Experimental Realization of Device-Independent Quantum Randomness Expansion

TL;DR

This paper reports the first experimental demonstration of device-independent quantum randomness expansion, generating over 500 million quantum-proof random bits with high security and minimal soundness error, advancing practical quantum cryptography.

Contribution

It presents the first experimental realization of device-independent quantum randomness expansion secure against quantum side information, using quantum probability estimation.

Findings

Generated 5.47×10^8 quantum-proof random bits

Expanded randomness by 1.08×10^8 bits in 13.1 hours

Achieved a total soundness error of 4.6×10^{-10}

Abstract

Randomness expansion where one generates a longer sequence of random numbers from a short one is viable in quantum mechanics but not allowed classically. Device-independent quantum randomness expansion provides a randomness resource of the highest security level. Here, we report the first experimental realization of device-independent quantum randomness expansion secure against quantum side information established through quantum probability estimation. We generate $5.47\times10^8$ quantum-proof random bits while consuming $4.39\times10^8$ bits of entropy, expanding our store of randomness by $1.08\times10^8$ bits at a latency of about $13.1$ h, with a total soundness error $4.6\times10^{-10}$. Device-independent quantum randomness expansion not only enriches our understanding of randomness but also sets a solid base to bring quantum-certifiable random bits into realistic applications.

Figures

Tables

Table 1. Table 1: Optical efficiencies in the experiment.

Parties	Heralding, $\eta$	${\eta }^{sc}$	${\eta }^{so}$	${\eta }^{fibre}$	${\eta }^m$	${\eta }^{det}$
Alice	80.50%	92.3%	95.9%	99%	95.1%	96.6%
Bob	82.20%	93.1%			95.3%	97.3%

Table 2. Table 2: The empirical input-output counts from the training set.

	00	01	10	11
00	42212881971	318991793	275003068	629231576
01	1240932	27956	6070	21021
10	1243249	6689	27566	21427
11	1201874	45577	45611	3620

Table 3. Table 3: The empirical input-output distribution ν ​ ( A ​ B ​ X ​ Y ) 𝜈 𝐴 𝐵 𝑋 𝑌 \nu(ABXY) . An MLE is applied to the empirical data to derive a probability distribution adapted to the model used. Here we present the result to 20 decimal places.

	00	01	10	11
00	0.97199465625472059038	0.00715304637435085818	0.00631932133640711064	0.01444343448724344329
01	0.00002857430319592834	0.00000065311397457615	0.00000014282560923430	0.00000047693964624017
10	0.00002858371146706307	0.00000015598344257690	0.00000061881913175867	0.00000048866838458032
11	0.00002769260884464488	0.00000104708606499509	0.00000102451996051776	0.00000008296755582123

Table 4. Table 4: The optimal PEF F ′ ​ ( A ​ B ​ X ​ Y ) superscript 𝐹 ′ 𝐴 𝐵 𝑋 𝑌 F^{\prime}(ABXY) with power α = 1 + 1.172 × 10 − 6 𝛼 1 1.172 superscript 10 6 \alpha=1+1.172\times 10^{-6} . Here we present the result to 20 decimal places.

	00	01	10	11
00	1.00000000110510334216	0.99999903566359593654	0.99999908430264417003	1.00000100579637485331
01	1.00022934253952033856	0.98995503866430756279	0.93407594075304811731	1.02073956349038930113
10	1.00023612022915342478	0.93601590290081493339	0.98948855714127381677	1.02175557026355190437
11	0.99949697803240911131	1.00975800133726889562	1.01028078627036155268	0.92372918497532785497

Table 5. Table 5: Results of the NIST test suite dividing our output into 1 Mbit sections.

Statistical tests	P value	Proportion	Result
Frequency	0.38288	0.993	Success
BlockFrequency	0.70425	0.993	Success
CumulativeSums	0.30262	0.994	Success
Runs	0.77097	0.994	Success
LongestRun	0.61977	0.991	Success
Rank	0.95893	0.991	Success
FFT	0.60438	0.985	Success
NonOverlappingTemplate	0.48848	0.990	Success
OverlappingTemplate	0.15201	0.991	Success
Universal	0.66986	0.991	Success
ApproximateEntropy	0.71183	0.991	Success
RandomExcursions	0.35459	0.987	Success
RandomExcursionsVariant	0.42987	0.993	Success
Serial	0.13519	0.995	Success
LinearComplexity	0.81954	0.987	Success

Equations

$$H_{\text{min}}^{{\epsilon }_h}(\mathbf{C}|\mathbf{Z}E{)}_{{\rho }_{\mathbf{CZ}E|\Phi }}\ge h_s-\frac{1}{\alpha -1}{\log }_2\left(\frac{2}{{\epsilon }_h^2}\right)+\frac{\alpha }{\alpha -1}{\log }_2\kappa ,$$

$$r_{\text{in}}=h(q)+2q,$$

$$\mathcal{M}(\mathbf{C},\mathbf{Z})=\left\{{\rho }_{\mathbf{CZ}E}:{\rho }_{\mathbf{CZ}E}=\sum _{\mathbf{c},\mathbf{z}}|\mathbf{c}\mathbf{z}⟩⟨\mathbf{c}\mathbf{z}|\otimes {\rho }_E(\mathbf{c}\mathbf{z})\right\}=\mathcal{P}(\mathbf{Z})\mathcal{M}(\mathbf{C}|\mathbf{Z}),$$

$$\exists {\rho }_{ABE}\in \mathcal{D}({\mathcal{H}}_{ABE}),\text{POVM Measurements }\{N_{\mathbf{x}}^{\mathbf{a}}\},\{N_{\mathbf{y}}^{\mathbf{b}}\},\mu (\mathbf{Z})\in \mathcal{P}(\mathbf{Z}),$$

$$\text{such that }\forall \mathbf{c}=(\mathbf{a},\mathbf{b})\in \mathbf{C},\mathbf{z}=(\mathbf{x},\mathbf{y})\in \mathbf{Z},$$

$${\rho }_E(\mathbf{c}|\mathbf{z})={\mathrm{Tr}}_{AB}[{\rho }_{ABE}(N_{\mathbf{x}}^{\mathbf{a}}\otimes N_{\mathbf{y}}^{\mathbf{b}}\otimes I_E)],$$

$${\rho }_E(\mathbf{cz})=\mu (\mathbf{z}){\rho }_E(\mathbf{c}|\mathbf{z}),$$

$$\sum _{\mathbf{c}\in \mathbf{C}}\mathrm{Tr}[{\rho }_E(\mathbf{cz})]=\mu (\mathbf{z}).$$

$$\sum _{\begin{array}{c}{c}_n\in C_n,\\ z_n\in Z_n\end{array}}{\rho }_{\mathbf{CZ}E}$$

$${\rho }_{{\mathbf{c}}_{<n}{\mathbf{z}}_{<n}{C}_n{Z}_{n}E}$$

$${\rho }_{{\mathbf{c}}_{<n}{\mathbf{z}}_{<n}{C}_n{Z}_{n}E}=\sum _{c_n,z_n}|{\mathbf{c}}_{<n}{\mathbf{z}}_{<n}{c}_n{z}_n⟩⟨{\mathbf{c}}_{<n}{\mathbf{z}}_{<n}{c}_n{z}_n|\otimes {\rho }_E(c_n{z}_n).$$

$${\rho }_{ABC}=\underset{\lambda }{⨁}{p}_{\lambda }{\tau }_{A{a}_{\lambda }}\otimes {\chi }_{c_{\lambda }C},{\tau }_{A{a}_{\lambda }}\in \mathcal{D}({\mathcal{H}}_A\otimes {\mathcal{H}}_{a_{\lambda }}),{\chi }_{c_{\lambda }C}\in \mathcal{D}({\mathcal{H}}_{c_{\lambda }}\otimes {\mathcal{H}}_C),p_{\lambda }\ge 0,\forall \lambda .$$

$${\mathcal{M}}_{\le n}({\mathbf{C}}_{\le n},{\mathbf{Z}}_{\le n})={\mathcal{M}}_{<n}({\mathbf{C}}_{<n},{\mathbf{Z}}_{<n})\circ {\mathcal{M}}_n(C_n,Z_n{)}_{{\mathbf{c}}_{<n}{\mathbf{z}}_{<n}}={\mathcal{M}}_1(C_1,Z_1)\circ {\mathcal{M}}_2(C_2,Z_2{)}_{c_1{z}_1}\circ \cdots {\mathcal{M}}_n(C_n,Z_n{)}_{{\mathbf{c}}_{<n}{\mathbf{z}}_{<n}}.$$

$${\rho }_{CZE}=\sum _{c,z}|cz⟩⟨cz|\otimes \left(\mu (z){\mathrm{Tr}}_{AB}[{\rho }_{ABE}(P_{c|z}\otimes {\mathbb{I}}_E)]\right).$$

$${\rho }_{CZE}=\sum _{c,z}\mu (z)|cz⟩⟨cz|\otimes U{\tau }^{1/2}{P}_{c|z}{\tau }^{1/2}{U}^{†},$$

$$Q_{a|0;{\theta }_1}=\frac{\mathbb{I}+(-1{)}^a{\sigma }_z}{2},$$

$$Q_{a|1;{\theta }_1}=\frac{\mathbb{I}+(-1{)}^a[\cos ({\theta }_1){\sigma }_z+\sin ({\theta }_1){\sigma }_x]}{2},{\theta }_1\in (-\pi ,\pi ],$$

$$\mathcal{M}(C,Z)=\text{span}\{{\mu }_i(Z)\}\times \mathcal{M}(C|Z)=\{\tilde{\mu }(Z){\rho }_{CE|Z}:{\rho }_{CE|Z}\in \mathcal{M}(C|Z),\tilde{\mu }(Z)\in \text{span}\{{\mu }_i(Z)\}\}.$$

$${\mathcal{R}}_{\alpha }(\rho |\sigma )=\mathrm{Tr}\left[{\left({\sigma }^{-\beta /(2\alpha )}\rho {\sigma }^{-\beta /(2\alpha )}\right)}^{\alpha }\right].$$

$$\sum _{\mathbf{c},\mathbf{z}}F(\mathbf{cz}){\mathcal{R}}_{\alpha }({\tau }_E(\mathbf{cz})|{\tau }_E(\mathbf{z}))\le 1,\alpha >1,$$

$$\tau =\sum _{\mathbf{c},\mathbf{z}}|\mathbf{c}\mathbf{z}⟩⟨\mathbf{c}\mathbf{z}|\otimes {\tau }_E(\mathbf{c}\mathbf{z}),{\tau }_E(\mathbf{z})=\sum _{\mathbf{c}}{\tau }_E(\mathbf{cz}).$$

$$H_{\text{min}}^{{\epsilon }_h}(\mathbf{C}|\mathbf{Z}E{)}_{\rho }=\underset{\begin{array}{c}P({\rho }^{\prime },\rho )\le {\epsilon }_h,\\ {\rho }^{\prime }\in \mathcal{S}({\mathcal{H}}_{CZE})\end{array}}{\max }{H}_{\text{min}}(\mathbf{C}|\mathbf{Z}E{)}_{{\rho }^{\prime }},$$

$$H_{\text{min}}(\mathbf{C}|\mathbf{Z}E{)}_{{\rho }^{\prime }}=\underset{\sigma \in \mathcal{S}({\mathcal{H}}_{ZE})}{\sup }\underset{\lambda }{\sup }\{\lambda \in \mathbb{R}:{\rho }^{\prime }\le \exp (-\lambda )I_C\otimes \sigma \},$$

$$P(\rho ,\tau )=\sqrt{1-{\left(\mathrm{Tr}|\sqrt{\rho }\sqrt{\tau }|+\sqrt{(1-\mathrm{Tr}[\rho ])(1-\mathrm{Tr}[\tau ])}\right)}^2}$$

$$H_{\text{min}}^{{\epsilon }_h}(\mathbf{C}|\mathbf{Z}E{)}_{\rho }\ge h_s-\frac{1}{\alpha -1}{\log }_2\left(\frac{2}{{\epsilon }_h^2}\right)+\frac{\alpha }{\alpha -1}{\log }_2\kappa .$$

$$\underset{F(CZ),\alpha }{\max }{r}_{\nu }(F,\alpha )=\frac{1}{\alpha -1}\sum _{cz}\nu (cz){\log }_2(F(cz)),$$

$$\displaystyle\text{s.t.}\left\{\begin{array}[]{lr}F(cz)\geq 0,\,\forall c\in C,\,z\in Z,&\\ \sum_{cz}F(cz)\mathcal{R}_{\alpha}(cz|z)_{\tau_{E}(cz)}\leq 1,\,\forall\tau\in\mathcal{M}(C,Z),&\\ \alpha>1.\end{array}\right.$$

$$\underset{F^{\prime }(CZ),\alpha }{\max }{r}_{\nu }(F^{\prime },\alpha )=\frac{1}{\alpha -1}\sum _{cz}\nu (cz){\log }_2(F^{\prime }(cz)),$$

$$\displaystyle\text{s.t.}\left\{\begin{array}[]{lr}F^{\prime}(CZ)\geq 0,\,\forall c\in C,\,z\in Z,&\\ \sum_{cz}F^{\prime}(cz)\tau^{\prime}(c|z)^{\alpha-1}\tau^{\prime}(cz)\leq 1,\,\forall\tau^{\prime}(CZ)\in\mathcal{M}_{C}(C,Z),&\\ \alpha>1.\end{array}\right.$$

$$\underset{F^{\prime }(CZ),\alpha }{\max }{r}_{\nu }(F^{\prime },\alpha )=\frac{1}{\alpha -1}\sum _{cz}\nu (cz){\log }_2(F^{\prime }(cz)),$$

$$\displaystyle\text{s.t.}\left\{\begin{array}[]{lr}F^{\prime}(CZ)>0,\,\forall c\in C,\,z\in Z,&\\ \sum_{cz}F^{\prime}(cz)\tau^{\prime}_{k}(c|z)^{\alpha-1}\tau^{\prime}_{k}(cz)\leq 1,\,k=1,2,\cdots,80,&\\ \alpha>1.\end{array}\right.$$

$$\underset{\nu }{\max }\sum _{abxy}p(ab|xy)\log \nu (abxy),$$

$$\displaystyle\text{s.t. }\left\{\begin{array}[]{lr}\nu(xy)=\mu(xy),&\\ \nu(a|xy)=\nu(a|x),\nu(b|xy)=\nu(b|y).\end{array}\right.$$

$$\tilde{f}=\underset{\tau ,\theta }{\max }\sum _{cz}\mu (z){\tilde{F}}^{\prime }(cz)(\mathrm{Tr}[P_{c|z;\theta }{\tau }^{1/\alpha }{P}_{c|z;\theta }]{)}^{\alpha },$$

$$\text{s.t. }\theta =({\theta }_1,{\theta }_2)\in [0,\pi ]\times [0,\pi ],\tau ⪰0\text{ with }\mathrm{Tr}[\tau ]=1.$$

$$\tilde{f}(\theta )=\underset{\tau }{\max }\sum _{cz}\mu (z){\tilde{F}}^{\prime }(cz)(\mathrm{Tr}[P_{c|z;\theta }{\tau }^{1/\alpha }{P}_{c|z;\theta }]{)}^{\alpha }.$$

$$\tilde{f}(\theta ")\le \frac{[\sin (\varphi -\phi )+\sin (\phi ){]}^{\alpha -1}[\sin (\varphi -\phi )\tilde{f}(\theta )+\sin (\phi )\tilde{f}({\theta }^{\prime })]}{\sin (\varphi {)}^{\alpha }}\le {\left(\frac{\varphi }{\sin (\varphi )}\right)}^{\alpha }\max (\tilde{f}(\theta ),\tilde{f}({\theta }^{\prime })).$$

Full text

††preprint: APS/123-QED

Randomness is a fundamental element of nature and ubiquitous in human activities. Intrinsically, randomness comes from the breaking of quantum coherence Ma et al. (2016); Acín and Masanes (2016); Herrero-Collantes and Garcia-Escartin (2017). The loophole-free violation of a Bell inequality Bell (1964); Hensen et al. (2015); Shalm et al. (2015); Giustina et al. (2015); Rosenfeld et al. (2017); Li et al. (2018) certifies entanglement, a special form of coherence, in a device-independent manner. This is the essence of device-independent quantum random number generation (DIQRNG) Colbeck ; Pironio et al. (2010); Colbeck and Kent (2011), and the rigorous security analysis makes it possible to design experiments secure against general attacks even under the extreme condition that the experimental devices themselves are not trusted Ma et al. (2016); Acín and Masanes (2016); Herrero-Collantes and Garcia-Escartin (2017). The random bits certified in the loophole-free DIQRNG experiments are at the highest level of security among its kind being unpredictable to any strategies based on quantum or classical physics Liu et al. (2018a); Bierhorst et al. (2018); Zhang et al. (2020a). Randomness is required for setting the inputs of a Bell test, however, and in previous experimental realizations, more randomness is consumed than the certified  Pironio et al. (2010); Liu et al. (2018a); Zhang et al. (2020a); Bierhorst et al. (2018). As it becomes publicly known after the experiment, the input randomness is consumed and cannot be reused. Otherwise, an adversary can take advantage of the information leakage and compromise the security of DIQRNG Colbeck . Theoretically, the amount of input randomness can be made arbitrarily small for the certification of the Bell inequality violation and further the randomness generation Miller and Shi (2014), and it is possible that the amount of generated randomness surpasses the input, which is randomness expansion. Randomness expansion compensates the store of randomness for the consumption and provides more, eliminating the potential risk in security due to the circular involvement of randomness.

The realization of device-independent quantum randomness expansion (DIQRE) has remained an outstanding challenge as it poses even stricter requirements than the loophole-free violation of Bell inequalities and DIQRNG. In fact, the latter two tasks are prerequisites for randomness expansion. Besides, DIQRE requires a highly biased input probability distribution Vazirani and Vidick (2012); Miller and Shi (2014), which causes larger statistical fluctuations and takes more statistics for successful certification. Consequently, it is experimentally more demanding to realise DIQRE in a reasonable time. For instance, higher detection efficiency, higher visibility, and a more robust system behavior are required. While entangled atomic systems Hensen et al. (2015); Rosenfeld et al. (2017) promise a large violation of Bell inequality, these systems are currently constrained by low event rates, making it hard to obtain decent experimental statistics within a reasonable time frame. Entangled photonic systems Shalm et al. (2015); Giustina et al. (2015); Li et al. (2018); Liu et al. (2018b); Bierhorst et al. (2018); Liu et al. (2018a); Zhang et al. (2020a) on the other hand exhibit a relatively small violation of Bell inequality, but can be operated at very high event rates, thus providing an opportunity to achieve randomness expansion. We present here a concrete realization of DIQRE secure against a general quantum adversary111We do not consider the memory attack in reusing the protocol Barrett et al. (2013). For one run of the experiment the memory attacks do not play a role (the randomness remains secure provided the devices used are kept secure after the experiment). taking advantage of two recent advancements. One is the development of cutting-edge single-photon detection with near unity efficiency Eisaman et al. (2011), which makes entangled photon-based loophole-free Bell test experiments viable. The other is the development of theoretical protocols Pironio et al. (2010); Vazirani and Vidick (2012); Miller and Shi (2014); Coudron and Yuen (2014); Arnon-Friedman et al. (2018); Zhang et al. (2020b); Brown et al. (2019), which allows for the efficient generation of randomness secure against quantum side information in device-independent experiments, such as the quantum probability estimation (QPE) method Zhang et al. (2020b). Below we briefly describe the spot-checking QPE method and our procedure to apply it to realize DIQRE.

A procedure to realize randomness expansion according to the spot-checking QPE method is given in Box 1. The procedure consists of three key steps: parameter assignments, experimental randomness expansion and randomness extraction. The randomness expansion experiment is based on a sequence of Bell-test trials in the format of Clauser-Horne-Shimony-Holt (CHSH) game Clauser et al. (1969) (see Fig. 1 for experimental schematics and assumptions). In the $i$th trial, a source at the central station prepares a pair of entangled photons and sends them to two spatially separated parties, Alice and Bob. A coordinating random number generator independent of the measurement devices and the source generates a bit $T_{i}=0$ (or $T_{i}=1$) with nonzero probability $1-q$ (or $q$), respectively. If $T_{i}=0$, the trial is a “spot trial” where Alice and Bob set their input measurement settings to $X_{i}=0,\,Y_{i}=0$. If $T_{i}=1$, the trial is a “checking trial” where Alice and Bob choose their own measurement settings $X_{i},\,Y_{i}\in\{0,1\}$ independently and uniformly at random. The value of $T_{i}$ is kept private from the measurement devices. At the end of the trial Alice and Bob deliver an output $A_{i},\,B_{i}\in\{0,1\}$, respectively. For a total number of $n$ experimental trials, we denote the input sequences by $\bm{X}=(X_{1},X_{2},\cdots,X_{n}),\,\bm{Y}=(Y_{1},Y_{2},\cdots,Y_{n}),\,\bm{T}=(T_{1},T_{2},\cdots,T_{n})$, the outcome sequences by $\bm{A}=(A_{1},A_{2},\cdots,A_{n}),\,\bm{B}=(B_{1},B_{2},\cdots,B_{n})$, respectively, and further denote $\bm{Z}=\bm{X}\bm{Y},\,\bm{C}=\bm{A}\bm{B}$ and $Z_{i}=X_{i}Y_{i},\,C_{i}=A_{i}B_{i}$.

In an adversarial picture, the source and measurement devices are prepared by a potentially malicious party, Eve, in advance of the experiment. Generally, the behavior of the quantum devices in each trial can be different and depend on previous events. The final state after the experiment can be described by a classical-quantum state shared by Alice, Bob, and Eve, $\rho_{\bm{CZ}E}=\sum_{\bm{c},\bm{z}}\ket{\bm{c}\bm{z}}\bra{\bm{c}\bm{z}}\otimes\rho_{E}(\bm{c}\bm{z})$. We use lowercase letters to denote the values that the variables actually take in an experiment, and $(\bm{c},\bm{z})$ is one specific realization of the experiment’s input-output sequence occurring with the probability $\mathrm{Tr}[\rho_{E}(\bm{c}\bm{z})]$. The random variable $\bm{T}$ can be omitted without loss of generality, as we assume its value to be secret to Eve. The quantum system of Eve, $\rho_{E}$, carries the quantum side information of the measurement results. We define the set of all possible joint final states after the experiment to be the model $\mathcal{M}(\bm{C},\bm{Z})$.

For randomness expansion, we determine a quantum estimation factor (QEF) $F(\bm{CZ})$ with power $\alpha$ for the model $\mathcal{M}(\bm{C},\bm{Z})$. Informally speaking, with a fixed security parameter $\varepsilon_{h}$, the quantity $\{\log_{2}[F(\bm{cz})]+\log_{2}(\varepsilon_{h}^{2}/2)\}/(\alpha-1)$ witnesses the amount of private randomness extractable from the outputs $\bm{c}$. To turn it into a rigorous statement, we need to determine a criterion of success before running the protocol. The protocol succeeds if $F(\bm{cz})\geq 2^{h_{s}(\alpha-1)}$, where $h_{s}$ (bits) is the success threshold. We denote the set of success events as $\Phi$ and $\kappa\in(0,1)$ as the predetermined lower bound on the success probability. Then, for an arbitrary state $\rho_{\bm{CZ}E}$ in the model, either the protocol success probability is less than $\kappa$, or the smooth min-entropy conditional on the success is lower bounded by Zhang et al. (2020b)

[TABLE]

where $\varepsilon_{h}$ is the smoothing parameter in the smooth min-entropy of $\bm{C}$ conditioned on $\bm{Z}E$, and $\rho_{\bm{CZ}E|\Phi}$ represents the normalized state conditional on the success. In particular, this result holds for the general condition. To obtain a lower bound on the $\varepsilon_{h}$-smooth min-entropy, a lower bound $\kappa$ on the success probability is required. Literature suggests setting $\kappa=\varepsilon_{h}$ to obtain a conservative lower bound on the $\varepsilon_{h}$-smooth min-entropy Arnon-Friedman et al. (2018); Zhang et al. (2020b). However, we remark that the lower bound $\kappa$ is irrelevant for the soundness proof of the randomness generation protocol with QEFs (see Theorem 4 of Ref. Zhang et al. (2020b)). Because at each trial the probability distributions of the input variables $T_{i}$, $X_{i}$, and $Y_{i}$ are independent of the previous results and the quantum side information, a valid QEF $F(\bm{CZ})$ for a sequence of trials can be obtained by chaining the QEFs $F(C_{i}Z_{i})$ for each experimental trial in the sequence (see Appendix A.2).

If the success threshold is met in the experimental randomness expansion procedure, the protocol shall proceed to randomness extraction. We use a quantum-proof strong extractor to extract certified random bits from the output sequence with a security parameter $\varepsilon_{x}$ Ma et al. (2013) (see Appendix A.4 for details in randomness extraction). Informally speaking, the extractor takes the experimental output sequence $\bm{C}$ in the Bell test, together with a uniform bit string $S$, or the seed, as the input, and delivers a string of near-uniform random bits, except for a failure probability no larger than $\varepsilon_{x}$. We do not consider the seed as entropy consumed in the experiment, since by definition the seed of a strong extractor can be reused albeit at the cost of the security parameter increased by $\varepsilon_{x}$ Ma et al. (2013). Security is not compromised even if the seed is known by Eve after the execution of the protocol, as long as it is independent of the raw data and the classical postprocessing process is authenticated. Guaranteed by the composable security property, the total failure probability of the protocol, or the soundness error, is no larger than $\varepsilon_{S}=2\varepsilon_{h}+\varepsilon_{x}$ (see Appendix A.4).

In the protocol, technically, an essential step is to find an (almost) optimal QEF for witnessing entropy in the experiment. We begin with taking a sequence of experimental trials as the training set and use it to determine an empirical input-output probability distribution $\nu(CZ)$. With respect to this empirical probability distribution, we perform an optimization program to obtain a single trial QEF $F(CZ)$ and estimate the amount of output randomness per trial by $r_{\nu}(F,\alpha)=\mathbb{E}_{\nu}[\log_{2}F(CZ)]/(\alpha-1)$, without considering the smoothing parameter and protocol success probability. For a robust experimental system whose behavior is near the empirical knowledge, the average output randomness witnessed by the QEF shall be close to $r_{\nu}(F,\alpha)$. All three QRNGs for the input settings are accounted for the input randomness, and the average entropy consumption per trial in randomness expansion is given by

[TABLE]

where $h(q)=-q\log_{2}q-(1-q)\log_{2}(1-q)$ is the binary entropy, and the coefficient $2$ is the amount of randomness consumed by Alice and Bob in a checking trial. We would expect a successful randomness expansion if $r_{\nu}(F,\alpha)$ exceeds $r_{\text{in}}$.

Before the experiment, we fix the target least amount of near-uniform random bits to be expanded $k_{\text{exp}}$, the smoothing parameter $\varepsilon_{h}$ involved in randomness expansion, the security parameter $\varepsilon_{x}$ in randomness extraction, the success threshold $h_{s}$, the largest allowed number of experimental trials $N$, and a lower bound on the success probability of the protocol $\kappa$ (see Appendix B). In the subsequent experiment, in each trial the single trial QEF takes a value $F(c_{j}z_{j})$ with a realization $(c_{j}z_{j})$, we keep updating a register $G_{n}$ by multiplying its value with the latest single-trial QEF value, where $n$ denotes the trial number. Before the experiment, the register $G_{n}$ is initialized to be $G_{0}=1$. We can stop the experiment in advance if the chained QEF value already exceeds the threshold before reaching the $N$th trial.

We realize randomness expansion on our upgraded photonic-entanglement distribution platform Liu et al. (2018b, a); Li et al. (2018). A sketch of the experimental setup can be found in Appendix C. In the experimental preparation, we enforce the nonsignaling condition by establishing spacelike separation between the measurement events of Alice and Bob, such that the output $A_{i}\,(B_{i})$ is independent of $Y_{i}\,(X_{i})$. We achieve a single-photon detection efficiency from creation to detection of $80.50\%$ for Alice and $82.20\%$ for Bob (see Appendix C.2), and measure the average CHSH game value $J=0.75088$, which surpasses the classical bound of $J\leq 0.75$ substantially over our previous results Liu et al. (2018b, a); Li et al. (2018). Under this experimental condition, we determine a ratio of $1-q:q=8375:1\,(q=0.000119)$ for a good randomness expansion result which corresponds to consuming the input entropy at a rate of $r_{\text{in}}=0.00197$ (see Appendix C.1). We operate our experiment with a 4 MHz repetition rate.

For this experimental demonstration, we set $k_{\text{exp}}=512$ bits with a total soundness error of $\varepsilon_{S}=2\varepsilon_{h}+\varepsilon_{x}\approx 2\times 2^{-32}$ (with $\varepsilon_{x}=2^{-100}$). We conservatively set the bound on the protocol success probability $\kappa=\varepsilon_{h}$ in estimating the output randomness. We take three hours training data (by consuming an amount of randomness $k_{0}\approx 8.50\times 10^{7}$ bits in $4.32\times 10^{10}$ trials), with which we determine a single trial QEF with power $\alpha=1+1.172\times 10^{-6}$ and an expected output randomness rate $r_{\nu}(F,\alpha)=0.00289$ surpassing the input entropy rate by $0.00092$. To determine the largest allowable number of trials, we use the protocol success probability with honest devices $\gamma$, which relates to the completeness of the protocol (see Appendix A.5 for security definition). With $\gamma=99.3\%$, we determine the largest allowable number of trials to be $N=2.35\times 10^{11}$ (open square in Fig. 2), which takes approximately 16 experimental hours, and set the threshold as $h_{s}=6.31\times 10^{8}$ bits (see Appendix D.1). If $G_{n}$ surpasses $h_{s}$ in no more than $N$ trials, we shall expand our store of randomness by at least $512$ near-uniform random bits in the end.

Our result of the randomness expansion experiment (corresponding to Step 2 in Box 1) is shown in Fig. 2. We update $G_{n}$ with the observed QEF values for every latest accumulated 1-min of experimental data. To show the result of quantum expansion more directly, in Fig. 2 we plot the quantity, $R_{n}=[\log_{2}G_{n}-\log_{2}(2/\varepsilon_{h}^{2})+\alpha\log_{2}\kappa]/(\alpha-1)$, as shown by the blue dotted line. In view of Eq. (1) and the remark behind it, the quantity $R_{n}$ can be seen as the amount of $\varepsilon_{h}$-smooth min-entropy accumulated in the output after $n$ trials (if the protocol will succeed). Output randomness emerges after $2.6\times 10^{10}$ trials and gradually surpasses the amount of entropy consumed $k_{0}+nr_{\text{in}}$ (black solid line). It surpasses the threshold (open circle) after $N_{\text{act}}=1.89\times 10^{11}$ trials (about 13.1 h). At this point we can stop the experiment in advance and set the QEF values for the remained trials to be 1. Therefore, we actually generate $5.47\times 10^{8}$ bits of randomness and consume $k_{0}+N_{\text{act}}r_{\text{in}}=4.39\times 10^{8}$ bits of entropy. Afterward, we use the Toeplitz hashing matrix, a quantum-proof strong extractor Ma et al. (2013), to extract near-uniform random bits with security parameter $\varepsilon_{x}=2^{-100}$. In the end, we expand our store of randomness by $1.08\times 10^{8}$ near-uniform random bits, which is far more than the requirement of the expansion task.

Our experimental realization of DIQRE is a substantial progress toward the ultimate understanding of randomness. In particular, this may further inspire the research of other interesting directions of randomness, for example, randomness amplification Colbeck and Renner (2012), which, instead of requiring input randomness to be independent of the devices, could amplify the imperfect random bits into perfect ones. Besides, DIQRE might be related with quantum side information proof strong multisource extractors Kasher and Kempe (2010). For these tasks, possible candidates for input randomness source could be cosmic randomness Bell and Bell (2004) and human randomness Abellán et al. (2018). DIQRE, which expands a very small random seed to rather long sequence of random bits without compromising the security, possesses a great potential for realistic applications demanding high level secure randomness.

The authors would like to thank X. Yuan and R. Colbeck for enlightening discussions, and E. Knill for pointing out a mistake in an earlier version. This work has been supported by the National Key R&D Program of China (2017YFA0304000, 2017YFA0303900 and 2017YFA0304004), the National Fundamental Research Program (under Grant No. 2013CB336800), the National Natural Science Foundation of China, Chinese Academy of Science, Guangdong Provincial Key Laboratory Grant No. 2019B121203002, Guangdong Innovative and Entrepreneurial Research Team Program Grant No. 2019ZT08X324, the Key-Area Research and Development Program of Guangdong Province Grant No. 2020B0303010001, Shanghai Municipal Science and Technology Major Project (Grant No. 2019SHZDZX01), and the Zhongguancun Haihua Institute for Frontier Information Technology.

M.-H. L and X. Z. contributed equally to this work.

Note added.—After finishing this work, we became aware of a similar DIQRE experiment work Shalm et al. (2019). This work is based on the probability estimation method Zhang et al. (2018), which is closely related with the QPE method used in this work, but can only certify randomness in the presence of classical side information. Besides, there is a DIQRE experiment against quantum side information which is based on the entropy accumulation theorem (EAT) Liu et al. (2019). We present a discussion on the comparison of QPE and EAT methods and list the related experimental results in Appendix F.

Appendix A Theory of Device-Independent Quantum Randomness Expansion

In our randomness expansion experiment, we adopt the Clauser-Horne-Shimony-Holt-type (CHSH) Bell test in a spot-checking protocol. The configuration involves three stations, commonly referred to as Alice, Bob and Charlie. In each trial, Charlie, whom Alice and Bob trust, draws a random bit $T\in\{0,1\}$ according to a Bernoulli distribution $(1-q,q)$. He then broadcasts the value of $T$ to Alice and Bob. If $T=0$, Alice and Bob both set their measurement inputs $X,Y$ as [math]. If $T=1$, Alice and Bob perform a standard CHSH-type Bell test. They make independent local measurements randomly, where Alice’s setting choices form a random variable $X$ and Bob’s form $Y$, $X,Y\in\{0,1\}$. Their outcomes form another two random variables $A,B$ ranging in the set $\{0,1\}$. We use subscripts to label the trial number, and letters without subscripts represent variables in a general single trial. Alice and Bob are space-like separated to block the signaling loophole in the Bell test. When we refer to the devices as a whole for randomness expansion, we denote the input to the device as $Z=(X,Y)$ and output as $C=(A,B)$. Here we implicitly make the assumption that $T$ is kept private by Alice and Bob and not leaked to the outside during the process of randomness generation. $(C_{i},Z_{i})$ is called the result of the $i^{\text{th}}$ trial. For a sequence of trials, we use letters in bold, that is, $\bm{Z}=(Z_{1},Z_{2},\cdots)=(\bm{XY})$ and similar for other ones. Following convention, lowercase letters represent specific values the variables take in an experiment.

Ever since Colbeck first proposed the idea of quantum randomness expansion via Bell test in his PhD thesis Colbeck , much progress has been made on the security analysis of device-independent quantum random number generation (DIQRNG) Pironio et al. (2010); Fehr et al. (2013); Vazirani and Vidick (2012); Miller and Shi (2014, 2017). So far there are two major protocols promising information-theoretically secure randomness generation in the presence of quantum side information and in a non-i.i.d. condition with current technology. One is based on entropy accumulation theorem (EAT), which requires a “min-tradeoff function” Arnon-Friedman et al. (2018). A modified protocol further utilises NPA hierarchy method Brown et al. (2019). The other protocol is the quantum probability estimation (QPE) theory based on quantum estimation factor (QEF) Zhang et al. (2020b), which directly estimates the output entropy from the observed statistics. As the QPE can be relatively more efficient for a small-size randomness generation and experiments with a small Bell violation, considering the characteristics of our optical platform and task target, we employ the QEF method in our device-independent quantum randomness expansion (DIQRE) experiment.

A.1 Models in Quantum Probability Estimation Framework

In QPE framework, the essence is a characterization of the set of possible final states in the experiment, which we call the model of the experiment. In our device-independent test, the possible final state of these systems can be described by a classical-quantum mixed state $\rho_{\bm{CZT}E}=\sum_{\bm{c},\bm{z},\bm{t}}\ket{\bm{c}\bm{z}\bm{t}}\bra{\bm{c}\bm{z}\bm{t}}\otimes\rho_{E}(\bm{c}\bm{z}\bm{t})$, where $\rho_{E}$ corresponds to the quantum side information of Eve. According to our assumptions on the coordinating random number generator, Eve does not have access to $\bm{T}$. Hence we can omit the variable $\bm{T}$ in describing the set of final states, and describe the input $\bm{Z}$ by a probability distribution $\mu(\bm{Z})$. With the assumption that the choice of inputs is independent of the quantum systems, for $\mu(\bm{Z})$ belonging to a set of possible distributions $\mathcal{P}(\bm{Z})$, the set of possible final states is described by the model $\mathcal{M}(\bm{C},\bm{Z})$

[TABLE]

We denote the set of density operators acting on the space of Alice, Bob and Eve as $\mathcal{D}(\mathcal{H}_{ABE})$, and the positive operator-valued measure (POVM) measurements $\{N_{\bm{x}}^{\bm{a}}\},\{N_{\bm{y}}^{\bm{b}}\}$ act on the space of Alice and Bob, respectively, where the positive semi-definite operator $N_{\bm{x}}^{\bm{a}}$ denotes the operator corresponding to the input $\bm{x}$ and output $\bm{a}$ for Alice, and similarly for $N_{\bm{y}}^{\bm{b}}$ on Bob’s side, and $\sum_{\bm{a}\in\bm{A}}N_{\bm{x}}^{\bm{a}}=I_{A},\,\sum_{\bm{b}\in\bm{B}}N_{\bm{y}}^{\bm{b}}=I_{B}$. $\mathcal{M}(\bm{C}|\bm{Z})$ is called the input-conditioned model related with $\mathcal{M}(\bm{C},\bm{Z})$, consisting of elements $\rho_{\bm{C}E|\bm{Z}}$, where for any $\bm{z}\in\bm{Z},\,\rho_{\bm{C}E|\bm{z}}=\dfrac{1}{\mu(\bm{z})}\sum_{\bm{c}}\ket{\bm{cz}}\bra{\bm{cz}}\otimes\rho_{E}(\bm{cz})=\sum_{\bm{c}}\ket{\bm{cz}}\bra{\bm{cz}}\otimes\rho_{E}(\bm{c}|\bm{z})$, $\exists\rho_{\bm{CZ}E}=\sum_{\bm{c},\bm{z}}\ket{\bm{c}\bm{z}}\bra{\bm{c}\bm{z}}\otimes\rho_{E}(\bm{c}\bm{z})\in\mathcal{M}(\bm{C},\bm{Z}),\,\mu(\bm{Z})\in\mathcal{P}(\bm{Z})$. After the experiment, with a probability $\mathrm{Tr}[\rho_{E}(\bm{cz})]$ Alice and Bob observe the realisation $(\bm{c},\bm{z})$, and Eve’s system becomes $\rho_{E}(\bm{cz})/\mathrm{Tr}[\rho_{E}(\bm{cz})]$.

In our experiment, the trials form an ordered sequence. Now let us consider the model for $n$ trials, which we now denote as $\mathcal{M}_{\leq n}(\bm{C}_{\leq n},\bm{Z}_{\leq n})$ to explicitly show the number of trials. If the result before the $n^{\text{th}}$ trial is $(\bm{c}_{<n},\bm{z}_{<n})$, we denote the model for the $n^{\text{th}}$ trial as $\mathcal{M}_{n}(C_{n},Z_{n})_{\bm{c}_{<n}\bm{z}_{<n}}$. For a variable $\rho_{\bm{CZ}E}\in\mathcal{M}_{\leq n}(\bm{C}_{\leq n},\bm{Z}_{\leq n})$, it should satisfy that for any $\bm{c}_{<n}\in\bm{C}_{<n},\,\bm{z}_{<n}\in\bm{Z}_{<n}$,

[TABLE]

where

[TABLE]

Apart from the above constraint, we additionally have the Markov chain condition between adjacent trials, $\bm{C}_{<i}\leftrightarrow\bm{Z}_{<i}E\leftrightarrow Z_{i},\,\forall i$, guaranteed by the assumption of the independent and identically distributed (i.i.d.) input settings in our experiment. The quantum Markov chain is defined as

Definition 1**.**

(Quantum Markov Chain) For a tri-partite quantum state $\rho_{ABC}\in\mathcal{D}(\mathcal{H}_{ABC})$, it is said to obey a quantum Markov chain condition $A\leftrightarrow B\leftrightarrow C$, if for $\mathcal{H}_{B}$, there exists a decomposition $\mathcal{H}_{B}=\bigoplus_{\lambda}\mathcal{H}_{a_{\lambda}}\otimes\mathcal{H}_{c_{\lambda}}$, such that

[TABLE]

With Eq. (4) and the Markov chain condition, the model in our experiment $\mathcal{C}(\bm{C},\bm{Z})$ can be chained by the models for each single round (see Sec. VIB in Zhang et al. (2020b)),

[TABLE]

Therefore, we only need to focus on the model for a single round of the experiment. Suppose the initial state before measurements shared by Alice, Bob and Eve is $\rho_{ABE}$, and the result observed by Alice and Bob is $z=(x,y),\,c=(a,b)$. The POVM element can be expressed as $P_{cz}=Q_{a|x}\otimes Q_{b|y}$, with $Q_{a|x},Q_{b|y}\succeq 0,\,\sum_{a}Q_{a|x}=\sum_{b}Q_{b|y}=\mathbb{I},\,\forall a,b,x,y$. If the input $Z$ is drawn according to a probability distribution $\mu(Z)$, the final state is

[TABLE]

The model for a single trial of CHSH-type Bell test has been well investigated Pironio et al. (2009). Here we use the results of Theorem 6 in Zhang et al. (2020b) for subsequent analysis. For a single trial, under a fixed input probability distribution $\mu(Z)$, the model can be expressed as the convex combination of states in the form

[TABLE]

where $\tau\succeq 0,U$ is an isometry: $(\mathbb{C}^{2})^{\otimes 2}\rightarrow\mathcal{H}_{E}$. With a discussion on the dimension, it is known that $\mathcal{H}_{E}$ can be restricted to $\mathbb{C}^{4}$ Cirel’son (1980). The measurement operator $P_{C|Z;\theta}=Q_{A|X;\theta_{1}}\otimes Q_{B|Y;\theta_{2}}$. Here we introduce the parameter $\theta=(\theta_{1},\theta_{2})$ to characterize the measurement operators, where

[TABLE]

and a similar representation holds for Bob’s measurement operators. Combining Eq. (9) and (10), we obtain the model for the single round $\mathcal{M}(C,Z)$ and its corresponding input-conditioned model $\mathcal{M}(C|Z)$ under a fixed input probability distribution $\mu(Z)$.

If we take into consideration the possible bias in the input probability distribution, when the actual probability distribution $\tilde{\mu}(Z)$ can be expressed as a convex combination of several extremal probability distributions $\{\mu_{i}(Z)\}_{i}$, we can denote the set of input probability distributions as the convex span of these probability distributions, $\text{span}\{\mu_{i}(Z)\}$, and the single trial model is

[TABLE]

A.2 Quantification of Randomness with Quantum Estimation Factors

For a concrete model $\mathcal{M}(\bm{C},\bm{Z})$, we can define quantum estimation factors (QEF), which is related to $\alpha$-Rényi powers.

Definition 2**.**

(Rényi Powers) Let $\rho\succeq 0$, and the support of $\rho$ lies in $\sigma\succeq 0$, $\beta=\alpha-1>0$. The Rényi power of order $\alpha$ of $\rho$ conditional on $\sigma$ is

[TABLE]

Definition 3**.**

(Quantum Estimation Factor) The non-negative real-valued function $F(\bm{CZ})$ is a quantum estimation factor (QEF) with power $\alpha>1$ for the model $\mathcal{M}(\bm{C},\bm{Z})$, if $F(\bm{CZ})$ satisfies the following inequality with $\alpha$-Rényi power for $\forall\tau\in\mathcal{M}(\bm{C},\bm{Z})$

[TABLE]

In the following we write $\mathcal{R}_{\alpha}(\tau(\bm{cz})|\tau(\bm{z}))\equiv\mathcal{R}_{\alpha}(\bm{cz}|\bm{z})_{\tau(\bm{cz})}$ for brevity and in accordance with the main text. With QEFs, we can give a lower bound to the amount of randomness that can be extracted from the device-independent (DI) test, which is measured by the smooth conditional min-entropy Tomamichel et al. (2010).

Definition 4**.**

(Smooth Conditional Min-Entropy) Consider a quantum state $\rho\in\mathcal{D}(\mathcal{H}_{CZE})$. The $\varepsilon_{h}$-smooth min-entropy of $C$ conditioned on $Z,E$ is

[TABLE]

where $P(\rho^{\prime},\rho)$ is the purified distance between $\rho^{\prime},\rho$, and $\mathcal{S}(\cdot)$ denotes the set of sub-normalised density operators acting on the corresponding Hilbert space. The purified distance between $\rho,\tau\in\mathcal{S}(\mathcal{H})$ is defined as

[TABLE]

Theorem 1**.**

(Theorem 3 in Zhang et al. (2020b)) Prior to a randomness generation procedure with $N$ trials, suppose that $F(\bm{CZ})$ is a QEF with power $\alpha$ for the model of the experiment $\mathcal{M}(\bm{C},\bm{Z})$, and set the smoothing parameter in randomness generation $\varepsilon_{h}\in(0,1]$, the threshold $h_{s}>0$ for a successful randomness generation and a lower bound $\kappa\in(0,1]$ to the probability of a successful randomness generation. A successful randomness generation is that, after $N$ trials have been executed, an event $(\bm{c},\bm{z})$ happens such that $F(\bm{cz})\geq 2^{h_{s}(\alpha-1)}$. In this case, for any possible final state $\rho\in\mathcal{M}(\bm{C},\bm{Z})$, we have either the probability of success is less than $\kappa$, or the quantum smooth conditional min-entropy given success satisfies

[TABLE]

As we have the quantum Markov condition in our protocol, $\bm{C}_{<i}\leftrightarrow\bm{Z}_{<i}E\leftrightarrow Z_{i},\,\forall i$, we have the following result:

Theorem 2** (Theorem 5 in Zhang et al. (2020b)).**

Under the condition $\bm{C}_{<i}\leftrightarrow\bm{Z}_{<i}E\leftrightarrow Z_{i},\,\forall i$, let $G_{n}(\bm{CZ})$ be a QEF with power $\alpha$ for the model $\mathcal{M}_{\leq n}(\bm{C},\bm{Z})$ of the first $n$ trials, and $F_{n+1}(C_{n+1},Z_{n+1})_{\bm{cz}}$ be a QEF with the same power for the model $\mathcal{M}_{n+1}(C_{n+1},Z_{n+1})_{\bm{cz}}$ of the $(n+1)^{\text{th}}$ trial conditioned on the result $\bm{c},\bm{z}$ of previous experimental trials. Then $G_{n}(\bm{CZ})\cdot F_{n+1}(CZ)_{\bm{CZ}}$ is a valid QEF with power $\alpha$ for the model $\mathcal{M}_{\leq n+1}(\bm{C},\bm{Z})$ of the first $(n+1)$ trials.

Therefore, we need only consider the QEF for the model of a single round.

A.3 Optimization of Quantum Estimation Factor

In a DIQRE experiment, we need to optimize the QEF used for witnessing quantum randomness. If the experiment has a stable behaviour, we may expect the existence of some probability distribution $\nu(CZ)$ behind the result, and it is adapted to the model for a single trial, i.e. $\exists\rho_{CZE}\in\mathcal{M}(C,Z),\,\rho_{CZE}=\sum_{c,z}\ket{cz}\bra{cz}\otimes\rho_{E}(cz),\,\nu(cz)=\mathrm{Tr}[\rho_{E}(cz)],\,\forall c\in C,\,z\in Z$. Thanks to Theorem 2, we can chain single trial QEFs to derive a valid QEF for multiple trials, as long as the Markov chain condition is guaranteed between adjacent trials. As the model for each trial is included in $\mathcal{M}(C,Z)$, we can use the same QEF for all trials before the stopping criterion is met, and optimize it to maximize an expected randomness rate witnessed by QEF

[TABLE]

No efficient direct optimization of Eq. (17) has been developed, though. While a sub-optimal solution can be accepted, as long as it does not compromise security, i.e. the solution satisfies the constraint in Eq. (17). A heuristic solution is to first solve a similar optimization, however, wherein the adversary is constrained to classical side information, and scale the solution with some coefficient to derive a valid QEF. The first step of the optimization is the so-called optimization of probability estimation factor (PEF), proposed in Zhang et al. (2018). We write the PEF as $F^{\prime}(CZ)$. In this case Eve’s system is restricted to be one-dimensional. We write the corresponding model as $\mathcal{M}_{C}(C,Z)$, which becomes a set of joint probability distribution $\tau^{\prime}(CZ)$, and the optimization problem can be taken as

[TABLE]

This optimization problem is a concave maximization problem over a convex set, to which a global optimal solution can be found in principle. Directly solving this optimization problem is still difficult, though. The probability distributions come from measuring quantum states. Possible probability distributions form a convex set, yet not a polytope, hence going over the solving domain determined by the constraints is no easy task. While suboptimal solutions to this method can be derived with an appropriate extension of the solving domain into a polytope. In our experiment, we optimize the PEF over a polytope determined by 8 PR-boxes Popescu and Rohrlich (1994) and the corresponding Tsirelson’s bounds Cirel’son (1980), which include all input-conditional distributions of outputs according to quantum mechanics. In all, the modified optimization problem is defined over a polytope with 80 extreme points, and they can be constructed by PR-boxes and local deterministic points Knill et al. (2017); Bierhorst (2016). Then the optimization becomes

[TABLE]

$\tau^{\prime}_{k}(CZ)$ are the extremal points of this convex polytope model.

It needs to be noted that $\nu(CZ)$ should be adapted to the model. In our experiment, we derive this empirical probability distribution from actual experimental data. The raw conditional frequency distribution $p(C|Z)$ attained from the experiment has a weak signaling behaviour between Alice and Bob due to the statistical fluctuation. For this matter, we conduct maximum-likelihood estimation to derive a maximum likely probability distribution with respect to the raw frequency distribution and adapted to the non-signaling condition,

[TABLE]

Here we write the variables $Z=(X,Y),\,C=(A,B)$ explicitly. We fix the input distribution to be $\mu(XY)$, which is the ideal input probability distribution.

After obtaining the optimal PEF $F^{\prime}(CZ)$, we scale it by a parameter $f_{\text{max}}$ to obtain a QEF. We first normalize $F^{\prime}(CZ)$ with $f_{0}$ such that $\frac{1}{f_{0}}\sum_{cz}F^{\prime}(cz)\equiv\sum_{cz}\tilde{F}^{\prime}(cz)=1$. Then we introduce a parameter $\tilde{f}$ and solve the optimization problem

[TABLE]

The value $\tilde{F}^{\prime}(CZ)/\tilde{f}\equiv F^{\prime}(CZ)/f_{\mathrm{max}}$ delivers a valid QEF. We denote $\tilde{f}=\max_{\tau}\tilde{f}(\theta)$, where

[TABLE]

For a fixed tuple $\theta=(\theta_{1},\theta_{2})$, $\tilde{f}(\theta)$ is concave with respect to $\tau$, and we apply a Frank-Wolfe type algorithm Jaggi (2013) to obtain both lower and upper bounds on $\tilde{f}(\theta)$. Optimization over $\theta$ is cumbersome, though. We emphasize that it suffices to derive an upper bound of $f_{\mathrm{max}}$ in order to derive a valid QEF. For this, we exploit the following result:

Lemma 1** (Lemma 9 in Zhang et al. (2020b)).**

*Suppose given two points in the parameter space, $\theta=(\theta_{1},\theta_{2}),\theta^{\prime}=(\theta_{1}+\phi,\theta_{2})$ where $\phi\in(0,\pi/2]$, for a point $\theta"=(\theta_{1}+\varphi,\theta_{2})$ such that $\varphi\in[0,\phi]$, we have *

[TABLE]

A similar result holds when varying the second parameter in the tuple $\theta=(\theta_{1},\theta_{2})$.

To apply this lemma for an upper bound on $f_{\mathrm{max}}$, we first divide the parameter space of $\theta$ along the two directions and calculate the values $\tilde{f}(\theta)$ on the mesh grid. It suffices to know an upper bound on $\tilde{f}(\theta^{\prime})$ where $\theta^{\prime}=(\theta^{\prime}_{1},\theta^{\prime}_{2})$, $\theta^{\prime}_{1}\in[\theta_{1},\theta_{1}+\phi_{1}]$ and $\theta^{\prime}_{2}\in[\theta_{2},\theta_{2}+\phi_{2}]$. For this, we abbreviate the values $\tilde{f}(\theta^{\prime})$ when $\theta^{\prime}=(\theta_{1},\theta_{2})$, $(\theta_{1}+\phi_{1},\theta_{2})$, $(\theta_{1},\theta_{2}+\phi_{2})$ and $(\theta_{1}+\phi_{1},\theta_{2}+\phi_{2})$ by $\tilde{f}_{11}$, $\tilde{f}_{21}$, $\tilde{f}_{12}$ and $\tilde{f}_{22}$ respectively. According to Lemma 1, for any $\theta=(\theta_{1}+\varphi_{1},\theta_{2}),\,0\leq\varphi_{1}\leq\phi_{1}$ we have

[TABLE]

Similarly, for any $\theta=(\theta_{1}+\varphi_{1},\theta_{2}+\phi_{2}),\,0\leq\varphi_{1}\leq\phi_{1}$ we have

[TABLE]

Then by applying the lemma again along the other direction in the parameter space and in view of the above two equations, we can determine that

[TABLE]

holds for any tuple $\theta^{\prime}=(\theta^{\prime}_{1},\theta^{\prime}_{2})\in[\theta_{1},\theta_{1}+\phi_{1}]\times[\theta_{2},\theta_{2}+\phi_{2}]$. At the same time we have

[TABLE]

for any tuple $\theta^{\prime}=(\theta^{\prime}_{1},\theta^{\prime}_{2})\in[\theta_{1},\theta_{1}+\phi_{1}]\times[\theta_{2},\theta_{2}+\phi_{2}]$. Therefore, for all $\theta^{\prime}$ in the region $[\theta_{1},\theta_{1}+\phi_{1}]\times[\theta_{2},\theta_{2}+\phi_{2}]$ we can obtain both an upper and a lower bounds on $\tilde{f}(\theta^{\prime})$. As a consequence, we can obtain both an upper and a lower bound on $f_{\mathrm{max}}$ given a mesh grid. By refining the mesh grid, we can reduce the gap between the lower and upper bounds on $f_{\mathrm{max}}$.

In Eq. (21) we have fixed $\mu(Z)$. In deriving $f_{\text{max}}$ we further take into account the possible bias in $\mu(Z)$ such that $F^{\prime}(CZ)/f_{\text{max}}$ is a valid QEF for our model. In our setting, we consider that $|\tilde{q}-q|\leq\varepsilon_{b}$ in the probability distribution of $T_{i}$, where $\tilde{q}$ is the actual value in the experiment and $q$ is the ideal value. Denote $q_{u}=q+\varepsilon_{b},\,q_{l}=q-\varepsilon_{b}$, the set of probability distributions of $Z$ is the convex combination of the probability distributions $\mu_{1}(Z)=(1-3q_{u}/4,q_{u}/4,q_{u}/4,q_{u}/4),\,\mu_{2}(Z)=(1-3q_{l}/4,q_{l}/4,q_{l}/4,q_{l}/4)$ for $z\in\{00,01,10,11\}$. For the model we consider, any state belonging to it can be expressed as $\tau=\sum_{i=1}^{2}\lambda_{i}\tau_{i},\,\lambda_{i}\geq 0,\,\lambda_{1}+\lambda_{2}=1$, where $\tau_{i}\in\mathcal{M}_{i}(C,Z)=\mu_{i}(Z)\times\mathcal{M}(C|Z),\,i=1,2$. If $F(CZ)$ is a valid QEF for $\mathcal{M}_{i}(C,Z),\,i=1,2$, then it is also a valid QEF for $\mathcal{M}(C,Z)$, since for all $\tau=\sum_{i=1}^{2}\lambda_{i}\tau_{i}\in\mathcal{M}(C,Z)$, we have

[TABLE]

With this conclusion, we can calculate the regularising factor $f_{\mathrm{max}}^{i}$ for $\mathcal{M}_{i}(C,Z),\,i=1,2$ such that $F^{\prime}(CZ)/f_{\mathrm{max}}^{i}$ is a valid QEF for both models $\mathcal{M}_{i}(C,Z)$. By taking $f_{\mathrm{max}}=\max\{f_{\mathrm{max}}^{1},\,f_{\mathrm{max}}^{2}\}$ we can derive a valid QEF for $\mathcal{M}(C,Z)$, that is, $F(CZ)=F^{\prime}(CZ)/f_{\mathrm{max}}$.

A.4 Randomness extraction

We use Toeplitz extractor in the experiment, which takes the experimental output as input and delivers a sequence of near uniform random bits Impagliazzo et al. (1989); Frauchiger et al. (2013); Ma et al. (2013); Liu et al. (2018a). The Toeplitz extractor is a quantum-proof strong extractor, defined as follows:

Definition 5** (Quantum-Proof Strong Extractor Nisan and Zuckerman (1996); Konig and Renner (2011); De et al. (2012); Ma et al. (2013)).**

A function $\text{Ext: }\{0,1\}^{n}\times\{0,1\}^{d}\rightarrow\{0,1\}^{m}$ is a quantum-proof $(k,\varepsilon_{x})$-strong extractor with a uniform seed, if for all classical-quantum states $\rho_{XE}$ classical on $X$ with $H_{\text{min}}(X|E)_{\rho}\geq k$ and a uniform seed $Y$, we have

[TABLE]

where $\|\cdot\|_{1}$ is the trace norm, $\rho_{U_{m}}=\frac{I}{2^{m}}$ is the fully mixed state of dimension $2^{m}$ and $\rho_{Y}$ is the fully mixed state of the seed $Y$.

The definition states that, given a quantum-proof $(k,\varepsilon_{x})$-strong extractor with a uniform seed, $m$ bits of uniformly distributed random bits can be provided (except for a failure probability no larger than $\varepsilon_{x}$) if there is a guarantee of $k$ bits of min-entropy in the input $X$. For brevity, we call $\varepsilon_{x}$ the security parameter of the extractor. This definition naturally guarantees a composability property, shown by the following lemma:

Lemma 2** (De et al. (2012); Renner (2008)).**

If $\text{Ext: }\{0,1\}^{n}\times\{0,1\}^{d}\rightarrow\{0,1\}^{m}$ is a quantum-proof $(k,\varepsilon_{x})$-strong extractor, then for any classical-quantum state $\rho_{XE}$ such that $H_{\text{min}}^{\varepsilon_{h}}(X|E)_{\rho}\geq k$, we have

[TABLE]

From this property, we can reuse the extraction seed albeit a linear increase in the security parameter.

An $m\times n$ Toeplitz matrix takes the from,

[TABLE]

For the Toeplitz matrix, we have the following lemma that guarantees its use as a quantum-proof strong extractor:

Lemma 3** (Renner (2008)).**

The set of all Toeplitz matrices can be used as a quantum-proof strong $(k,\varepsilon_{x})$ extractor with $\varepsilon_{x}=2^{-(k-m)/2}$, where $m$ is the output length.

The experimental output is written in the form of an $n-$dimensional vector,

[TABLE]

The output of the Toeplitz extractor is a sequence of nearly uniform random bits $U_{m}$, with $R_{m}=T_{m\times n}\times V_{n}$, which is given as,

[TABLE]

A.5 Protocol Security

In this subsection, we shall discuss the security of the protocol under the framework of quantum probability estimation. In this work we use a composable security definition Canetti (2000); Ben-Or and Mayers (2004); Portmann and Renner (2014):

Definition 6** (Protocol soundness and completeness).**

*A random number generation protocol with an $m$-bit output $\bm{C}$ is called $(\varepsilon_{S},\varepsilon_{C})$-secure if it is

(1) $\varepsilon_{S}$-Sound: The output satisfies*

[TABLE]

*where $\Phi$ represents the event that the protocol does not abort, $\rho_{\bm{C}E|\Phi}$ is the normalised final state conditioned on a success, with $\rho_{\bm{C}}$ giving the output $\bm{C}$, and $\rho_{E}$ the system of side information, and $\tau_{m}$ is a maximally mixed state of $m$ qubits. The probability that the protocol does not abort is $p_{\Phi}$.

(2) $\varepsilon_{C}$-Complete: There exists an honest implementation where the protocol observes an identical and independent behaviour, and the probability that it does not abort satisfies $p_{\Phi}\geq 1-\varepsilon_{C}$.*

In our experiment, we apply the following protocol for random number generation Zhang et al. (2020b):

Box 1. Input-Conditional Random Number Generation

**Input: **

$k_{\text{gen}}$: the number of random bits to be generated.

$\varepsilon_{S}$: the soundness error.

**Given:

**An experiment of $N$ trials, with input $\bm{Z}$ and output $\bm{C}$ of length $2N$.

A valid QEF $F(\bm{CZ})$ with power $\alpha$ for the model of the experiment $\mathcal{M}(\bm{C},\bm{Z})$.

A quantum-proof $(k,\varepsilon_{x})$-strong extractor $\text{Ext: }\{0,1\}^{2N}\times\{0,1\}^{d}\rightarrow\{0,1\}^{k_{\text{gen}}}$.

**Output:

**A bit string of length $k_{\text{gen}}$.

Procedures:

Assign the smoothing parameter in randomness generation $\varepsilon_{h}$, the security parameter of the extractor $\varepsilon_{x}$ such that $\varepsilon_{S}=2\varepsilon_{h}+\varepsilon_{x}$.

Assign the success threshold of the experiment $h_{s}$.

Obtain a realisation $s$ of the uniform seed $S$ of length $d$.

Perform the randomness generation experiment and obtain a realisation $\bm{c},\bm{z}$ of $\bm{C},\bm{Z}$ and the QEF value $F(\bm{cz})$.

If $F(\bm{cz})\geq 2^{h_{s}}(\alpha-1)$, the protocol succeeds and return $U_{k_{\text{gen}}}=\text{Ext}(\bm{c},s)$; otherwise, the protocol fails and return $U_{k_{\text{gen}}}=0^{\frown k_{\text{gen}}}$.

Under the QPE framework, the soundness and completeness for the protocol has been proved (see Sec. IIIC of Zhang et al. (2020b)). We mention that in this work, the total soundness error in the soundness proof in Zhang et al. (2020b) shall be modified to $\varepsilon_{S}=\varepsilon_{x}+2\varepsilon_{h}$ as given in Eq. (30), since the soundness definition used in this work is slightly different from that in Zhang et al. (2020b).

Appendix B Parameter Determination

Before the execution of randomness expansion, we need to determine a probability distribution of inputs that supports the task, set the largest allowed number of experimental trials, the soundness error and the failure probability of the protocol, and find a valid QEF that yields a good randomness expansion rate. In our experiment, we determine these parameters with the following procedure:

Box 2. Procedure for parameter determination:

1. Determine an input probability distribution $\mu(Z)$ that supports randomness expansion.

2. Set the input probability distribution as $\mu(Z)$. Conduct a series of “training trials” consuming $k_{0}$ bits of entropy and determine an empirical input-output probability distribution $\nu(CZ)$ for randomness expansion.

3. Determine a QEF $F(CZ)$ with power $\alpha$ that yields a large $r_{\nu}(F,\alpha)$.

4. Set the randomness expansion target $k_{\text{exp}}$, the largest allowed number of trials $N$, the soundness error in randomness expansion $\varepsilon_{h}$, the soundness error in randomness extraction $\varepsilon_{x}$, the completeness error of the protocol $\varepsilon_{C}$, and a lower bound on the success probability $\kappa$ of the protocol.

5. Set the success threshold in the randomness expansion experiment $h_{s}$.

In Step 1, based on our experimental parameters, we simulate an input-conditional probability distribution $\bar{\nu}(C|Z)$ using the Eberhard model Eberhard (1993), and construct the model for the joint probability distribution $\bar{\nu}(CZ)$ of the input and output by multiplying different input distributions $\mu(Z)$ under the spot-checking protocol. We consider a simulated input setting to be feasible for randomness expansion if $r_{\bar{\nu}}(F,\alpha)>r_{\text{in}}$ for some QEF $F(CZ)$ with power $\alpha$. In this step no randomness shall be consumed. We take the assumption that the simulated input-output probability distributions do not deviate from the actual experimental behaviour too much.

To determine the input probability distribution and QEF for an efficient randomness expansion, for the best we should minimize the expected number of trials for randomness expansion. Nonetheless, a suboptimal solution can be accepted. In our determination, under a given simulated probability distribution $\bar{\nu}(CZ)$, we vary the value $\alpha$, and for each fixed value of $\alpha$, in principle we can optimize the QEF that yields a largest expected randomness rate witnessed by QEF [Eq. (17)]. As stated, however, the optimization is difficult to tackle. In practice, we make use of the PEF, and consider the optimization in Eq. (19). For the same input-output probability distribution $\bar{\nu}(CZ)$, the expected output randomness rate witnessed by the PEF $F^{\prime}(CZ)$ is $r_{\bar{\nu}}(F^{\prime},\alpha)=\mathbb{E}_{\bar{\nu}}\log_{2}(F^{\prime}(CZ))/(\alpha-1)$. We assume $r_{\bar{\nu}}(F^{\prime},\alpha)$ is close to $r_{\bar{\nu}}(F,\alpha)$, and we will show that it is reasonable in our experiment. In our experiment, we determine the input probability distribution in reference to the value of $r_{\bar{\nu}}(F^{\prime},\alpha)$.

With the input probability distribution fixed, following the route suggested in Zhang et al. (2020a), we carry out a series of training trials under this input setting and obtain an empirical probability distribution $\nu(CZ)$ adapted to the model $\mathcal{M}(C,Z)$ we use. Still, we first search for a PEF $F^{\prime}(CZ)$ with power $\alpha$ that might support the randomness expansion efficiently. Then we scale the PEF $F^{\prime}(CZ)$ with a parameter $f_{\text{max}}$, such that $F^{\prime}(CZ)/f_{\text{max}}$ becomes a valid QEF for the model against quantum side information with the same power, following the approach given in Sec. A.3.

Afterwards, we determine the largest allowed number of experimental trials $N$ with the aid of an honest protocol that observes an i.i.d.behaviour. We note that the assumption is only used in parameter determination. In the actual randomness expansion experiment we do not make any assumption about the input-output distribution. In the honest protocol with the input-output probability distribution of $\nu(CZ)$, we set the smoothing parameter in randomness generation to be $\varepsilon_{h}$, and the preset success probability of the protocol to be $\gamma$. Here $\gamma=1-\varepsilon_{C}$, where $\varepsilon_{C}$ is the completeness error of the protocol. By the central limit theorem, the distribution of the variable $N\log_{2}(F(CZ))/(\alpha-1)$ can be well approximated by a normal distribution, with the mean $Nr_{\nu}(F,\alpha)$ and the variance $N\sigma_{\nu}^{2}$, where $\sigma_{\nu}$ is the standard deviation of the random variable $\log_{2}(F(CZ))/(\alpha-1)$ with respect to the input-output distribution $\nu(CZ)$, determined by

[TABLE]

The success probability of the honest protocol is given by

[TABLE]

where $Q$ is the tail distribution function, and $\bar{h}_{s}$ is the success threshold for an honest protocol. Here we use a barred notation to distinguish the protocol success probability from the one for the adversarial condition $\kappa$ that is used in the actual experiment. According to Eq. (16), with an honest protocol, to generate at least $k$ bits of randomness in $N$ trials in the randomness expansion experiment (before the randomness extraction), the success threshold is determined by

[TABLE]

For the expansion task to expand at least $k_{\text{exp}}$ bits of near-uniform random bits at the end of the protocol, $k$ is determined by

[TABLE]

$Nr_{\text{in}}$ the largest amount of randomness that might be consumed in input setting, and the term $-2\log_{2}\varepsilon_{x}$ is required by the randomness extraction procedure. After the randomness extraction there are $k_{\text{gen}}$ near-uniform random bits generated (without the deduction of the entropy cost, which is $k_{0}+Nr_{\text{in}}$ in total). After setting the completeness error $\varepsilon_{C}$ and the determination of the protocol success probability for an honest protocol $\gamma$, the soundness error in randomness expansion $\varepsilon_{h}$, we determine the largest allowed number of trials in randomness expansion $N$ by solving Eq. (36)(37) and (38) jointly.

To determine the success threshold $h_{s}$ for the actual randomness expansion experiment, we need to set the lower bound to the actual protocol success probability $\kappa$. We emphasize that now we do not assume the experimental behaviour to be honest. Literature suggests taking $\kappa=\varepsilon_{h}$ to obtain a conservative lower bound on the $\varepsilon_{h}$-smooth min-entropy Zhang et al. (2020b). Then the success threshold is determined by

[TABLE]

Appendix C System characterization

In Fig. 3 we present a schematic illustration of our experimental set-up. The set-up is similar to the one in our previous experimental work of DIQRNG in Liu et al. (2018a), and the technical details can be found therein. In this section we discuss the determination of the essential experimental parameters of this work.

C.1 Assignment of input probability distribution

In this subsection we present the results in determining the input-output probability distribution. Following the route in Sec. B, we simulate a set of input-output distributions $\bar{\nu}(CZ)=\mu(Z)\bar{\nu}(C|Z)$ with different input probability distributions $\mu(Z)$, and $\bar{\nu}(C|Z)$ is an input-conditioned probability distribution simulated based on our previous experimental data. In the simulation of a set of input-conditioned probability distribution with the Eberhard model, the key experimental parameters for the simulation include the efficiencies in different processes of the experiment, the choices of measurement bases and the entangled state, the state fidelity, the mean photon number of the entangled photon source, the visibility, etc. For the detailed simulation procedure, one may refer to the Supplementary Material of Li et al. (2018). As shown by Fig. 4, we optimize the PEF to maximize $r_{\bar{\nu}}(F^{\prime},\alpha)$, with various values of $(1-q)/q$, which is the ratio of the number of spot trials to the number of checking trials, and the order $\alpha$ in the QEF. If $r_{\bar{\nu}}(F^{\prime},\alpha)>r_{\text{in}}$ we consider the input probability distribution to be feasible for randomness expansion. We try to find an input probability distribution to minimize the number of trials for randomness expansion to our best. From PEF results, we find that with the power $\alpha$ around the level of $1+1\times 10^{-6}$, an efficient randomness expansion is possible. Afterwards we perform a fine-grained optimization with $\alpha$ varying around this value, and determine $\alpha=1+1.172\times 10^{-6}$. From the PEF optimization results, we determine the ratio of the number of spot trials to the number of checking trials to be $(1-q)/q=8375(q=0.000119)$, corresponding to an input entropy rate of $r_{\text{in}}=0.00197$. A detailed description of experimentally realising a biased QRNG can be referred to our previous work Liu et al. (2018a).

C.2 Determination of single photon efficiency

We determine the single photon heralding efficiency as $\eta_{A}=C/N_{B}$ and $\eta_{B}=C/N_{A}$ for Alice and Bob, in which two-photon coincidence events $C$ and single photon detection events for Alice $N_{A}$ and Bob $N_{B}$ are measured in the experiment, which are listed in Tab. 1.

In this table, $\eta^{sc}$ is the efficiency to couple entangled photons into single mode optical fibre, $\eta^{so}$ is the efficiency for photons passing through the optical elements in the source, $\eta^{fibre}$ is the transmittance of fibre connecting source to measurement station, $\eta^{m}$ is the efficiency for light passing through the measurement station, and $\eta^{det}$ is the single photon detector efficiency. $\eta^{so}$, $\eta^{fibre}$, $\eta^{m}$, $\eta^{det}$ can be measured with classical light beams and NIST-traceable power meters.

C.3 Quantum state and measurement bases

To maximally violate the Bell inequality in experiment, we create non-maximally entangled two-photon state Eberhard (1993) $\cos(24.56^{\circ})\ket{HV}+\sin(24.56^{\circ})\ket{VH}$ and set measurement bases to be $A_{1}=-83.02^{\circ}$ and $A_{2}=-118.58^{\circ}$ for Alice, and $B_{1}=6.98^{\circ}$ and $B_{2}=-28.58^{\circ}$ for Bob, respectively.

We measure diagonal/anti-diagonal visibility in the bases set ($45^{\circ},-24.56^{\circ}$), ($114.56^{\circ},45^{\circ}$) for minimum coincidence, and in the bases set ($45^{\circ},65.44^{\circ}$), ($24.56^{\circ},45^{\circ}$) for maximum coincidence, where the angles represent measurement basis $\cos(\theta)\ket{H}+\sin(\theta)\ket{V}$ for Alice and Bob. By setting the mean photon number to $\mu=0.0025$ to suppress the multi-photon effect, we measure the visibility to be $99.5\%$ and $98.4\%$ in horizontal/vertical basis and diagonal/anti-diagonal basis.

We perform quantum state tomography measurement of the non-maximally entangled state, with result shown in Fig. 5. The state fidelity is $99.16\%$. We attribute the imperfection to multi-photon components, imperfect optical elements, and imperfect spatial/spectral mode matching.

C.4 Spacetime configuration of the experiment

To close the locality loophole, space-like separation must be satisfied between relevant events at Alice and Bob’s measurement stations: the state measurement events by Alice and Bob, measurement event at one station and the setting choice event at the other station (Fig. 6). We then obtain

[TABLE]

where $|SA|$ = 93 m ($|SB|$ = 90 m) is the free space distance between entanglement source and Alice’s (Bob’s) measurement station, $T_{E}$ = 10 ns is the generation time for entangled photon pairs, which is mainly contributed by the 10 ns pump pulse duration, $L_{SA}$ = 191 m ($L_{SB}$ = 173.5 m) is the effective optical path which is mainly contributed by the long fibre (130 m, 118 m) between source and Alice/Bob’s measurement station, $T_{QRNG1}=T_{QRNG2}$ = 96 ns is the time elapse for unbiased QRNG to generate a random bit, $T_{Delay1}$ = 270 ns ($T_{Delay2}$ = 230 ns) is the delay between unbiased QRNG and Pockels cells, $T_{PC1}$ = 112 ns ($T_{PC2}$ = 100 ns) including the internal delay of the Pockcels Cells (62 ns, 50 ns) and the time for Pockcels cell to stabilize before performing single photon polarization state projection after switching which is 50 ns, which implies that the experimental time is able to be shortened by increasing the repetition rate of the experiment because the small $q$ reduces the impact of the modulation rate of the Pockels cells, $T_{M1}$ = 55 ns ($T_{M2}$ = 100 ns) is the time elapse for SNSPD to output an electronic signal, including the delay due to fibre and cable length.

Measurement independence requirement is satisfied by space-like separation between entangled-pair creation event and setting choice events, so we can have

[TABLE]

As shown in Fig. 6, Alice’s and Bob’s random bit generation events for input setting choices are outside the future light cone (green shade) of entanglement creation event at the source.

Appendix D Experimental Results

D.1 Randomness expansion task: 512 bits

Our DIQRE task is set to outperform the input by at least 512 near-uniform random bits at the end of the protocol. We set the soundness errors $\varepsilon_{h}=2^{-32},\,\varepsilon_{x}=2^{-100}$, the success probability for an honest protocol $\gamma=99.3\%$ (equivalent to the one-sided $2.5\sigma$ criterion and corresponding to the completeness error $\varepsilon_{C}=0.7\%$), and the lower bound to the success probability in the actual experiment to be the same as the soundness error in randomness expansion, $\kappa=\varepsilon_{h}=2^{-32}$. We carry out three hours of training trials under the input setting determined in Sec. C.1, which corresponds to a consumption of $k_{0}\approx 8.50\times 10^{7}$ bits of entropy, and obtain an empirical probability distribution $\nu(CZ)$ (see Table 2 and 3). With respect to $\nu(CZ)$, we optimize the QEF value according to the methods in Sec. A. We first optimize a PEF under the no-signaling condition and Tsirelson’s bounds. The power $\alpha$ of the optimized PEF is $\alpha=1+1.172\times 10^{-6}$, and the values of the PEF are given in Table 4. We derive the value of the PEF using the C++ programming language and the package float128, attaining a precision to $35$ decimal places. After obtaining the PEF, we normalize it and solve the optimization of $f_{\mathrm{max}}$ in Eq. (21). Such an optimization problem is tackled via the parallel computation toolbox in Matlab. The overall QEF rescaling factor is the multiplication of the sum of the 16 PEF values and $f_{\mathrm{max}}$. We derived an upper bound of $1+1.12\times 10^{-9}$ to the overall rescaling factor. The QEF value can be obtained by dividing the PEF with this factor. The expected output entropy rate witnessed by the QEF is $r_{\nu}(F,\alpha)=0.00289$. For the optimization of $f_{\mathrm{max}}$, we used 24 workers for parallel computation, taking $30963.214420$ seconds. With these parameters, we determine the largest allowed number of trials in randomness expansion to be $N=2.35\times 10^{11}$, and the success threshold in the experiment to be $h_{s}=6.31\times 10^{8}$ bits.

D.2 System Robustness

During the experiment execution, we monitor the behaviour of the set-up via the real-time CHSH violation value. Fig. 7 shows the measured CHSH violation value versus time. Every 180 seconds, we estimate the CHSH violation real-time with the accumulated data. The data consists of the 3-hour training and the 13.1-hour main experiment. Since the time span is short, and the CHSH violation value is relatively stable, we continuously carry out the experiment without any break.

D.3 Random Number Generation Result

In our randomness extraction, we conservatively set $\varepsilon_{x}=2^{-100}$. In the randomness extraction procedure, we apply a Toeplitz matrix of the size $m\times n=k_{\text{gen}}\times 2N=(5.47\times 10^{8})\times(2\times 2.35\times 10^{11})$. The experiment succeeds in prior to the largest allowed number of trials $N$, which stops at the $N_{\text{act}}^{\text{th}}$ trial, and the raw data is of the length $2N_{\text{act}}=2\times 1.89\times 10^{11}$. While to keep in accordance with the protocol requirement, the Toeplitz matrix is applied to the concatenation of the raw data of measurement outcomes of length $2\times 1.89\times 10^{11}$ and a sequence of zeros, of which the total length is $n=2\times 2.35\times 10^{11}$. $m=5.47\times 10^{8}$ bits of near-uniform random bits have been extracted.

We use the fast Fourier transform (FFT) to speed up the multiplication,

[TABLE]

Here FFT is the fast Fourier transform on the vector, $T_{m+n-1}$ is the elements $(a_{-(n-1)},...,a_{-1},a_{0},a_{1},...,a_{m-1})$ in the Toeplitz matrix. IFFT is the inverse fast Fourier transform of the product of the vectors. The vector dimension should be expand to $m+n-1$ by adding zeros at the end.

To save memory use in randomness extraction, for some $l\leq m,\,l\in\mathbb{N}^{+}$, we divide the matrix into $\lceil n/l\rceil$ blocks each with dimension $m\times l$,

[TABLE]

with block $T_{m\times l}^{i}$ given by

[TABLE]

Similarly, we divide the vector into $\lceil n/l\rceil$ blocks,

[TABLE]

with each block given by

[TABLE]

We then apply FFT to each block. The results are given by

[TABLE]

where $U_{l}^{i}=T^{i}_{m\times l}\cdot V^{i}_{l}$, which is given by

[TABLE]

The final result is given by

[TABLE]

The blocked algorithm is slower than the full FFT algorithm, but it saves memory. We perform the extraction calculation on a personal computer with 32 Gbytes memory by dividing the original data into 1200 blocks (corresponding to $l=3.92\times 10^{8}$), which takes about 85 hrs including data loading and computation.

D.4 Statistical analysis of output randomness

To check the statistical properties of our output, we run it through the NIST test suite NIS . To do so, we set the section length to 1 Mbits for our $5.47\times 10^{8}$ random output bits. As shown in Tab. 5, the random bits successfully pass the tests.

Appendix E Discussion on Security Assumptions

E.1 Security Assumptions in This Work

Since there is no unconditional randomness in nature, a certain set of assumptions or requirements is always needed for randomness generation. In Fig. 1 of the main text and the caption below it we list all the assumptions in this work. We review the assumptions here:

Secure lab: The information exchange with an outside entity is controlled. The devices cannot communicate to the outside to leak the experimental results directly. 2. 2.

Non-signaling condition: In each trial, the measurement process of Alice/Bob is independent of the other party. 3. 3.

Trusted coordinator: A well characterised biased random number generator (depicted by “Biased QRNG” in the figure) determines a trial to be “spot” or “checking”. The setting is private to the measurement devices and the entanglement source. 4. 4.

Trusted inputs: Alice and Bob each has a private random number generator (depicted by “Unbiased QRNG” in the figure) to feed perfect random bits to the measurement device in the “checking trials”. 5. 5.

Trusted post-processors: The classical post-processing procedure is trusted. 6. 6.

Quantum mechanism: Quantum mechanics is correct and complete.

Most of the assumptions are necessarily required in almost all device-independent quantum information processing tasks, such as DIQRNG Pironio et al. (2010); Bierhorst et al. (2018); Liu et al. (2018a). The first assumption prevents the devices from leaking the outputs of the experiment directly to an adversary, which trivially compromises security. The second and fourth assumptions are needed so that the violation of a Bell inequality is valid and cannot be faked with classical means. In our work, we arrange the related measurement events of Alice and Bob to be space-like separated (see Sec. C.4), which meets the requirement of the second assumption under the theoretical framework of relativity. The fifth assumption is needed for correct classical data processing.

One special requirement for our DIQRE experiment is the spot-checking arrangement. We assume a trusted initial random seed to determine whether a trial is spot or checking, and the untrusted devices cannot tell whether a trial is spot or checking before the measurement is finished. The trust on this random seed is necessary to avoid the attack where an adversary behaves differently in the checking trials and the spot trials. Technically, this assumption does not pose additional requirements. To see this, first, for any information processing tasks based on the loophole-free violation of Bell tests, Assumption 4 is required, which unavoidably requires trust on some initial randomness. Apart from DIQRNG, there are other types of QRNGs, such as the source-independent QRNGs Ma et al. (2016), which require trusted random seed for input setting. Besides, even QRNGs with trusted devices require initial random seed, since the randomness extraction procedure cannot be done without initial random seed. The requirement of trusted initial random seed for randomness extraction is embedded in Assumption 5. To realise the spot-checking protocol, the random seed for determining a trial to be spot or checking can be shared between the two valid users of DIQRE, Alice and Bob, before the experiment. They keep the seed private until it is used for the input setting. In this sense, trust on this random seed is not stronger than the Assumption 1 required for the secure store of generated randomness.

E.2 Simulation of Randomness Expansion with Independent Local Biased Random Number Generators

In our spot-checking protocol, we rely on a trusted random number generator represented by the random variable $\bm{T}=(T_{1},\cdots,T_{n})$, to which an adversary is inaccessible (Assumption 3). This is a common assumption in spot-checking type of device-independent tests, see Refs. Miller and Shi (2014); Arnon-Friedman et al. (2018); Zhang et al. (2020b) for example. However, we can possibly remove it under the QPE framework and even avoid using a spot-checking protocol for DIQRE. Alice and Bob can each employ a biased random number generator to determine their input settings locally, where now the single trial experiment model is $\mathcal{M}(C,Z)=\mu_{A}(X)\times\mu_{B}(Y)\times\mathcal{M}(C|XY)$ with $\mu_{A}(X),\,\mu_{B}(Y)$ being independent Bernoulli distributions $(1-q_{A},q_{A}),\,(1-q_{B},q_{B})$ with $q_{A},q_{B}\in(0,1)$. Assuming the PEFs under this condition close to QEFs, with the power for PEFs set to $\alpha=1+1.66\times 10^{-9}$ we perform an optimization over PEFs to derive a simulated randomness expansion result as shown by Fig. 8, where we use the same input-conditional probability distribution above for simulation. Here we let $q=q_{1}=q_{2}$ and define $b_{l}=(1-q)/q$ as the bias parameter in this setting. We see that it is theoretically possible to realise expansion when $b_{l}$ is large enough. With current experimental conditions, however, it is difficult to realise randomness expansion in this way, as one may notice that the counting rate for the input setting $(1,1)$ is too low due to the highly biased local input settings, and a relatively small power in the Rényi power makes the implementation time far too long. Nevertheless, this provides us with a new insight on how to remove additional assumptions in a device-independent task.

Appendix F Comparison with Other Protocols

F.1 Comparison between Quantum Probability Estimation and Entropy Accumulation Theorem

Apart from the QPE-based method, for the tasks of DIQRNG and DIQRE, there exist different theoretical approaches for analysis, for example, the results in Vazirani and Vidick (2012); Miller and Shi (2014); Arnon-Friedman et al. (2018). Among these methods, the entropy accumulation theorem (EAT) Arnon-Friedman et al. (2018) is the first theoretical method achieving an asymptotically optimal result for the certification of DIQRNG in the limit of infinite data size, and it has been applied to the first loophole-free DIQRNG experiment against quantum side information Liu et al. (2018a) and a recent experimental work on DIQRE Liu et al. (2019). Here we present a brief discussion on the pros and cons of QPE and EAT methods, and list the existing experimental works using the two methods.

(a) QPE method Zhang et al. (2020b): This method is designed to witness randomness in an efficient manner, especially for applications requiring a low latency for randomness generation. A specific randomness generation target is set in advance. Apart from this work, the QPE-based protocol has been used for DIQRNG secure against quantum side information Zhang et al. (2020a), and a recent experimental work of DIQRE secure against classical side information Shalm et al. (2019) is carried out based on a classical-proof version of the theory, the probability estimation method Zhang et al. (2018). The QPE method takes advantage of full input-output probability distribution, and is highly numerical and sensitive in statistical fluctuations. For example, the experimental settings in this work are optimized with respect to an empirical input-output probability distribution obtained from three hour’s training data. Besides, in all these QPE-based works, a specific randomness generation or expansion task is set, and the largest allowed number of rounds for the task is pre-determined.

(b) EAT method Arnon-Friedman et al. (2018): This method utilises the violation value of a specific Bell inequality, and leads to a formula connecting the Bell test value and the amount of randomness generated depending on the number of rounds. Using this we can calculate the expected number of rounds needed for randomness generation or expansion. It has been applied to the first DIQRNG experiment secure against quantum side information Liu et al. (2018a) and a recent experimental work on DIQRE Liu et al. (2019). In these two works, the CHSH inequality is used. An abort condition is set in the protocol, but there is no need to set a specific amount of randomness to be generated as a target. For example, in the work of Ref. Liu et al. (2019), a CHSH test is carried out to estimate the parameters of the experiment according to the value of violation, and a 19.2-hour experimental time is set to achieve expansion afterwards.

We suspect that in general, whether QPE or EAT method is the better technique to use depends on the situation. A detailed analysis of when one is preferable to the other is desirable, but is beyond the scope of the present work. We note that some preliminary work has been done in the Section VIII. B. of Ref. Zhang et al. (2020b). From current theoretical and experimental results, we would like to state that the current QPE method is more tailored for efficiently witnessing randomness generation with a low latency than EAT-based approach. Though our discussion is more in a qualitative manner, we hope this can benefit further investigations.

F.2 Comparison between CHSH Bell Test and GHZ Test

In this work, we have utilised the CHSH-type Bell test. In general, other types of Bell test can be used for randomness expansion. One specific choice is the Greenberger-Horne-Zeilinger (GHZ) protocol proposed in Colbeck , where the GHZ test is used. This is a randomness expansion protocol based on three nonlocal quantum devices. The protocol is implicitly related the Mermin inequality Mermin (1990), while here we briefly state the original design. In the randomness expansion protocol of Colbeck , the randomness is generated from the outputs of the GHZ test, which goes as follows:

The users randomly set inputs to three quantum measurement devices as $X,Y,Z\in\{0,1\}$, and the measurement devices output $A,B,C\in\{\pm 1\}$. The test is repeated for a certain number of trials. 2. 2.

The users keep the trials with the input settings $(X,Y,Z)=(0,0,0),(0,1,1),(1,0,1),(1,1,0)$. 3. 3.

If $ABC=-1$ for the first setting and $ABC=+1$ for the remaining three, the test succeeds, and the protocol proceeds to randomness extraction. Otherwise the protocol aborts.

A nice theoretical property of the GHZ test is that the condition cannot be met perfectly with classical strategies using shared randomness but with a unique quantum strategy Colbeck (in the sense of local unitary operations). Therefore, the GHZ test has a convenient cheat-detection property in the ideal case, where a user can be certain whether there is an attack by observing whether the requirement of the test is met Colbeck and Kent (2011). Nevertheless, in a real experiment with imperfect devices under a potentially adversarial condition, an enough amount of statistics shall be required for the GHZ protocols for the certification of the generated randomness, and tolerance to noise and error needs to be considered, too.

Compared to the GHZ protocol, we emphasize that the probabilistic nature of the CHSH test does not introduce an additional side-channel of information leakage. In both protocols, the amount of possible information leakage can be estimated arbitrarily well over a long run of the protocol, in the sense that under the QPE framework, the soundness error of the protocol can be taken arbitrarily small by taking long enough statistics. In general, the number of trials required to achieve a particular soundness error depends on the Bell test that is used, and it might benefit in certain conditions to use the GHZ test due to its deterministic property, i.e., the GHZ game can be won perfectly. We leave the investigation of DIQRE based on general Bell tests for further research.