Quantum randomness extraction for various levels of characterization of the devices

0.45 MB·

by  Yun Zhi Law

Quantum randomness extraction for various levels of characterization of the
devices
Yun Zhi Law,1 Le Phuc Thinh,1 Jean-Daniel Bancal,1 and Valerio Scarani1,2
1Centre for Quantum Technologies, National University of Singapore,
3 Science Drive 2, Singapore 117543, Singapore
2Department of Physics, National University of Singapore,
2 Science Drive 3, Singapore 117542, Singapore
(Dated: October 16, 2014)
Theamountofintrinsicrandomnessthatcanbeextractedfrommeasurementonquantumsystems
dependsonseveralfactors: notably,thepowergiventotheadversaryandthelevelofcharacterization
ofthedevicesoftheauthorizedpartners. Afterpresentingasystematicintroductiontothesenotions,
4
in this paper we work in the class of least adversarial power, which is relevant for assessing setups
1
operated by trusted experimentalists, and compare three levels of characterization of the devices.
0
2 Many recent studies have focused on the so-called “device-independent” level, in which a lower
bound on the amount of intrinsic randomness can be certified without any characterization. The
ct other extreme is the case when all the devices are fully characterized: this “tomographic” level
O has been known for a long time. We present for this case a systematic and efficient approach to
quantifying the amount of intrinsic randomness, and show that setups involving ancillas (POVMs,

5 pointer measurements) may not be interesting here, insofar as one may extract randomness from
1 the ancilla rather than from the system under study. Finally, we study how much randomness can
beobtainedinpresenceofanintermediatelevelofcharacterizationrelatedtothetaskof“steering”,

] inwhichBob’sdeviceisfullycharacterizedwhileAlice’sisablackbox. Weobtainourresultshere
h
by adapting the NPA hierarchy of semidefinite programs to the steering scenario.
p
-
t
n
I. INTRODUCTION ied this way was quantum key distribution [6]; it
a
was followed by the task of generating certified ran-
u
q domness [7, 8] and by the quantifications of some
The quantum information community has always
[ entanglement measures [9, 10].
duly acknowledged Bell’s work as pioneering. In-
Device-independent certification still requires
3 deed, Bell’s discovery [1] that an apparently philo-
some assumptions on the devices, that we are go-
v sophical issue can actually be settled by experiment
3 ing to describe in detail in the next section: these
was a precursor to the approach of stopping com-
4 assumptions define the minimal level of characteri-
plaining about quantum weirdness and putting it
2 zation of the devices that is required to be able to
4 to practical use. Once this novel approach was certify some quantum behavior. On the contrary,
. adopted, however, there seemed to be little scope
1 the bulk of the quantum information literature usu-
left for Bell inequalities: Bell having done its job by
0 ally works under the assumption that the degrees of
showing that local variables don’t exist, one should
4 freedom under study (“system”) and the measure-
1 focus on entanglement as a resource. A few authors ments are fully characterized — intriguingly, this
: triedtofindlinksbetweenBellinequalitiesandsome
v is the case even in quantum cryptography: for in-
usefultasks,butthereportedexampleshappenedto
i stance, the unconditional security of the BB84 pro-
X be either artefacts of restrictive assumptions [2] or
tocolreliesonthefactthatthesystemsusedbyAlice
r ad hoc constructions [3]. and Bob are qubits [11]. Between the two extremes,
a
The practical role of Bell inequalities in quantum several semi-device-independent levels of trust can
information was fully clarified around the year 2007 be relevant.
(see [4, 5] for a review of those developments): the The goal of this paper is to discuss how the pro-
violationofBellinequalitieswitnessesentanglement ductionofquantumrandomness dependsonthelevel
withoutanyneedtospecifythedimensionalityofthe with which the devices involved are characterized.
system under study or the measurements that are Our results will be derived in the minimal adversar-
performed on it. This means that one can certify, ial class which is relevant to assess setups produced
and even more, quantify, the entanglement shared and operated by honest experimentalists. We begin
between two or more black boxes. This possibility, byclarifyingallthesescenarios(SectionII),thenwe
unique to Bell inequalities, has been called device- introduce the mathematical tools (Section III) and
independent certification. The first task to be stud- present an explicit comparison between three levels
of characterization (Section IV). Finally, we high- A. Classes of adversarial power
light some subtleties proper to randomness extrac-
tioninascenarioofcompletecharacterizationofthe
Throughout the paper, we are going to as-
system and the measurements (Section V).
sume that quantum theory holds; in particular,
we don’t discuss the possibility of certifying ran-
domness against an adversary limited only by no-
signaling [12, 14–16, 20, 21]. The power given to
Eve can be divided in three main classes:
II. SCENARIOS FOR QUANTUM
RANDOMNESS Class (I) Eve has no access to the devices. Because of
the Kerchhoff-Shannon principle (one should
not look for security in hiding details of the
hardware or the protocol), we assume that
z
q ⇢
� � even though she cannot influence it, Eve has
X� knowledgeoftheexperimentalsetup. Thus,she
M ⇢ mayknowineachrunwhichquantumstateen-
z ters the box, and which measurement is used.
Her description of both state and measure-
ments may be better than that of both Al-
c
ice and the provider: for instance, she may
be able to describe the state as pure in each
FIG. 1. Generic setup of quantum randomness extrac-
runbyknowingwhichdecompositionofapos-
tion. The authorized party inputs z into a box and re-
ceives the outcome c, whose randomness one wants to sible mixture is being used. Since the choice
guarantee with respect to an adversary Eve. Inside the of measurement in each run is known to Eve,
box, the role of z consists in selecting a possible mea- no initial private randomness is required here.
surement M to be performed on a state ρ, and c is the We can define two subclasses, according to
z
outcome of that measurement. The assumption of mea- whetherEvedoesnot(a)ordoes(b)holdapu-
surement independence (which is enforced here, though rificationofthestateinaquantummemory(in
it could be partially relaxed) means that in each run z
the literature on quantum cryptography one
and ρ must be uncorrelated. Various scenarios can be
finds also intermediate situations between (a)
considered based on the power given to Eve (discussed
and (b), the so-called bounded-storage mod-
inparagraphIIA)andthelevelofcharacterizationthat
els [22] and noisy storage models [23]). Be-
theauthorizedpartyhasofherdevices(paragraphIIB).
cause quantum theory is no-signaling, holding
apurificationdoesnotallowEvetochangethe
stateρ,butmaygivehermoreguessingpower
We start this paper by a concise review of vari-
since she will be able to steer towards a spe-
ous scenarios for quantum randomness. The generic
cific decomposition (by performing a specific
setupforquantumrandomnessissketchedinFig.1.
measurement on her reduced state).
As explained in the caption, the goal of the autho-
rized party is to certify the randomness of the out-
Class (II) Eve distributes the state to the users, but
come c with respect to Eve’s knowledge. There is a
has only classical, though perfect, knowledge
priori placeforathirdparty,theprovider,whomay
about the set of possible measurements. Note
have produced some of the devices but has no inter-
that in this case, the measurement settings
est in learning c. A scenario will be defined by the
shouldnotbeknownbyEveinadvance,other-
power given to Eve and the level of characterization
wiseshecouldpreparethestateaccordinglyto
of the devices. We address them in this order.
obtain full knowledge of the outcomes. Thus,
For definiteness, we focus exclusively on the case aninitialamountofprivaterandomnessisnec-
of measurement independence: namely, we assume essarytoruntheprotocol. Wecanagaindefine
that the state to be measured ρ and the choice of subclasses (a) and (b) as above. Class II(b)
the measurement z are fully uncorrelated in each is a natural analog of the entanglement-based
run. It is remarkable that even this assumption can schemeinwhichquantumcryptographycanbe
be partially relaxed, giving rise to the possibility of proven “unconditional secure”: as such, most
randomnessamplification[12–19],butwedon’tcon- papers on quantum randomness have consid-
sider this task in this paper. ered it [21, 24–26]. This class is natural in the
2
Class I Class II Class III
Eve... has no access to the devices distributes the state prepares the devices
Subclass (a) randomness
holds classical side information generation randomness no
expansion randomness
Subclass (b) randomness
holds quantum side information generation
TABLEI.Randomnessprotocolsinpresenceofmeasurementindependencewithdifferentclassesofadversaries. The
gray cell corresponds to the trusted provider assumption, which describes the class of adversaries considered in this
work.
case where Alice holds two subsystems situ- seed must indeed guarantee measurement indepen-
atedinsecured,butpossiblydistantlocations. dence, i.e. z must be “random” with respect to the
choice of the state in each run, and viceversa; while
Class (III) The maximal class is that in which Eve is
the randomness we want to extract must be unpre-
the provider, namely she prepares both the
dictable for Eve. Therefore, if one works in Class I,
measurement devices and the state: the only
norandomnesswithrespecttoEveisrequiredinthe
power left with Alice is the choice of z in each input seed: even if Eve knows z, she cannot adapt
run. The claim is frequently made, at least in
the state to it. Similarly, the random seed needed
semi-popular accounts, that quantum physics
to extract the final random bits from the output c
could provide security against an adversarial
throughtheleft-overhashlemmaneedsonlyberan-
provider. The correct statement is that one
dom with respect to the outputs themselves. It can
may be able to certify the quantumness of the
thusbeknowntotheadversary. Onecanthenspeak
process that generates c, typically in the case of randomness generation [28]. On the contrary, in
of a loophole-free Bell test. However, an ad-
Classe II, since Eve prepares the state, the inputs
versarial provider would certainly find a way
z must be generated with a process that is a priori
to hide a transmitter in the devices, with the
guaranteed to be unknown to Eve. In other words,
taskofleakingoutthevaluesofcattheendof in these classes there is no randomness generation,
the protocol, or may employ attacks discussed
butonlyrandomnessexpansion —and,afteraseries
in [27]. Therefore, however certifiably quan-
ofpartialresults[24,28,29],ithasbeenprovedthat
tum the process that generated the outcomes
such expansion can in principle be unbounded [21].
may have been, there cannot be any random-
The different adversarial classes discussed here are
ness with respect to an adversarial provider.
summarized in Table I.
So we won’t consider this class any longer in
this paper.
A point worth stressing is the amount of random-
nessneededtogeneratetheseedz. Thechoiceofthis
Finally recall that we are assuming strict mea- B. Levels of characterization of the devices
surement independence. If partial measurement de-
pendence is taken into account, one would have to
The second defining feature of a scenario is the
refine the definition of these classes: for instance,
level of characterization that Alice has of the work-
by specifying whether the dependence is introduced
ing of her devices. We sketched it in the introduc-
unwittingly by the provider or maliciously by Eve.
tion, now we can be more precise:
• The tomography level of characterization usu-
ally means that Alice knows the behavior of
her devices as well as Eve does. This is what
3
we shall consider in this paper. Of course, in knowledge of the degree of freedom, but as-
the vast literature on quantum tomography, sume an upper bound on the dimensionality
the possibility of partial knowledge of the de- of the systems under study [39]. In this pa-
viceshasbeenconsidered[30–33],soonecould per,weshallconsiderexplicitlythecasecalled
refine this level of characterization in several one-sided device-independent, in which entan-
sublevels. In all cases, though, it is assumed glement is certified by two devices, Alice’s be-
thatAliceknowsexactlywhichdegreesoffree- ingtomographicandBob’sunknown;thiscase
dom are relevant to the measurement (polar- was studied for quantum key distribution [40].
ization, spin, quadrature of a field...).
When this trust in the characterization is un-
warranted, a Class II Eve may successfully C. Assumptions of this paper
hack thedevices. Inparticular,Evemayknow
that some degrees of freedom, others than the Inthispaper,weconsiderEveinClassI(a),which
onesAliceisawareof, playaroleinthephysi- wascalled“trustedprovider”inpreviousworks[41].
calprocess,andmaythusinfluencethebehav- In real life, this class describes randomness genera-
ior of the boxes by addressing those degrees tion in an experiment performed by a trusted labo-
of freedom. For instance, this was the case in ratory: therefore,evenifitdoesnotexploretheulti-
theseriesofexperimentsthathackedquantum matelimitsofquantumpower,itisarguablyrelevant
cryptographydevicesbyexploitingthephysics for physics [42, 43]. The randomness is guaranteed
of photodetectors [34–36]. Similarly, a Class against any Eve that is not involved in setting up
I Eve could also take advantage of her knowl- or running the experiment. Furthermore, Eve not
edgeaboutwhathappensinadditionaldegrees beinginthelab,shecouldholdthepurificationonly
of freedom if a setup happens to use them. if those degrees of freedom were “radiative” and she
had the power to collect them: this, together with
• The device-independent level of characteriza- the state-of-the-art of quantum memories, makes it
tion means that Alice does not rely on a veryreasonabletorestricttosubclass(a)atleastfor
description of her devices but only on the a few years to come.
observed statistics. Since the statistics on
Also, we consider only the asymptotic limit of in-
a single quantum system can always be re-
finitely many runs where each run is assumed to be
produced with classical randomness, device-
independent and identically distributed (i.i.d.) ac-
independencerequiresaloophole-freeviolation
cording to some strategy of Eve. Corrections due
of a Bell inequality. Specifically, it is crucial
to finite samples, and extension to non-i.i.d. scenar-
to close the detection loophole, while the no-
ios can in principle be done with the techniques in
signaling condition may be justified in other
[28, 44, 45].
ways than by arranging spacelike separation.
Inanycase,Alicemayactuallyholdbothmea-
surement devices in her lab. Nevertheless, for
III. COMPUTING RANDOMNESS FOR
convenience we shall speak of Alice and Bob
DIFFERENT LEVELS OF
when it comes to device-independence. We
CHARACTERIZATION
also note that, as it happens for measurement
independence,thestrictno-signalingcondition
A. Definitions and notation
maybepartiallyrelaxed,butwedon’tconsider
this relaxation in this paper [37].
Let us introduce the basic notions to study ran-
• One can define intermediate levels of charac- domness (cf. [46]). The authorized party can in-
terization, collectively known as semi-device- put z ∈ {1,...,m} in the box and obtain output
independent. For instance, in the con- c∈{1,...,d} (see Fig. 1). In the asymptotic limit of
text of quantum cryptography, the idea infinitely many runs, she can reconstruct the statis-
of measurement-device-independence has been tics P(c|z). This statistical distribution may reflect
put forward after noting that hacking usually either accidental randomness (due to ignorance of
involves detectors (which are therefore bet- some details of the state or the device) or intrinsic
ter left untrusted) rather than sources (which randomness, due to the unpredictability of the out-
may therefore be trusted) [38]. Other works come of quantum measurements. We are interested
relax the tomographic requirement of perfect in the latter because for Eve, in any of the Classes
4
defined above, there is no accidental randomness. Now we are going to explain how randomness
In this section, the states |ψ(cid:105) or ρ refer to every- can be computed in each of the three levels of
thing that is in the box, so that the measurements characterization of our concern. For the device-
can be assumed to be projective. When the box independent level of characterization, randomness
is fully characterized, it becomes possible to distin- generation against a Class Ia Eve have been pre-
guish between the system and a possible ancilla, i.e. sented in [41, 48], so we don’t repeat this here.
to discuss the case of POVMs as distinct. We do
this in section VB.
Ifthestateispure,thereisnoaccidentalrandom- B. Tomography level of characterization
ness for von Neumann measurements. Then, the
randomness of c obtained from a given z is quanti- For the case of tomography level of characteriza-
fiedbytheprobabilityG(|ψ(cid:105),z)ofguessingtheout- tion,weareonagroundfamiliarformostphysicists.
come correctly. Since the best strategy for guessing
Ifaqubitispreparedinthestate|+z(cid:105),tosaythata
istoguessthemostprobableoutcome,thisguessing
measurement of σ provides a perfect random bit is
x
probability is
justarephrasingofelementarytextbookknowledge.
The example of a qubit prepared in the maximally
G(|ψ(cid:105),z)=maxP(c|z,|ψ(cid:105)). (1)
c mixedstate1/2isonlyslightlymoreinvolved: then,
a measurement of a single observable (say) σ does
If the state shared by Alice and Bob is mixed, we x
not guarantee any randomness, because the state
have to separate the intrinsic randomness from the
may have been prepared by mixing eigenstates of
accidental one. For measurement z, the average
that operator, in which case Eve would have full
guessing probability that quantifies intrinsic ran-
knowledge of the outcome of each run. However,
domness is then given by
theuncertaintyrelationsprovideawayaroundit: if
in each run Alice can choose to measure either σ
G(ρ,z)= max q G(|ψ (cid:105),z), (2) x
{qλ,ψλ}(cid:88)λ λ λ tohreσrezf,onreotphreerpeairsartaionndocmannebsesawnitheigreesnpsteacttetoofEbvoetahs,
where ρ = q |ψ (cid:105)(cid:104)ψ |, and the maximization is long as she does not hold a purification (see [49] for
λ λ λ λ
taken over all possible such decompositions. how uncertainty relations must be modified if Eve
For the d(cid:80)evice-independent level of characteriza- does hold a purification).
tion, Alice cannot write down a quantum state but Now we provide a general recipe to compute the
needs to use only the observed probability distribu- intrinsic randomness for projective measurements;
tion P. Then the guessing probability that quanti- the case of POVMs will be discussed in paragraph
fies intrinsic randomness is VB.
Sincethestateρcanbereconstructedandisthere-
G(P,z)= max G(ρ,z), (3) fore part of the observed data, we need to perform
(ρ,M)→P
the maximization of Eq. (2). In the decomposition,
where the maximization is taken over all quantum it is not a priori obvious how many quantum states
states ρ and measurements M compatible with the |ψλ(cid:105) are to be considered. Fortunately, the argu-
probability distribution P. ment used in [41] can be transposed directly from
Inallthesecases,thenumberofrandombitsthat probability distributions to density matrices. In a
can be extracted per run is quantified by the min- nutshell, all the lambdas for which the inner max-
entropy imization is achieved by the same argument c can
be grouped together into a unique lambda (which is
Hmin(G)=−log2G. (4) relabeled as c). Thus, it is sufficient to consider one
state per outcome.
Finally, one may consider extracting randomness
Therefore, for a projective measurement M ≡
out of several settings, rather than a single one. If
{Π ,c=1,...,d} with d outcomes, one has to solve
c
Eveisallowedtokeepapurificationofthestate[sub-
classes (b)], upon learning which settings have been
G(ρ,M)=max Tr ρ Π (5)
used in a given run, she may be able to steer the {ρc} c c c
state to the decomposition that maximizes (2) for (cid:88) (cid:2) (cid:3)
those settings [47]. If Eve does not hold a purifica- under the constraints that ρ = ρ , ρ ≥ 0. Like
c c c
tion [subclasses (a)], however, using several settings in the case of device-independence, this maximiza-
is known to be advantageous [41]. tion is a semi-definite program ((cid:80)SDP), the only dif-
5
ference being that the matrix that must be posi- withA ={Πx}andB ={Πy}denotingAliceand
x a y b
tive is the quantum state itself, not a matrix of mo- Bob’slocalmeasurements. Theguessingprobability
mentaoftheobservedstatistics. Moreover, herethe is analog to (3) and given by
SDP solves the problem of interest directly, rather
G(P,z)= max G(ρ,A ,B )
than a relaxation thereof. Given the tomography x y
(ρ,Ax,By)→P
levelofcharacterization, Alicecanchoosetoextract
= max P (c|z) (9)
randomnessfromany measurement,andwillchoose c
that for which the guessing probability in (5) is the (ρc,Ax,By)→P(cid:88)c
lowest. Hence, for a given state ρ, where ρ = cρc, and Pc(a,b|x,y) = Tr(ρcΠxa ⊗
Πy). The constraints for the optimization are the
G(ρ)=minG(ρ,M) [one measurement]. (6) obbserved sta(cid:80)tistics P(a,b|x,y), and the knowledge
M
of the state and measurements on Bob’s side.
Further, when Eve is not allowed to hold a purifica- Such optimization is very similar to the one used
tion, it may be advantageous to extract randomness for the device-independent level of characterization
from more measurements. If setting Mz is chosen in [41, 48], where one can use the hierarchy intro-
with probability qz, the average guessing probabil- duced in [52] to provide upper bounds. In that
ity will be case, from the set of local measurements and de-
pending on the hierarchy’s level, one forms a cer-
m
G(ρ,{Mz}z)=m{ρaCx} C z=1qzTr ρCΠzcz tuaeisnwmitahtriρxcΓocfwphroodseucetlsemoefnotpsearraetoerxspoecfttahtieonfovrmal-:
(cid:88)(cid:88) (cid:2) (cid:3) (cid:104)M ⊗1(cid:105),(cid:104)1⊗M (cid:105),(cid:104)M ⊗M (cid:105),(cid:104)M M(cid:48) ⊗1(cid:105),(cid:104)1⊗
=max Tr ρCMC , (7) M AM(cid:48) (cid:105), (cid:104)M MB(cid:48) ⊗MAM(cid:48) (cid:105)B, etc, wAherAe M ,M(cid:48) ,
{ρC}(cid:88)C (cid:2) (cid:3) anBd MBB,MB(cid:48)AareAoperaBtorsBfrom the set of AAliceA’s
wherewehavedenotedM = m q Πz ;thecon- and Bob’s local measurements (union the identity),
straints are as above, andCnow Cz==1 (zc ,czc ,...,c ), respectively (see [52] for a detailed description of
1 2 m
so the maximization now invo(cid:80)lves a decomposition this matrix). Some elements of Γc are related to
on dm states. The fact that Eve cannot steer Al- the Pc(a,b|x,y) mentioned above, while others are
ice’s mixture is explicit in that the decomposition extra unknown variables in the optimization. By
ρ = CρC is independent of z. As above, Alice constraining Γc to be positive semi-definite and the
is allowed to choose the set of measurements that sum over c of Pc(a,b|x,y) to be the observed statis-
minim(cid:80)izes the guessing probability, so tics, one can bound the guessing probability in the
device-independent level of characterization.
G(ρ)= min G(ρ,{Mz}) [more measurements].(8) Nowintheone-sideddevice-independentcase, we
{Mz} impose further constraints on the elements of Γ
c
Notice that unlike the optimization (7) which is an based on the knowledge of Bob’s measurements.
SDP, this last optimization over the choices of mea- Namely, we use the algebraic relations satisfied by
surement settings is not a SDP. these operators to constraint the moments of Γc
which involve them. For instance, if B = (B +
√ 3 1
B )/ 2 or B B = −B B , the relations (cid:104)OB (cid:105) =
2 1 2 √ 2 1 3
C. One-sided device-independent level of ((cid:104)OB (cid:105)+(cid:104)OB (cid:105))/ 2or(cid:104)OB B (cid:105)=−(cid:104)OB B (cid:105)are
1 2 1 2 2 1
characterization imposed for all product of operators O. This re-
duces the number of independent variables in the
The one-sided device-independent level of charac- optimization. Theserelationsareimposedoneachc
terization, to our knowledge, has never been consid- in (9), as they should hold for each of the ρ in the
c
ered before in the context of randomness. The sce- decomposition. Notethatwedonotdirectlyusethe
narioisverysimilartosteering[50,51]: thesetupis knowledge of Bob’s local state to further constraint
actuallythesame,butthefigureofmeritisdifferent. the optimization. We thus obtain an upper bound
Indeed,insteadofhavingAlicetoconvinceBobthat on the guessing probability.
shecansteerhisstate,wejustletthemperformtheir Just like in the other levels of characterization,
measurements locally and ask whether randomness onecouldconsiderextractingrandomnessfrommore
can be extracted from their outcomes. than one measurement here, if Eve does not hold a
Like before, we consider first the amount of ran- purificationofthemeasuredstate. Theoptimization
dom bits that can be extracted from the outcomes problem can be set up in a manner analogous to
c=(a,b)ofasinglepairofmeasurementsz =(x,y) what we have been considering.
6
IV. COMPARISON OF THE YIELDS OF
THREE LEVELS OF CHARACTERIZATION 2
1.8 Tomography
One−sided device−independent
Inordertocomparetheyieldsofthevariouslevels 1.6 Device−independent
of characterization, we need a common set of data. 1.4
We assume that the data come from measuring a
1.2
two-qubit Werner state ρ = V|Φ+(cid:105)(cid:104)Φ+| + (1 −
V)1/4; Alice measures eithVer A = σ or A = σ , Hmin 1
1 x 2 z
Bob measures one of the four B1 = σx, B2 =√σz, 0.8
B3 = σ+ or B4 = σ− with σ± = (σx ± σz)/ 2. 0.6
These measurements can lead to non-trivial assess-
0.4
ment for all the level of characterization we are in-
0.2
terestedin. Indeed, (A ,A ;B ,B )canbeusedfor
1 2 1 2
partialtomographyandidentify|Φ+(cid:105)uniquelywhen 0
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
V =1; for device-independence, (A ,A ;B ,B ) vi- Visibility
1 2√ 3 4
olate the CHSH inequality for V > 1/ 2 and cer-
√
tify |Φ+(cid:105) for V = 1 because CHSH = 2 2 [53]; for FIG.2. AmountofrandomnessextractedHmin fromthe
one-sided device-independence, a similar argument outcomes of the setting pair A2,B1 from three different
levels of characterizations.
holds for (A ,A ;B ,B ) and the steering inequal-
1 2 1 2
ity S defined in [54]. Anyway, in what follows, the
2
amountofrandomnessiscomputeddirectlyfromthe
is certified from an optimal violation of the CHSH
observed statistics, without processing them into a
inequality
specific tomography protocol or inequality.
As mentioned before, we focus on the random- CHSH=(cid:104)A B (cid:105)+(cid:104)A B (cid:105)+(cid:104)A B (cid:105)−(cid:104)A B (cid:105)≤2
1 1 1 2 2 1 2 2
ness generated by a single pair of setting. In the (10)
device-independent case, we bound the amount of withthesamestate,andfromaoptimalviolationof
random bits using the second level of the hierar- a modified CHSH inequality
chy [52], as described in (3) (see [41, 48] for more
CHSH =(cid:104)A B (cid:105)+(cid:104)A B (cid:105)+(cid:104)A B (cid:105)
details). For the one-sided device-independent case, 3 1 1 1 2 2 1
we use the method described in section IIIC at the −(cid:104)A2B2(cid:105)+(cid:104)A1B3(cid:105)≤3. (11)
same level of the hierarchy, together with the al-
Theselasttwocomputationsareperformedbyfixing
gebraic relations generated by Bob’s measurements
√ √ the value of the inequality rather than the value of
(includingB =(B +B )/ 2,B =(B −B )/ 2,
3 1 2 4 1 2 the correlations in the corresponding SDP. The re-
B B = −B B , B B = −B B , etc.). Finally,
1 2 2 1 3 4 4 3 sult is shown in Fig. 3: 2 bits of randomness can be
for tomography characterization, we compute the
extracted indeed from CHSH when the pair of per-
amount of randomness based on (7), as explained 3
fectly uncorrelated measurements Z ,X are used.
in section IIIB. A B
However, no such measurements are available when
The main result we obtained for three different
CHSH is maximally violated.
levels of characterization is shown in Fig. 2. As ex-
NotealsothatinFig.2and3,randomnesscanbe
pected, for any visibility V the amount of random- extracted in the device-independent case only pro-
ness increases with the level of characterization of
vided that a Bell inequality is violated, i.e. when
√ √
the devices, with the tomographic level giving the
V < 1/ 2 for CHSH and V = 3/(2 2+1) ≈ 0.78
largest amount of randomness.
forCHSH . Inother words, norandomness is found
3
Note that for all three different levels of charac- when a local hiddenvariable modelcanproduce the
terization, two bits of randomness can be extracted observed correlations.
when V =1. In the device-independent case, this is In the one-sided device-independent case, how-
more randomness than the ∼ 1.23 bits that can be ever, randomness can be extracted from all Werner
certifiedfromthemaximalviolationoftheCHSHin- state, except the completely mixed state. Yet, it is
equality [7]. To understand this difference, we com- knownthatWernerstatesarenon-steerableforV ≤
paretheamountofrandomnessthatcanbecertified 0.5 [50], i.e. such states admit a Local Hidden State
in this scenario from different constraints. (LHS) model. Thus, our result shows that one can
Namely, we consider the randomness that can be certify randomness in one-sided device-independent
certified from the correlations above, the one that context even in presence of a LHS model.
7
ρ = 1/2, against an adversary of Class I(a). We
2 recover known results on uncertainty relations and
1.8 CHSH shownumericalevidenceformoregeneralsituations.
Modified CHSH AsmentionedatthebeginningofparagraphIIIB,
1.6 Full Probability
forasinglemeasurement[Eq.(6)]onehasG(1/2)=
1.4 0: for whatever measurement being performed be-
ingperformed,themixturemayhavebeenprepared
1.2
by mixing the two eigenstates of the measurement
Hmin 1 and this information could be available to Eve. So
0.8 to bound the guessing capability of Eve, we need
to consider more than one measurements. We thus
0.6
refer to Eqs (7) and (8) from now onwards.
0.4 Letusdenote{M } theN projectivemea-
k k=1,...,N
0.2 surements: foranystringofvaluesC =(c1,...,cN)∈
{−1,+1}N, the effective measurement operator is
0
0.65 0.7 0.75 0.8 0.85 0.9 0.95 1
Visibility 1+(cid:126)n ·(cid:126)σ N
M = C with (cid:126)n = q c (cid:126)n .(12)
C 2 C k k k
FIG. 3. The amount of randomness computed with dif- k(cid:88)=1
ferent constraints: CHSH, CHSH3, and full observed With this notation, we have
statistics. H ofCHSHcorrespondstothesettingpair
min
A2,B3, while others correspond to A2,B1. G(1/2,{M })= 1+maxC|(cid:126)nC| . (13)
k 2
This can be understood by the fact that a local Indeed, the r.h.s. is obviously an upper bound,
hidden state model only ascribes fixed outcomes to since it is the largest of the eigenvalues; and
themeasurementofoneparty. Theotherone,Bobin it can be achieved by the decomposition 1/2 =
ourcase,receivesaquantumstatetomeasure. How- 21|+(cid:126)nC¯(cid:105)(cid:104)+(cid:126)nC¯|+ 12|−(cid:126)nC¯(cid:105)(cid:104)−(cid:126)nC¯| where C¯ is defined
ever, Bob enjoys in this context a tomographic level by |(cid:126)nC¯| = maxC|(cid:126)nC|. Finally, we are allowed to
of characterization of his system. He can thus al- choose the N most favorable measurements, i.e.
waysextractsomerandomnessfromthisstate. This Eq. (8) becomes G(1/2,N)= 1+2gN for
is the case unless all the quantum states given to
g ≡ min max|(cid:126)n |. (14)
Bob can all be chosen in the same basis, as possible N {Mk,qk} C C
when V =0.
Now, since |(cid:126)n |=1, we have
NotethatrandomnesscanbeextractedforallV > k
0thienrtahnedtoommnoegsrsaaplhsiocdleisvaeplpoefatrrsustthearsewwehlle.nHVow=eve0r, |(cid:126)nC|2 = qk2+ (ckqk(cid:126)nk)·(ck(cid:48)qk(cid:48)(cid:126)nk(cid:48)).(15)
k k(cid:54)=k(cid:48)
i.e. whentheWernerstateiswhitenoise. Inthenext (cid:88) (cid:88)
section,wediscusshowrandomnesscanbeextracted Notice that the second term can always be made
from the white noise by using several measurement non-negative by the maximization over C. Indeed,
settings. it follows from
(ckqk(cid:126)nk)·(ck(cid:48)qk(cid:48)(cid:126)nk(cid:48))=0 (16)
V. MORE RESULTS ON THE c1(cid:88),...,cNk(cid:88)(cid:54)=k(cid:48)
TOMOGRAPHIC LEVEL OF that maxC k(cid:54)=k(cid:48)(ckqk(cid:126)nk)·(ck(cid:48)qk(cid:48)(cid:126)nk(cid:48)) ≥ 0. There-
CHARACTERIZATION fore,intheminimization,thebestchoicewouldcon-
sist in choo(cid:80)sing all the vectors mutually orthogonal,
A. Randomness from single-qubit white noise but this is possible only for N = 2,3. In these
and uncertainty relations cases, iti√ssimpletofinishtheoptimiz√ation: wefind
g = 1/ 2 ≈ 0.7071 and g = 1/ 3 ≈ 0.5774.
2 3
Notice that, translated in min-entropy, the case
Among the many possible illustrations of ran-
domness in the tomographic level of characteriza- for N = 2 bound saturates the uncertainty rela-
tion for two min-entropies, Eq. (9) of [55], namely
tion, we consider the case of randomness extraction
√
from a single qubit in the maximally mixed state H (σ )+H (σ )≥log(1+1/ 2).
min z min x 2
8
To go further, we resort to numerical optimiza- bound. In particular, we can choose
tion to obtain upper bounds on g . For N = 4,
N
the optimal choice of measurements is found to be ρ = Πc , q = Tr Πc (18)
{(σ ,1−3q),(σ ,q),(σ ,q),(−σ ,q)}wherethevec- c Tr Π c d
z 1 2 3 c (cid:2)s (cid:3)
tors (cid:126)n are 120 degrees apart from each other in
1,2,3
thex−yplane;knowingthisgeometry,onecanfinish which indeed gives (cid:2) cq(cid:3)cρc =1/ds. Then
the optimization analytically to find g = 4/13≈
4 G(1/d(cid:80),{Π })
0.5547 for q =3/13. For N =5 and N =6, we find s c
g5 ≈ 0.5422 and g6 ≈ 0.5270. This trend(cid:112)suggests ≥ n Tr Πc Tr Πc Π
tthhaatt,twhhisenwoNuld→b∞e ,thoenecahsaesigfNth→e o12p;tiwmealchcehcokiecde (cid:88)c=1 d(cid:2)s (cid:3) (cid:20)Tr[Πc] c(cid:21)
would consist in spreading the (cid:126)nk uniformly in the = n 1 Tr Π2 . (19)
half-sphere. d c
c=1 s
(cid:88) (cid:2) (cid:3)
EachΠ canbewrittenasitsspectraldecomposition
c
B. Randomness from POVMs rc
Π = µ |k (cid:105)(cid:104)k | (20)
c c,k c c
As we have just seen and also mentioned in para- k(cid:88)=1
graph IIIB, no randomness can be extracted from where r = rank(Π ) and µ are the eigenvalues
c c c,k
a single projective measurement on the maximally of Π , with |k (cid:105)(cid:104)k | to be the corresponding projec-
c c c
mixed state, because Eve may know the decom- tor. Substituting the spectral decomposition into
position in the eigenvalues of that measurement. Eq. (19) gives
The reasoning does not seem to apply to POVMs,
though: even knowing a pure state, in general Eve n 1 1 n rc
Tr Π2 = µ2 (21)
cannot guess with certainty the outcome of a non- d c d c,k
projective POVM. Is it therefore possible to extract (cid:88)c=1 s (cid:2) (cid:3) s (cid:88)c=1k(cid:88)=1
randomness from a single POVM on the maximally But using the Cauchy-Schwarz inequality, we have
mixed state? The answer is, yes, but the origin of
the randomness makes the problem trivial. Indeed, n rc n rc n rc 2
µ2 12 ≥ µ
because of Neumark’s theorem, a POVM is noth- k,c c,k
ing else than a projective measurement on the sys- (cid:20)(cid:88)c=1k(cid:88)=1 (cid:21)(cid:20)(cid:88)c=1k(cid:88)=1 (cid:21) (cid:20)(cid:88)c=1k(cid:88)=1 (cid:21)
tem and some additional degrees of freedom. We that is,
are going to show that a POVM on the maximally
mixed state cannot provide more randomness than n rc d2
µ2 ≥ s , (22)
that present in the ancilla — thence it is pointless c,k n r
toperformthePOVMforrandomnesspurposes,one (cid:88)c=1k(cid:88)=1 c=1 c
could have measured the ancilla directly. because n rc µ = (cid:80)n Tr Π = d . By
c=1 k=1 c,k c=1 k s
To see this, let us first denote the system’s di- substituting this inequality into Eq. (21), we find
mensions by d . The n-outcomes POVM elemenets finally th(cid:80)e foll(cid:80)owing lower (cid:80)bound on(cid:0) th(cid:1)e guessing
s
are written as {Πc}c=1,...,n. Given that the state we probability:
have is white noise, the probability for Eve to guess
the outcomes correctly is G(1/d ,{Π })≥ ds (23)
s c n r
c=1 c
G(1/d ,{Π })
s c that is, the upper bound on th(cid:80)e min-entropy
n
= max q Tr ρ Π (17)
c c c H (1/d ,{Π })≤log( r )−logd . (24)
{qc,|ψc(cid:105)}c=1 min s c c s
(cid:88) (cid:2) (cid:3) c
(cid:88)
where 1/d = q ρ and, as previously, ρ InthetensorproductimplementationofthePOVM,
s c c c c
groups all the states in the decomposition for which which uses an ancilla of dimension d , we have
a
maxc(cid:48)Tr[ρΠc(cid:48)] = (cid:80)Tr[ρΠc]. Since the maximization crc = dsda; whence the maximum min-entropy
in Equation (17) is taken over all possible decompo- is logd , which comes solely from the ancilla. In
a
sition, any specific decomposition provides a lower (cid:80)the direct sum implementation, r = d +d is
c c s h
(cid:80)
9
theminimumtotaldimension(system+hiddensub- one should ignore the atom and extract randomness
space) required to implement the POVM [56]: since directly from the laser. For yet other pointer mea-
log(d + d ) ≤ logd + logd , the min-entropy is surements, it may not even be feasible to measure
s h s h
upper bounded by logd . In both cases, we have the pointer in a complementary basis (certainly it
h
proved our claim: all the randomness that can be would be challenging for the Stern-Gerlach setup).
obtained in a POVM on the maximally mixed state It is not our aim to propose concrete schemes to
canbeascribedtotheadditionaldegreesoffreedom extractrandomnessatthetomographylevelofchar-
used to implement the POVM. Finally notice that, acterization. Rather,thebottom-linemessagecould
as far as our proof goes, this conclusion applies only beputthisway: wheneveraquantumdegreeoffree-
when the system is in the maximally mixed state: dom is measured by coupling it to a pointer, the
it remains an open problem whether, in other cases, pointer is usually in a well-defined quantum state.
POVMsmayextractmorerandomnessfromthesys- So, if the goal is to extract randomness, it is worth
tem than projective measurements. considering the possibility of getting it directly from
the pointer.
C. Randomness from pointer measurements
VI. CONCLUSION
The previous observation on POVMs extends to
another case in which additional degrees of freedom
In this work, we have quantified the randomness
are used: that of measurement by coupling the rele-
that can be extracted from a given quantum de-
vantdegreeoffreedomtoapointer. Thebestknown
vice with the device-independent, one-sided device-
textbook example is the Stern-Gerlach experiment.
independent, and tomographic level of characteriza-
More common nowadays is the measurement of the
tion. Specific tools were introduced to perform this
polarization of a photon: thephotonissentonapo-
quantification in the one-sided device-independent
larizing beam-splitter (PBS), the two output ports
and tomographic cases. For the latter, we have also
of which are correlated with orthogonal polariza-
shownthatnotallconceivableprocedurestoextract
tions. It is by detecting in which beam the photon
randomness are actually relevant: in particular one
is(pointer)thatpolarizationisinferred. Now,ifone
must be careful whenever ancillas are involved since
sets up an experiment to extract randomness from
the randomness may just come from them rather
the polarization qubit [57, 58], the same setup pro-
than from the system under study. We have fo-
videsanotherdegreeoffreedom,whosestatemustbe
cusedontheminimalclassofadversarialpower,rele-
very close to pure if the measurement has to make
vant for the study of implementations performed by
sense at all: indeed, the beam must come from a
trusted experimentalists; a similar study could be
well-defined direction for the PBS to work as ex-
conducted for randomness extraction against more
pected. Thence, in principle one can extract more
powerful adversaries.
randomnessbyignoringpolarizationandsendingthe
photononanormalbeam-splitter[59,60]. Westress
that this argument bears on the amount of random-
nessandonsimplicity“onpaper”: polarizationmay ACKNOWLEDGMENT
be preferable to deal with other practical concerns
[57]. This work is funded by the Singapore Ministry of
Forotherqubits,thingsmaybemoresubtle. Con- Education (partly through the Academic Research
sider for instance the probing of an atomic qubit Fund Tier 3 MOE2012-T3-1-009) and by the Singa-
withalaserbeam: alaserbeamalonecanbeusedto pore National Research Foundation. We thank two
generaterandomness[61],butwithadifferentdetec- anonymousrefereesforusefulcommentsthatleadto
tionschemethantheoneusedinprobingatomicex- improving the structure of the paper, and Gonzalo
citations;soitmaynotbeimmediatetosuggestthat de la Torre for discussions.
[1] J. S. Bell, Physics (Long Island City, N.Y.) 1, 195 [2] V. Scarani and N. Gisin, Physical Review A 65,
(1964). 012311 (2002).
10