Optimal randomness certification in the quantum steering and prepare-and-measure scenarios

Quantum mechanics predicts the existence of intrinsically random processes. Contrary to classical randomness, this lack of predictability can not be attributed to ignorance or lack of control. Here we find the optimal method to quantify the amount of local or global randomness that can be extracted in two scenarios: (i) the quantum steering scenario, where two parties measure a bipartite system in an unknown state but one of them does not trust his measurement apparatus, and (ii) the prepare-and-measure scenario, where additionally the quantum state is known. We use our methods to compute the maximal amount of local and global randomness that can be certified by measuring systems subject to noise and losses and show that local randomness can be certified from a single measurement if and only if the detectors used in the test have detection efficiency higher than 50%.

Quantum mechanics predicts the existence of intrinsically random processes. Contrary to classical randomness, this lack of predictability can not be attributed to ignorance or lack of control. Here we propose a method to quantify the amount of randomness that can be extracted in two scenarios: (i) the quantum steering scenario, where two parties measure a bipartite system in an unknown state but one of them does not trust his measurement apparatus, and (ii) the prepare-and-measure scenario, where additionally the quantum state is known. We use our methods to compute the maximal amount of local randomness that can be certified by measuring systems subject to noise and losses and show that randomness can be certified from a single measurement if and only if the detectors used in the test have detection efficiency higher than 50%.
One of the most distinct features of quantum mechanics is its intrinsically random character. While in classical mechanics lack of predictability can always be associated to ignorance or lack of control of the probed systems, the rules of quantum physics say that one can not predict the outcome of a measurement even if all the variables of a system are known. This inherent unpredictability has been exploited in different applications such as quantum random number generation [1] and quantum key distribution [2].
Recent results have shown that the randomness observed in quantum mechanics can be certified even without relying on any modelling of the quantum devices used for the generation of the random data. In fact, by analysing the data obtained in experiments involving local measurements on bipartite entangled systems one can prove that no one could have predicted this data in advance whenever a Bell inequality violation is observed [3,4]. This is called device-independent randomness certification [5,6]. The device-independent approach has the practical advantage that it does not rely on the exact description of the experimental set-up. This is crucial when implementing cryptographic protocols as an adversary can use a mismatch between the theoretical description and the actual implementation of the set-up to fake its performance [7][8][9]. However, deviceindependent protocols require and low levels of noise [4], which make them very demanding experimentally.
An intermediate scenario is that of quantum steering [11,12]. It refers to the case where two parties, say Alice and Bob, apply local measurements on an unknown bipartite system. While one of them, Bob, has complete knowledge of his measurement apparatuses, Alice does not, and treats her measuring device as a black box with classical inputs and outputs. Quantum steering has been receiving lot of attention recently due to the fact that it allows for entanglement detection which is more robust to noise and experimental imperfections than Bell nonlocality [12,13]. Moreover, quantum steering was shown to be useful for one-sided device independent quantum key distribution [14] and randomness certification [15]. Several experimental groups have recently observed steering, including in continuous-variable systems [16,17], using Bell local states [18], using inefficient [19][20][21], asymmetric states [22], and multipartite systems [23][24][25].
The main result of our paper is a general method that quantifies the optimal amount of randomness can be certified from a single measurement in a steering experiment. We use this method to show that randomness can be certified provided that the detectors used have efficiency higher than 50%. Our method can be seen as the generalisation of the ideas of [26,27] from the deviceindependent scenario to the semi-device-independent scenario. We compare the results obtained there compared to those obtained here, in terms of the amount of randomness that can be obtained by measuring systems subjected to white noise, and find substantial benefits can be obtained in the present setting.
There are several motivations to quantify the amount of randomness in the steering scenario. From a fundamental point of view, it is important to understand how much randomness can be maintained if we give up partial information about the specific description of the systems [15,28,29]. From a practical point of view, the amount of randomness obtained in the steering scenario gives an upper bound to what Alice and Bob would obtain in a fully device-independent setting, regardless of the number of measurements Bob would apply. Furthermore, it is a scenario that appears naturally in some asymmetric applications. For instance the present results give a way of quantifying the amount of randomness in remote untrusted stations. This is relevant, for instance, when the provider of a quantum-random-number generator wants to remotely check if the devices they provided are still functioning properly.

STEERING AND RANDOMNESS
The scenario we treat in this work is the following [12]: two parties, Alice and Bob, are located in distant laboratories and receive a bipartite system from a source. One of the two parties, say Alice, does not trust her measuring devices, which are treated as "black boxes". She can, nevertheless, choose which measurement to perform, which she labels by x ∈ {0, . . . , m A − 1}, each of which provides an outcomes, which she labels a ∈ {0, . . . , n A − 1}. The other party, Bob, has complete knowledge of his device, which allows him to perform quantum state tomography on his part of the system, and thus to obtain a complete description of his subsystem. The states reconstructed by Bob will usually depend on Alice's input and ρ AB is the unknown state shared with Alice, P (a|x) is the probability that Alice observes outcome a given she chose x, and M a|x is the corresponding (unknown) element of Alice's measurement. The set of unnormalized an assemblage and can be completely determined by Bob through tomographic measurements.
As noticed in [12], Bob can determine if ρ AB is entangled by looking at the form of the assemblage {σ a|x } a,x . This is because separable states can only lead to assemblages with the specific form where λ is a hidden variable distributed according to q(λ), which determines both Alice's response P (a|x, λ), and the states sent to Bob, σ λ . Assemblages of this form are said to have a Local Hidden State (LHS) model and can be detected through the violation of a steering inequality [30] (similar to a Bell inequality or an entanglement witness) or a simple semi-definite program [31]. It turns out that the confirmation of steering not only guarantees that the shared state is entangled, but also that Alice is performing incompatible measurements [32,33]. It is thus very intuitive to expect a relation between steering and randomness: first, the correlations (entanglement) shared between Alice and Bob allows Bob to certify steering, and consequently the incompatibility of Alice's measurements. Second, since Alice's measurements are incompatible not all the outcomes she receives are predictable, and thus random.

RANDOMNESS CERTIFICATION
In order to certify the randomness of Alice's outcomes we work in the adversarial scenario, where a potential eavesdropper, Eve, wants to predict them. This framework is relevant for cryptographic tasks, namely for the so-called one-sided device-independent quantum key distribution (1SDIQKD). In the most general case, we do not make any assumption on Alice's measurement device, so that it could even have been provided by Eve. We also consider that the state ρ AB is the reduced state of a tripartite entangled state ρ ABE shared by Alice, Bob and Eve, i.e. ρ AB = Tr E [ρ ABE ]. Hence, by applying measurements to her subsystem Eve can in principle obtain information about Alice's outcome.
Here we will focus exclusively on the case where Alice and Bob want to extract randomness from the outcomes of a single given measurement of Alice, let us say x * ∈ {0, . . . , m A − 1}. We focus on this case since it is the most relevant one from the perspective of 1SDIQKD. We assume that Eve also knows from which measurement x * Alice is going to extract randomness, so she can optimise her attack to obtain information about this measurement setting. The figure of merit we use to evaluate the amount of randomness in Alice's outcomes is the probability that Eve can correctly guess the outcome a of the measurement x * of Alice. This quantity, denoting Eve's guessing probability P guess (x * ), is given by the probability that Eve's guess e is equal to a whenever Alice measures x * : Randomness is certified whenever the guessing probability is strictly less than 1, in which case Eve can not predict Alice's outcome with certainty. After Alice and Eve have applied their measurements the assemblage prepared will be where M e is the element of Eve's (optimal) measurement which yields outcome e ∈ {0, . . . , n A −1}. However, since Alice and Bob do not have access to Eve's outcomes the assemblage they will reconstruct will be given by In order to compute the optimal strategy for Eve we need to maximise her guessing probability (for a given input x * of Alice), over all strategies. Naively, this would appear to constitute optimising the triple {ρ ABE , M a|x , M e }, of state, measurements for Alice, and measurement for Eve, a non-linear optimisation problem. However, just as in the device-independent case [26,27], we can instead replace this by an equivalent linear optimisation over all physical assemblages {σ e a|x } a,e,x that are compatible with the no-signalling principle and the observed assemblage {σ obs a|x } a,x . More precisely, the maximisation problem can be formulated as the following semidefinite programme (SDP) [34]: In the objective function we used P E (e)P A (a|x, e) = P (ae|x) = Tr[σ e a|x ] to re-express P guess (x * ). The first constraint assures that the decomposition for Eve is compatible with the assemblage Alice and Bob observe. The second constraint is the non-signalling condition -i.e. Alice cannot signal to Bob and to Eve. The last one is the requirement for every σ e a|x to be a valid (unnormalized) quantum state. We defer to the appendix the full proof that this optimisation problem is equivalent to optimising over states and measurements, which follows from the Gisin-Hughston-Jozsa-Wootters (GHJW) theorem [36] (which shows that all bipartite no-signalling assemblages have quantum realisations), combined with the fact that Eve, making only one measurement, also cannot signal.
Notice that the SDP (5) can be seen as the steering version of the SDP provided in [26,27] which bounds the amount of randomness given an observed nonlocal probability distribution P obs (ab|xy). As mentioned before, the SDP (5) provides an upper bound on the amount of randomness (i.e. a lower bound on the P guess ) that can be found using the SDP of [26,27]. This follows because (5) does not allow Eve to attack the measurements of Bob. Thus, our SDP bounds the maximal amount of randomness that could be obtained if Bob were to perform any number of measurements (that Eve can attack) and compute the randomness based on the obtained probability distribution. The number of random bits is quantified by the min-entropy H min (A|X) = − log 2 P * guess (x * ), where P * guess (x * ) is the result of the maximization (5). In Fig. 2 we plot the amount of randomness certified in the case that Alice applies the two mutually unbiased Pauli spin measurements on a two-qubit Werner state ρ AB = v|Φ + Φ + | + (1 − v)1/4, where |Φ + = (|00 + |11 )/ √ 2, and compare it with the amount of randomness obtained in the case Bob also treats his measuring device as a black box (i.e. the fully deviceindependent case). In Fig. 3 we also compute the amount of randomness that can be obtained by measuring the same spin measurements with detection efficiency η (for visibility v = 1 and v = 0.9), again comparing to the case where Bob treats his measuring device as a black box. As one can see, for v = 1 in the steering scenario randomness can be certified whenever the detection efficiency is higher than 50%, matching the threshold below which no randomness can be obtained [35]. Moreover, we see the due to the much larger detection efficiency for the CHSH inequality (82.8%) the steering scenario offers a significant advantage when using the maximally entangled state over the nonlocality scenario for the en-tire range of visibility which is experimental significant (i.e. v = 0.9 and above).

PREPARE-AND-MEASURE SCENARIO
Up to now we have considered the steering scenario, where Alice and Bob receive an unknown state ρ AB from an untrusted source. It turns out that all of the results discussed so far straightforwardly apply to the case where Bob prepares a known state and sends half of it to Alice. In this case, since the global state ρ AB is known, the assemblages reconstructed by Bob have to come from unknown measurements on this state, This SDP can be understood as the maximisation of Eve's guessing probability over all possible POVM measurements (where the outcome e goes to Eve and the outcome a goes to Alice, that can be applied to the state ρ AB , given the observation of the assemblage {σ obs a|x } a,x .

IMPROVING THE RANDOMNESS EXTRACTION
The SDP code (5) provides a way of quantifying the randomness in Alice's outcomes given the observation of a given assemblage. A natural question is, given a fixed number of measurements for Alice, and a fixed dimension for Bob, what is the best scheme they can implement (i.e. the best choice of state and measurements leading to an assemblage) which allows for the certification of the most randomness.
Here we propose a numerical see-saw method that, starting from an initial amount of certified randomness, seeks for measurement schemes that lead to higher randomness certification.
Every SDP has a dual program, also an SDP, that can be obtained through the theory of Lagrange multipliers [34]. The dual of (5) is given by Tr(F a|x σ obs a|x ) subject to Tr[σ a |x * ] ≤ a,x Tr(F a|x σ a|x ) ∀ a , σ a|x where in the constraint, ∀σ a|x should be understood as for all non-signalling assemblages, i.e. those satisfying a σ a|x = a σ a|x * for all x = x. The solution of this optimisation problem provides an upper bound on the maximal guessing probability P * guess (x * ) given the observed assemblage {σ obs a|x } ax , namely P * guess (x * ) ≤ a,x Tr(F a|x σ obs a|x ). Moreover, it outputs the coefficients F a|x of the optimal steering inequality that gives the best upper bound we can place on P * guess (x * ). Once we have solved the dual problem (7) we can run a second SDP that optimizes the violation of the steering inequality P * guess (x * ) ≤ a,x Tr(F a|x σ a|x ) over all assemblages {σ a|x } ax : Tr a σ a|x * = 1 The solution of this optimization problem provides the assemblage that allows for the certification of the most randomness by the steering inequality provided by the first SDP. Notice that every assemblage satisfying the constraints above has a quantum realization, easily identifiable [36]. At this point, one can perform a see-saw iteration of the two SDPs in order to obtain the optimal steering inequalities and assemblages (i.e. states ρ AB and measurements M a|x ): the SDP (5) (and its dual (7)) gives the best inequality to certify randomness from an assemblage, while the SDP (8) gives the best assemblage for a given steering inequality.
In Fig. 4 we plot the result of this see-saw iteration, starting with a partially entangled state |ψ = cos θ|00 + sin θ|11 and random measurements with η = 1.
Finally, we note that a similar procedure can be carried out using the pre-and-measure SDP (6) and its associated dual. Here, since the state is fixed, this provides a method to certify the optimal amount of randomness for a fixed state prepared by Bob, i.e. an optimal set of measurements for Alice.

CONCLUSIONS
We have presented a method that certifies the amount of randomness that can be extracted in a steering experiment, considering both the case where the source is untrusted and where it is trusted (prepare-and-measure scenario). Our method relies on optimization techniques that quantify the amount of certified randomness and provide the optimal steering inequality for randomness certification. Applying this method to realistic implementations -i.e. in presence of noise and losses -we have shown that for having reliable randomness certification in the steering scenario the detection efficiency has to be higher than 50%. This result is also valid for deviceindependent (DI) randomness certification and, in general, in scenarios with lower level of trust. It implies that the critical detection efficiency for DI randomness certification cannot be better than 50%.
Since randomness certification is of fundamental importance for QKD, the results presented here have a natural application in cryptographyc protocols in which one of the parties has trusted devices but not the other, such as 1SDIQKD.
single measurement (x = x * ) or Alice, is to distribute a state ρ ABE to Alice and Bob (keeping a part for herself) on which she will perform a measurement with POVM elements M e , for e = 0, . . . , m A − 1, and distribute to Alice a set of measuring devices which implement the POVMs with elements M a|x , for x = 0, . . . , n A − 1 and a = 0, . . . , m A − 1. When Eve obtains outcome e from her measurement she will give this as her guess for the outcome of Alice. Thus, the guessing probability of Eve is given by Alice and Bob however can however determine the assemblage σ obs a|x that they hold, (i.e. the set of conditional states prepared for Bob, along with the corresponding probabilities). Thus the optimisation problem we need to solve is given by Here, the first constraint is the consistency with the observed assemblage, the second constraints demand that ρ ABE is a valid quantum state and the third and fourth constraints that the measurements M a|x and M e are valid POVMs. Defining now the joint assemblage for Alice, Bob and Eve, σ e a|x = Tr AE [(M a|x ⊗ 1 B ⊗ M e ) ρ ABE ], (11) it is straightforward to see that all of the constraints appearing in (5) are satisfied whenever the constraints in (5) are satisfied, and that the objective functions match. Thus is is straightforward to see that the optimisation problem (5) is least a relaxation of (10). What we will show now is that they are in fact equivalent optimisation problems by showing that any solution to (5) also implies a solution to (10).
First of all, consider an assemblage σ e a|x satisfying all of the constraints in (5). For a fixed e, we can define p E (e) = a Tr σ e a|x , andσ e a|x = σ e a|x /p E (e). This has the following properties which show that for each e,σ e a|x is a valid assemblage [31]. From the GHJW theorem [36] Clearly this defines a valid state and valid measurements, hence they satisfy the latter constraints of (10). Furthermore, by construction it also satisfies the first consistently constraint, which is straightforwardly verified. In total, we thus conclude that the two optimisation problems are equivalent, since the solution to either one implies a solution to the other, obtaining the same P guess (x * ). We thus focus on the problem (5) which is easier to solve, being SDP optimsation, linear in the optimsation variables σ e a|x .