldots,N\}$, let $\textit{Player}^{i}_{t}$ denote the registers of which player $i$ has knowledge at the conclusion of step $(t+4)$:

[TABLE]

Then, following our convention, $\textit{Player}^{\widehat{i}}_{t}$ denotes the registers of which players $1,2,\ldots,i-1,i+1,\ldots,n$ have knowledge at conclusion of step $(t+4)$:

[TABLE]

The next proposition asserts that, if the probability of winning the first $t$ rounds is not too unlikely, then these players possess only a limited amount of information about player $i$’s input on the $(t+1)$st round. The lower bound that we choose for the winning probability in the first $t$ rounds can be somewhat arbitrary; we will take it to be $w(G)^{2t}$.

Proposition C.4**.**

Suppose that $\mathbf{P}(W_{1\ldots t}=\mathbf{1})\geq w(G)^{2t}$ in PureParallel. Then, for any $i\in\{1,2,\ldots,n\}$, the state $\Gamma^{t+4}$ that occurs after step $t+4$ satisfies

[TABLE]

Proof.

Note that in the state $\Gamma^{t+4}$, the registers $X^{i}$ are uniformly distributed relative to $X^{\widehat{i}}{X^{\prime}}^{\widehat{i}}A^{\widehat{i}}C^{\widehat{i}}P$. Since the conditional state $\Gamma^{t+4}_{\mid W_{1\ldots t}=\mathbf{1}}$ satisfies

[TABLE]

we have by Lemma C.1 that

[TABLE]

The registers $X^{i}_{1\ldots t}A^{i}_{1\ldots t}$ have a range of size $2^{O(t)}$, and so when we additionally condition on them we obtain

[TABLE]

which implies

[TABLE]

By permutation symmetry, the value of every term in the summation in (136) is the same.444The permutation symmetry argument can be made explicit as follows. Let $p^{j}_{\sigma}=\mathbf{P}(W_{1\ldots t}=\mathbf{1},P=\sigma)$. Let $s^{j}_{\sigma}:=H(X^{i}_{j}\mid\textit{Player}^{\widehat{i}},W_{1\ldots t}=\mathbf{1},P=\sigma)$ if $p^{j}_{\sigma}\neq 0$ (and otherwise, let $s^{j}_{\sigma}=0$). Then, the terms of the summation in (136) are the quantities $\left(\sum_{\sigma}p^{j}_{\sigma}s^{j}_{\sigma}\right)$ for $j\in\{t+1,\ldots,N\}$. For any $j,\ell\in\{t+1,\ldots,N\}$, if we choose an $N$-permutation $\alpha$ that maps $j$ to $\ell$ and fixes $\{1,2,\ldots,t\}$, then $p^{j}_{\sigma}s^{j}_{\sigma}=p^{\ell}_{(\alpha\circ\sigma)}s^{\ell}_{(\alpha\circ\sigma)}$, and so the quantities $\sum_{\sigma}p^{j}_{\sigma}s^{j}_{\sigma}$ and $\sum_{\sigma}p^{\ell}_{\sigma}s^{\ell}_{\sigma}$ are the same. Therefore,

[TABLE]

as desired. ∎

We will use the previous proposition to prove by induction an upper bound on the probability that $W_{1\ldots t}=\mathbf{1}$.

Proposition C.5**.**

Suppose that $\mathbf{P}(WIN(t))\geq w(G)^{2t}$. Then,

[TABLE]

Proof.

Consider the state of the PureParallel protocol after step $t+4$. By Proposition C.4, the expected value of the quantity

[TABLE]

when $x_{1\ldots t},a_{1\ldots t},\sigma$ vary according to the distribution given by the state $\Gamma^{t+4}_{\mid W_{1\ldots t}=\mathbf{1}}$, is lower bounded by $\log\left|\mathcal{X}^{i}\right|-O(t/N)$. Additionally, the state of the registers $\textit{Player}^{1\ldots n}_{t}$ when conditioned on any such values $X_{1\ldots t}=x_{1\ldots t},A_{1\ldots t}=a_{1\ldots t},P=\sigma$, is a pure state. By Proposition C.3 and the concavity of the square root function, the probability of the players winning the $(t+1)$st game under the distribution $\Gamma^{t+4}_{\mid WIN(t)}$ is no more than $w(G)+O(\sqrt{t/N})$, as desired. ∎

Theorem C.6**.**

For any $t\in\{1,2,\ldots,N\}$,

[TABLE]

Proof.

Let $E$ denote the function represented by $O$ on the righthand side of inequality (139). We apply induction on $t$. The base case is obvious. For the inductive step, assume that

[TABLE]

holds for a given value of $t\in\{1,2,\ldots,N-1\}$. If $\mathbf{P}(W_{1\ldots t}=\mathbf{1})<(w(G))^{2t}$, then

[TABLE]

and there is nothing to prove. If $\mathbf{P}(W_{1\ldots t}=\mathbf{1})\geq(w(G))^{2t}$, then by Proposition C.5,

[TABLE]

which completes the proof. ∎