Experimental device-independent certified randomness generation with an instrumental causal structure

TL;DR

This paper demonstrates a new method for generating certified quantum randomness using an instrumental causal structure, combining theoretical proofs with experimental implementation, and showing advantages over traditional Bell-based protocols under low noise conditions.

Contribution

It introduces a novel device-independent randomness generation protocol based on the instrumental scenario and experimentally validates it with entangled photons.

Findings

Certified randomness can be extracted using instrumental-inequality violations.

The protocol outperforms Bell-based protocols at low noise levels.

Experimental implementation confirms theoretical predictions.

Abstract

The intrinsic random nature of quantum physics offers novel tools for the generation of random numbers, a central challenge for a plethora of fields. Bell non-local correlations obtained by measurements on entangled states allow for the generation of bit strings whose randomness is guaranteed in a device-independent manner, i.e. without assumptions on the measurement and state-generation devices. Here, we generate this strong form of certified randomness on a new platform: the so-called instrumental scenario, which is central to the field of causal inference. First, we theoretically show that certified random bits, private against general quantum adversaries, can be extracted exploiting device-independent quantum instrumental-inequality violations. To that end, we adapt techniques previously developed for the Bell scenario. Then, we experimentally implement the corresponding randomness-generation protocol using entangled photons and active feed-forward of information. Moreover, we show that, for low levels of noise, our protocol offers an advantage over the simplest Bell-nonlocality protocol based on the Clauser-Horn-Shimony-Holt inequality.

Equations

$$\mathcal{I}={⟨A⟩}_1-{⟨B⟩}_1+2{⟨B⟩}_2-{⟨AB⟩}_1+2{⟨AB⟩}_3\le 3$$

$${\mathcal{H}}_{min}^{ϵ}(O^n|S^n{E}^n)>nt-\nu \sqrt{n},$$

Full text

I Introduction

The generation of random numbers has applications in a wide range of fields, from scientific research – e.g. to simulate physical systems – to military scopes – e.g. for effective cryptographic protocols – and every-day concerns – like ensuring privacy and gambling. From a classical point of view, the concept of randomness is tightly bound to the incomplete knowledge of a system; indeed, classical randomness has a subjective and epistemological nature and is erased when the system is completely known WIQ . Hence, classical algorithms can only generate pseudo-random numbers pseudo_random , whose unpredictability relies on the complexity of the device generating them. Besides, the certification of randomness is an elusive task, since the available tests can only verify the absence of specific patterns, while others may go undetected but still be known to an adversary statistical_test .

On the other hand, randomness is intrinsic to quantum systems, which do not possess definite properties until these are measured. In real experiments, however, this intrinsic quantum randomness comes embedded with noise and lack of complete control over the device, compromising the security of a quantum random-number generator. A solution to that is to devise quantum protocols whose correctness can be certified in a device-independent (DI) manner, i.e. solely from the observed statistics and with no assumption whatsoever on the internal working of the experimental devices. For instance, from the violation of a Bell inequality bell64 ; brunner14 one can ensure that the statistics of certain quantum experiments cannot be described in the classical terms of local deterministic models, hence being impossible to be deterministically predicted by any local observer. Moreover, the extent of such violation can provide a lower bound on the certified randomness characterizing the measurement outputs of the two parties performing the Bell test, as shown in Ref. rng_certified . Several other seminal works based on Bell inequalities have been developed Colbeck12 ; Gallego_2013 ; Brandao16 ; Ramanathan16 ; miller2016 ; vazirani2012 ; pan2018 ; vazirani2016QKD ; chung2015 ; dupuis2016 ; friedman2019 ; christensen2013 ; friedman2019 ; continuous_rand ; BSS14 , advancing the topics of randomness amplification (the generation of near-perfect randomness from a weaker source), randomness expansion (the expansion of a short initial random seed), and quantum key distribution (sharing a common secret string through communication over public channels). In particular, loophole-free Bell tests based on randomness generation protocol have been implemented christensen2013 ; bierhorst2018 ; rng_certified and more advanced techniques have been developed to provide security against general adversarial attacks friedman2019 ; continuous_rand ; Friedman2017 .

From a causal perspective, the non-classical behaviour revealed by a Bell test lies in the incompatibility of quantum predictions with our intuitive notion of cause and effect pearlbook ; Wood2015 ; Chaves2015 . Given that the causal structure underlying a Bell-like scenario involves five variables (the measurement choices and outcomes for each of the two observers and a fifth variable representing the common cause of their correlations), it is natural to wonder whether a simpler causal structure could give rise to an analogous discrepancy between quantum and classical causal predictions henson2014 ; perspectivecausality . The instrumental causal structure pearl1 ; Bonet , where the two parties (A and B) are linked by a classical channel of communication (shown in Fig.1-a), is the simplest model (in terms of the number of involved nodes) achieving this result instrumental . This scenario has fundamental importance in causal inference, since it allows the estimation of causal influences even in the presence of unknown latent factors pearl1 .

In this letter, we implement a device-independent random number generator based on instrumental correlations, secure against general quantum attacks friedman2019 . Our protocol is device-independent in the sense that we do not make any assumption about the measurements and states used in the protocol, not even their dimension. We stress however that the implementation is assumed to respect the causal structure imposed by the instrumental scenario. To implement the protocol in all of its parts, we have set up a classical extractor following the theoretical design by Trevisan trevisan . Moreover, we prove that device-independent randomness generation protocols implemented in this scenario, for high state visibilities, can bring an advantage in the gain of random bits when compared to those based on on the simplest two-input-two-output Bell scenario, i.e. the Clauser-Horn-Shimony-Holt (CHSH) chsh_1969 . Therefore, this work paves the way to further applications of the instrumental scenario in the field of device-independent protocols, which, until now, have relied primarily on Bell-like tests.

II Randomness certification via instrumental inequality violations

Let us first briefly review some previous results obtained in the context of Bell inequalities bell64 . In a CHSH scenario chsh_1969 , two parties, A and B, share a bipartite system and, without communicating to each other, perform local measurements on their subsystems. If A and B choose between two given operators each, i.e. ($A_{1}$, $A_{2}$) and ($B_{1}$, $B_{2}$) respectively, and then combine their data, the mean value of the operator $S=|\left\langle A_{1},B_{1}\right\rangle-\left\langle A_{1},B_{2}\right\rangle+\left\langle A_{2},B_{1}\right\rangle+\left\langle A_{2},B_{2}\right\rangle|$ should be upper-bounded by 2, for any deterministic model respecting a natural notion of locality. However, as proved in chsh_1969 , if A and B share an entangled state, they can get a value exceeding such bound, whose explanation requires the presence of non-classical correlations between the two parties. Hence, Bell inequalities have been adopted in rng_certified to guarantee the intrinsic random nature of the measurements’ outcomes, within a DI randomness generation and certification protocol.

In the instrumental causal model, which is depicted in Fig.1-a, the two parties (Alice and Bob) still share a bipartite state. Alice can choose among $l$ possible $d$-outcome measurements ($O_{A}^{1}$, …, $O_{A}^{l}$), according to the instrument variable $x$, which is independent from the shared correlations between Alice and Bob ($\Lambda$) and can assume $l$ different values, while Bob’s choice among $d$ observables ($O_{B}^{1}$, …, $O_{B}^{d}$) depends on Alice’s outcome. In other words, as opposed to the spatially-separated correlations in a Bell-like scenario, the instrumental process constitutes a temporal scenario, with one-way communication of Alice’s outcomes to select Bob’s measurement. Hence, due to the communication of Alice’s outcome $a$ to Bob, Bob’s outcome $b$ is not independent of $x$; however, the instrumental network specifies this influence to be indirect, formalized by the constraint $p(b|x,a,\lambda)=p(b|a,\lambda)$ and justifying the absence of an arrow from $X$ to $B$ in Fig. 1-a.

Similarly to Bell-like scenarios, the causal structure underlying an instrumental process imposes some constraints on the classical joint probabilities $\{p(a,b|x)\}_{a,b,x}$ that are compatible with it pearl1 ; Bonet (the so-called instrumental inequalities). In the particular case where the instrument $x$ can assume three different values (1,2,3), while $a$ and $b$ are dichotomic, the following inequality holds Bonet :

[TABLE]

where $\left\langle AB\right\rangle_{x}=\sum_{a,b=0,1}(-1)^{a+b}p(a,b|x)$. Remarkably, this inequality can be violated with the correlations produced by quantum instrumental causal models instrumental , up to the maximal value of $\mathcal{I}=1+2\sqrt{2}$. Recently, the relationship of the instrumental processes with the Bell scenario has been studied in himbeeck2018 .

In this context, we rely on the fact that if a given set of statistics $\{p(a,b|x)\}_{a,b,x}$ violates inequality (1), then the system shared by the two parties exhibits non-classical correlations that impose non-trivial constraints on the information a potential eavesdropper could obtain, represented in the probability distributions $\{p(a,b,e|x)\}_{a,b,e,x}$, where $e$ is the eventual side information of the eavesdropper. Consequently, this restricts the values of the conditional min-entropy, a randomness quantifier defined as $\mathcal{H}_{min}=-\log_{2}[\sum_{e}P(e)\max_{a,b}P(a,b|e,x)]$ PM13 . Indeed, it is possible to obtain a lower-bound on the min-entropy, for each $x$, as a function $f_{x}$ of $\mathcal{I}$: $\mathcal{H}_{min}\geq f_{x}(\mathcal{I})$. For each $x$ and $\mathcal{I}$, the lower bound $f_{x}(\mathcal{I})$ can be computed via semidefinite programming (SDP), by applying to the instrumental case the numerical techniques developed in bound ; rng_certified . Such method was originally conceived for the Bell scenario (see Supplementary Information), but it can actually be applied to any casual model involving a shared bipartite system, on whose subsystems local measurements are performed. The functions $f_{x}$ are convex and grow monotonically with $\mathcal{I}$; so, the higher the violation of inequality (1) is, the higher the min-entropy lower bound will be. Nevertheless, in real experimental conditions, in order to evaluate the quantum violation extent $\mathcal{I}^{*}$ (or, analogously, the probability distribution $p^{*}(a,b|x)$) to compute $f_{x}$, several experimental runs are necessary. Therefore, unless one makes the iid assumption (i.e. all the experimental runs are assumed to be independent and neither the state source nor Alice’s and Bob’s measurement devices exhibit time-dependent behaviours), this bound $f_{x}(\mathcal{I^{*}})$ will not hold in the presence of an adversary that could include a (quantum) memory in the devices, introducing interdependences among the runs. Several device-independent protocols have been proposed so far addressing the most general non-iid case reichardt2013 ; vazirani2014 ; miller2014 , but at the cost of a low feasibility. Only very recently a feasible solution for the CHSH scenario has been proposed and used friedman2019 ; continuous_rand ; Friedman2017 , resorting to the Entropy Accumulation Theorem (EAT), in order to deal with processes not necessarily made of independent and identically distributed runs.

Here we adapt the technique developed in friedman2019 to the instrumental scenario, making our randomness certification secure against general quantum attacks. According to the EAT, for a category of processes that comprehends also an implemented instrumental process composed of several runs, the following bound on the smooth min-entropy holds:

[TABLE]

where $O$ are the quantum systems given to the honest parties Alice and Bob, at each run, $S$ constitutes the leaked side-information, while $E$ represents any additional side information correlated to the initial state. Then, $t$ is a convex function which depends on the extent of the violation, expected by an honest, although noisy, implementation of the protocol, i.e. in a scenario with no eavesdropper ($I_{exp}$). On the other hand, $\nu$ depends also on the smoothing parameter $\epsilon$, which characterizes the smooth min-entropy $\mathcal{H}_{min}^{\epsilon}$, and $\epsilon_{EA}$, i.e. the desired error probability of the entropy accumulation protocol; in other words, either the protocol aborts with probability higher than $1-\epsilon_{EA}$ or the bound (2) holds (for further detail, see the Supplementary Information).

Our protocol is implemented as follows (see Fig.2): for each run, a random binary variable $T$ is drawn according to a Bernoulli distribution of parameter $\gamma$ (set by the user); if $T=0$, the run is an accumulation run, so $x$ is deterministically set to 2 (which guarantees a higher $f(\mathcal{I})$, see the Supplementary Information); on the other hand, if $T=1$, the run is a test run, so $x$ is randomly chosen among 1, 2 and 3. After $m$ test runs (with $m$ chosen by the user), the quantum instrumental violation is evaluated from the bits collected throughout the test runs and, if lower than $I_{exp}-\delta^{\prime}$, ($\delta^{\prime}$ being the experimental uncertainty on $\mathcal{I}$) the protocol aborts; otherwise the certified smooth min-entropy is bounded by inequality (2). This lower bound on the certified min entropy represents the maximum certified amount of bits that we can extract from our collected data. Hence, feeding the raw bit string and the $\mathcal{H}_{min}^{\epsilon}$ to the classical extractor trevisan , the algorithm will output at most $\mathcal{H}_{min}^{\epsilon}(O^{n}|S^{n}E^{n})$ certified random bits, the exact value depending on its internal error parameter $\epsilon_{ext}$. Specifically, we resorted to the classical extractor devised by Trevisan trevisan . This algorithm takes as inputs a weak randomness source, in our case the $2n$ raw bits long string, and a seed, which is poly-logarithmic in the input size (our code for the classical extractor can be found at code and, for a detailed description of the classical randomness extractor, see Supplementary Information).

III Experimental implementation of the protocol

The device-independent random numbers generator, in our proposal, is made up of three main parts, which are seen as black boxes to the user: the state generation and Alice’s and Bob’s measurement stations. The causal correlations among these three stages are those of an instrumental scenario (see Fig. 1-a-c) and are implemented through the photonic platform depicted in Fig.3.

Within this experimental apparatus, the qubits are encoded in the photon’s polarization: horizontal ($\left|H\right\rangle$) and vertical ($\left|V\right\rangle$) polarizations represent, respectively, qubits $\left|0\right\rangle$ and $\left|1\right\rangle$, eigenstates of the Pauli matrix $\sigma_{z}$. A spontaneous parametric down-conversion (SPDC) process generates the two-photon maximally entangled state $\left|\Psi^{-}\right\rangle=\frac{\left|HV\right\rangle-\left|VH\right\rangle}{\sqrt{2}}$. One photon is sent to path 1, towards Alice’s station, where an observable among $O_{A}^{1}$, $O_{A}^{2}$ and $O_{A}^{3}$ is measured, applying the proper voltage to a liquid crystal (LCD). The voltage must be chosen according to a random seed, made of a string of trits (indeed, in our case, we take $\gamma=1$, so $x$ is chosen among (1,2,3) at every run). This seed is obtained from the NIST Randomness Beacon beacon , which provides 512 random bits per minute. After Alice has performed her measurement, whenever she gets output 1 (i.e. $D_{A}^{0}$ registers an event), the detector’s signal is split to reach the coincidence counter and, at the same time, trigger the Pockels cell on path 2. Bob’s station is made of a Half-Wave Plate (HWP) followed by this fast electro-optical device. When no voltage is applied to the Pockels cell, Bob’s operator is $O_{B}^{1}$ and, when it is turned on, there is a swift change to $O_{B}^{2}$ (the cell’s time response is of the order of nanoseconds). In order to have the time to register Alice’s output and select Bob’s operator accordingly, the photon on path 2 is delayed, through a 125 meters long single-mode fiber.

The four detectors are synchronized in order to distinguish the coincidence counts generated by the entangled photons’ pairs from the accidental counts. Let us note that our experimental implementation requires the fair sampling assumption, due to our overall low detection efficiency. The measurement operators achieving maximal violation of $\mathcal{I}=1+2\sqrt{2}$, when applied to the state $\left|\psi^{-}\right\rangle$, are the following: $O_{A}^{1}=-(\sigma_{z}-\sigma_{x})/\sqrt{2}$, $O_{A}^{2}=-\sigma_{x}$, $O_{A}^{3}=\sigma_{z}$ and $O_{B}^{1}=(\sigma_{x}-\sigma_{z})/\sqrt{2}$, $O_{B}^{2}=-(\sigma_{x}+\sigma_{z})/\sqrt{2}$. After having implemented the instrumental scenario, performed several experimental runs and collected the raw bits, we verified that the violation was higher than the chosen threshold $I_{exp}=3.5$ and evaluated the smooth min-entropy bound according to inequality (2). In the end, we executed the classical randomness extractor devised by Trevisan trevisan . The complete procedure is summarized in Fig.2.

IV Results

IV.1 Theoretical Results

The DI random number generation protocol we propose for the instrumental scenario was developed adapting the pre-existing techniques for the Bell scenario friedman2019 ; continuous_rand , and is secure against general quantum adversaries. The most striking aspect of our protocol is that, as shown in Fig.4, although in terms of min-entropy the CHSH scenario guarantees a higher bound (as it can be seen in Fig.1-b), if we look at the randomness gain, considering an arbitrary randomness source which provides a given quantity of bits to use as input both of our protocol, as well as of its CHSH based counterpart, the instrumental scenario proves to be more convenient. In other words, more certified random bits can be extracted, investing the same amount of initial randomness. This happens in the regime of high state visibilities $v$ considering the following state $\rho=v\left|\psi^{-}\right\rangle\left\langle\psi^{-}\right|+(1-v)\frac{I}{4}$ and large amounts of invested random bits, for example at least $10^{9}$ bits (golden curve), with a visibility of $\sim 0.98$.

IV.2 Experimental Results

We implemented the instrumental scenario on a photonic platform and adopted the proposed quantum adversary-proof protocol in our experimental conditions. Specifically, we had 172095 experimental runs and set $\epsilon_{EA}=\epsilon=10^{-1}$ and the threshold to $I_{exp}=3.5$, with $\delta^{\prime}=0.011$. Since the registered violation was of $3.516\pm 0.011$, our smooth min-entropy bound, according to inequality (2), was 0.031125, which allowed us to gain, through the classical extractor, an overall number of 5270 random bits, with an error on the classical extractor of $\epsilon_{ext}=10^{-6}$. Note that each experimental run lasted $\sim 1s$ and the bottleneck of our implementation is the time response of the liquid crystal, $\sim 700$ ms, that implements Alice’s operator. Hence, in principle, significantly higher rates can be reached on the same platform, adopting a fast electro-optical device also for Alice’s station, with a response time of $\sim 100$ ns.

The length of the seed required by the classical extractor, as mentioned, is poly-logarithmic in the input size and its length also depends on the chosen error parameter $\epsilon_{ext}$ (which is the tolerated distance between the uniform distribution and the one of the final string) and on the particular algorithm adopted. In our case, we used the same implementation of code ; framework , which was proven to be a strong quantum proof extractor by De2012 . With respect to other implementations of the Trevisan extractor aaronson2018 , we require a longer seed, but we can extract a higher amount of random bits. Let us note that, since the length of the seed grows as $log(2n)^{3}$, where $n$ is the number of experimental runs, the randomness gain is not modified if we take also into account the bits invested in the classical extractor’s seed. Indeed, the number of extracted bits grows polynomially in $n$. Hence, if $H_{min~{}Instr}^{\epsilon}\geq H_{min~{}CHSH}^{\epsilon}$, then $m_{Instr}-d_{Instr}\geq m_{CHSH}-d_{CHSH}$, where $m$ is the length of the final string (after the classical extraction) and $d$ the length of the required seed. For more details about the internal functioning of the classical randomness extractor and its specific parameter settings, see the Supplementary Information.

V Discussion

In conclusion, in this work we implemented a device-independent random number generator based on the instrumental scenario. This shows that instrumental processes constitute an alternative venue with respect to Bell-like scenarios. Moreover, we also showed that, in some regimes, the efficiency of the randomness generated by the violation of the instrumental inequality (1) can surpass that of efficiency of the CHSH inequality, as shown in Fig.4.

Through the proposed protocol, we could extract an overall number of 5270 random bits, considering a threshold for the instrumental violation of $I_{exp}=3.5$ and $10^{-1}$, both as error probability of the entropy accumulation protocol ($\epsilon_{EA}$), as well as smoothing parameter ($\epsilon$). The conversion rate, from public to private randomness, as well as the security parameters, could be improved on the same platform, by raising the number of invested initial random bits, or, analogously, the number of runs. To access the regime in which the instrumental scenario is more convenient than the CHSH one, we should invest a number of random bits over $10^{9}$ and obtain a visibility of $\sim 0.98$ (the more we raise the amount of invested bits, the more the threshold for the visibility lowers down).

This proof-of-principle opens the path for further investigations of the instrumental scenario as a possible venue for other information processing tasks usually associated to Bell scenarios, such as self-testing Mayers04 ; Yang13 ; McKague14 ; Bamps15 ; Wu16 ; Supic16 ; Coladangelo17 ; McKague17 ; Supic18 ; Bowles18 and communication complexity problems Brukner04 ; Buhrman10 ; Buhrman16 .

VI AKNOWLEDGEMENTS

We aknowledge Gláucia Murta for stimulating discussion. We acknowledge support from John Templeton Foundation via the grant Q-CAUSAL n*∘*61084 (the opinions expressed in this publication are those of the authors and do not necessarily reflect the views of the John Templeton Foundation). IA, DP, MM, GC and FS aknowledge project Lazio Innova SINFONIA. DC acknoledges a Ramon y Cajal fellowship, Spanish MINECO (Severo Ochoa SEV-2015-0522), Fundació Privada Cellex and Generalitat de Catalunya (CERCA Program). LG and LA acknowledge financial support from the São Paulo Research Foundation (FAPESP) under grants 2016/01343-7 and 2018/04208-9. RC acknowledges the Brazilian ministries MCTIC, MEC and the CNPq (grants No. $307172/2017-1$ and $406574/2018-9$ and INCT-IQ) and the Serrapilheira Institute (grant number Serra-1708-15763). G.C. aknowledges Conicyt and Becas Chile. LA acknowledges financial support also from the Brazilian agencies CNPq (PQ grant No. 305420/2018-6 and INCT-IQ), FAPERJ (JCNE E-26/202.701/2018), CAPES (PROCAD2013 project), and the Brazilian Serrapilheira Institute (grant number Serra-1709-17173).

VII METHODS

VII.0.1 Experimental details

Photon pairs were generated in a parametric down conversion source, composed by a nonlinear crystal beta barium borate (BBO) of 2 mm-thick injected by a pulsed pump field with $\lambda=392.5$ nm. After spectral filtering and walk-off compensation, photons of $\lambda=785$ nm are sent to the two measurement stations A and B. The crystal used to implement active feed-forward is a $\mathrm{LiNbO}_{3}$ high-voltage micro Pockels Cell –made by Shangai Institute of Ceramics with $<1$ ns risetime and a fast electronic circuit transforming each Si-avalanche photodetection signal into a calibrated fast pulse in the kV range needed to activate the Pockels Cell– is fully described in sciarrino_teleportation . To achieve the active feed-forward of information, the photon sent to Bob’s station needs to be delayed, thus allowing the measurement on the first qubit to be performed. The amount of delay was evaluated considering the velocity of the signal transmission through a single mode fiber and the activation time of the Pockels cell. We have used a fiber 125 m long, coupled at the end into a single mode fiber that allows a delay of 600 ns of the second photon with respect to the first.