Self-testing protocols based on the chained Bell inequalities

Self testing is a device-independent technique based on non-local correlations whose aim is to certify the effective uniqueness of the quantum state and measurements needed to produce these correlations. It is known that the maximal violation of some Bell inequalities suffices for this purpose. However, most of the existing self-testing protocols for two devices exploit the well-known Clauser-Horne-Shimony-Holt Bell inequality or modifications of it, and always with two measurements per party. Here, we generalize the previous results by demonstrating that one can construct self-testing protocols based on the chained Bell inequalities, defined for two devices implementing an arbitrary number of two-output measurements. On the one hand, this proves that the quantum state and measurements leading to the maximal violation of the chained Bell inequality are unique. On the other hand, in the limit of a large number of measurements, our approach allows one to self-test the entire plane of measurements spanned by the Pauli matrices X and Z. Our results also imply that the chained Bell inequalities can be used to certify two bits of perfect randomness.


Introduction
In the last decades, it has been proven that nonlocality, besides being very important from a foundational point of view, is also a resource for quantum information applications in the socalled device-independent scenario. There, devices are just seen as "black boxes" producing a classical output, given a classical input. The devices can provide an advantage over classical information processing only when they produce non-local correlations, that is, correlations that violate a Bell inequality and, therefore, cannot be reproduced by shared classical instructions. It is then possible to construct quantum information applications exploiting this device-independent quantum certification based on Bell's theorem. Successful examples are protocols for device-independent randomness generation [1], device-independent quantum key distribution [2] and blind quantum computation [3].
Historically, self-testing can be considered as the first device-independent protocol. Introduced by Mayers and Yao [4], the standard self-testing scenario consists of a classical user who has access to several black boxes, which display some non-local correlations.
The user received these boxes from a provider, who claims that to produce the observed correlations the boxes perform some specific measurements on a given quantum state. The goal of the classical user is to make sure that the boxes work properly, i.e. that they contain the claimed state and perform the claimed measurements. This is especially relevant if the user does not trust the provider or, even if trusted, does not want to rely on the provider's ability to prepare the devices. Self-testing is the procedure that allows for this kind of certification. The self-tested states and measurements can later be used to run a given quantum information protocol, as proposed in [4] for secure key distribution. For many protocols, however, passing through self-testing techniques is not necessary and in fact it is simpler and more efficient to run the protocol directly from the observed correlations, as for example in standard deviceindependent quantum key distribution protocols [2]. Yet, self-testing protocols constitute an important device-independent primitive as they certify the entire description of the quantum setup only from the observed statistics.
As mentioned, the concept of self-testing was introduced by Mayers and Yao in [4], where the procedure to self-test a maximally entangled pair of qubits is described. This protocol was made robust in subsequent works, see [7,11]. In the following years new self-testing protocols for more complicated states such as graph states were described [10], as well as protocols for self-testing more complicated operations, such as entire quantum circuits [11]. A general numerical method for self-testing, known as the SWAP method, was introduced in [12], providing much better estimations of robustness than the analytical proofs. This numerical method can also be used to self-test three-qubit states such as GHZ states [13] and W states [14].
Despite its importance, we lack general techniques to construct and prove self-testing protocols. Most of the existing examples are built from the maximal violation of a Bell inequality. Based on geometrical considerations, see for instance [15,16], one expects that generically there is a unique way, state and measurements, of producing the extremal correlations attaining the maximal quantum violation of a Bell inequality. This is not always the case, but whenever it is, we say that the corresponding Bell inequality is useful for self-testing. Following this approach, it is possible to prove that the state and measurements maximally violating the Clauser-Horne-Shimony-Holt (CHSH) inequality [25] are unique [5,7], and the corresponding state is a maximally entangled two-qubit state. More recently, a self-testing protocol for any two-qubit entangled states has been derived in [20] using the Bell inequalities introduced in [8], and all the self-testing configurations for a maximally entangled state of two qubits using two measurements of two outputs have been identified in [9]. From a general perspective, it is an interesting question to understand which Bell inequalities are useful for self-testing and what are the states and measurements certified by them. But, as seen in the previous discussion, little is known beyond the simple scenario involving two measurements of two outputs.
The main result of this work is to prove that the so-called chained Bell inequalities [24], defined for two devices performing an arbitrary number of measurements of two outputs, are useful for self-testing. Recall that the maximal violation of these inequalities is given by a maximally entangled two-qubit state and measurements equally spaced on an equator of the Bloch sphere [19]. Our results imply that this known violation is unique. Our proof is based on a sum-of-squares (SOS) decomposition of the Bell operator defined by the chained inequalities. The specific form of the SOS decomposition allows us to construct a quantum circuit that acts as a swap-gate, provided that the inequality is maximally violated. It is then proven that the swap-gate circuit correctly isolates the states and measurements that need to be self-tested, that is, those providing the maximal violation.

Self-testing terminology
In this section we define the settings and introduce some self-testing terminology. We consider the standard Bell scenario in which two parties share a quantum state |ψ on which they can perform n measurements, described by the two-outcome operators A i , B i , where i = 1, . . . , n. The shared state and measurements are not trusted and are modelled as black boxes: each of them gets some classical input, which labels the choice of measurement, and produces a classical output, the measurement result. As the dimension is arbitrary, one can restrict the analysis to pure states and projective measurements without any loss of generality. The state |ψ lives in a joint Hilbert space H A ⊗ H B of an unknown dimension. Operators A i (B i ) act on the part of the state living in H A (H B ) , so that operators of different parties commute: can be considered to be projective measurements. In this scenario the parties calculate the joint outcome probabilities that can be described as p(a, b|i, j) = ψ |M a |ψ . The set of joint probabilities for all possible combinations of inputs and outputs is often simply called the set of correlations. The parties can also check whether the probability distribution is non-local, i.e. whether some Bell inequality is violated. A Bell inequality can be written as a linear combination of the observed correlations.
Usually there is a specification of the black boxes, in self-testing terminology named as the reference experiment, and it consists of the state |ψ ∈ H A ⊗ H B and measurements A i , B i in some given Hilbert spaces H A and H B of finite dimension. On the other hand, the term physical experiment is used for the actual state and measurements {|ψ , A i , B i }. The aim of self-testing is to compare the reference and the physical experiment and certify that they are physically equivalent. This means that the physical experiment is the same as the reference experiment up to local unitaries and additional non-relevant degrees of freedom, which are unavoidable, that is: where |ϕ A B describe the local states of the possible additional degrees of freedom of the physical experiment and U AA and U BB are arbitrary local unitaries acting on systems AA and BB . We introduce the product isometry a map that preserves the inner product, but does not have to preserve dimension. Thus we say that a self-testing protocol is successful if there exists a local isometry relating the physical and reference experiment: In self-testing terminology the relation between the physical and the reference experiment described by (2) is called equivalence. Trivially, a necessary condition for equivalence is that the full set of correlations obtained from the black boxes is equal to the set of correlations that one would obtain after applying the reference measurements on the reference state. A weaker necessary condition is to verify that the two sets of correlations lead to the same maximal quantum violation of a given Bell inequality.While in general checking all the correlations provides more information, there are some situations where observing just the maximum quantum value of a Bell inequality has been proven to be sufficient to certify the equivalence between the physical and the reference experiment. This is the approach we follow in this work and prove that the observation of the maximum quantum violation of the chained Bell inequalities suffices for self-testing.

The chained Bell inequality
The chained Bell inequalities were introduced in Refs. [24] to generalize the wellknown Clauser-Horne-Shimony-Holt (CHSH) Bell inequality [25] to a larger number of measurements per party, while keeping the number of outcomes to two. Let us denote by A i and B i (i = 1, . . . , n) the observables of Alice and Bob, respectively, and assume that they all have outcomes ±1. Then, the chained Bell inequality for n inputs reads where we denote A n+1 ≡ −A 1 . Notice that for n = 2 the above formula reproduces the CHSH Bell inequality Importantly, in quantum theory the chained Bell inequality can be violated by Alice and Bob if they perform measurements on an entangled quantum state. To be more precise, let there exist quantum observables A i and B i , i.e., Hermitian operators with eigenvalues ±1 acting on some Hilbert space H of, so far, unspecified dimension, and an entangled state |ψ ∈ H ⊗ H such that ψ|B n |ψ > 2n − 2, where B n stands for the so-called Bell operator where again A n+1 ≡ −A 1 . In particular, it has been shown in Ref. [19] that the maximal quantum violation of the Bell inequality (3) amounts to and it is realized with the maximally entangled state of two qubits and the following measurements where X and Z are the standard Pauli matrices and Fig. 1). For further purposes, let us also introduce the notion of the shifted Bell operator, that is, an operator given by B max n 1 − B n . Since, by the very construction, this operator is positivesemidefinite, then there exist a finite number of operators P i (not necessarily positive) which are functions of the measurements A i and B i such that This decomposition is called a sum-of-squares (SOS) decomposition, in this particular case of the shifted Bell operator. Furthermore, an SOS decomposition in which operators P i contain products of at most n measurement operators is named SOS decomposition of n-th degree. The use of SOS decompositions for self-testing proofs has been previously considered in [21]. Numerically, it is possible to obtain SOS decompositions of various degrees via the Navascues-Pironio-Acin (NPA) hierarchy [18]. In fact, the degree of the SOS decomposition is related to the level of the NPA hierarchy used. The dual of the semi-definite program defined by the n-th level of the NPA hierarchy yields an SOS decomposition of n-th degree. What is important for further considerations is that if |ψ maximally violates the chained Bell inequality, then (B max n 1 − B n )|ψ = 0, which implies that P i |ψ = 0 for every i. In other words, |ψ belongs to the intersection of kernels of the operators P i . This imposes a plethora of conditions on the state and measurements maximally violating the Bell inequality.

Self-testing with the chained Bell inequalities
In this section we prove that with the aid of the chained Bell inequalities one can selftest the presence of the maximally entangled state (7) and identify measurements (8), thus generalizing the results previously obtained for the CHSH Bell inequality in Refs. [5,7,17]. The advantage of our approach over the previous results lies on the fact that in the limit of a large number of measurements, the chained Bell inequality allows one to self-test the entire plane of the Bloch sphere spanned by the Pauli matrices X and Z. Also, our results imply that the maximal quantum violation of the chained Bell inequalities is unique in the sense that there exists only one probability distribution maximally violating them. This makes chained Bell inequalities useful for randomness certification (see [16]). In the context of nonlocal games this result confirms that measuring (8) on a maximally entangled state state (7) is the only way (up to local isometries) to win the odd cycle game with maximal probability; it is known that the probability to win the odd-cycle game in quantum regime is cos 2 (π/4n) [22].

The SOS decompositions
The key ingredient in our proof are the following two SOS decompositions of the shifted Bell operator associated to the chained Bell inequality whose proofs are deferred to Appendix A. We start from the first degree SOS decomposition. Lemma 1. Let {|ψ , A i , B i } be the state and the measurements maximally violating the chained Bell inequality. Then, the corresponding shifted Bell operators admits the following SOS of first degree: where we assume that B n+ j = −B j and B n = −B 0 . The coefficients α i , β i , and γ i are given by and with i = 1, . . . , n − 2.
Note that the above SOS decomposition remains valid if in its second line we omit the sum over j and fix j to be any number from {1, . . . , n}. Also, the transformations A i → B i and B i → A i+1 in the first parenthesis, and B i → A i in the second one lead to the whole family of 2n SOS decompositions. Let us finally mention that that the above SOS decomposition is a particular case of an SOS decomposition for a more general Bell inequality which will be presented in Ref. [23] together with an analytical method used to derive it.
It turns out, however, that none of them is enough for self-testing. In fact, we need the following second degree SOS decomposition.
be the state and the measurements maximally violating the chained Bell inequality. Then, the corresponding shifted Bell operator admits the following second-order SOS: where we again used the notation A n+1 = −A 1 and A 0 = −A n and the same for B's, and the α i , β i and γ i are given in Eqs. (11), (12) and (13).
Similarly we can construct another SOS decomposition from the above one by applying the following transformations to it: A i → B i in all terms, B i → A i+1 in the curly brackets and B i → A i in the remaining terms.

Exact case
We start our considerations with the ideal case when the black boxes reach the maximal quantum violation of the Bell inequality and and leave the study of the robustness of our schemes for the following section. Figure 2. The swap-gate used for self-testing. In it, |ψ AB stands for the state maximally violating the given Bell inequality, while |0 A and |0 B are ancillary qubit states controlling the gatesX A ,Z A ,X B andZ B . Then, H is the standard one-qubit Hadamard gate defined in the text.X A ,Z A ,X B andZ B are regularized, if necessary, versions of X A ,Z A ,X B and Z B respectively. At the output of the circuit the ancillary qubits are in the desired state |φ + .
The departure point of our considerations is the swap-gate introduced in Ref. [6] and presented on Fig. 2. In what follows we show that with properly chosen controlled gates X A , Z B , X B and Z B it defines a unitary operation that satisfies Eq. (2). To this end, let us choose and 2 cos(π/2n) , n even Clearly, as all observables A i and B i are Hermitian and have eigenvalues ±1, Z A and X A for even n and X B for odd n are unitary. However, the operators X A for odd n, X B for even n and Z B might not be unitary in general, which in turn makes the circuit of Figure  First, notice that it follows from the SOS decompositions (10) and (14) that for any i = 1, . . . , n, the identities are satisfied, which imply in particular that Moreover, one can prove that (see Appendix B) the operators X A and Z A anticommute in the following sense Finally, although the tilded operators are in general different than X B and Z B , it turns out that they act in the same way when applied to |ψ , that is, To prove these relations, let · stand for the vector norm defined as |ψ = ψ|ψ . Then, the following reasoning applies [20] ( where the first and the second equalities stem from the fact that X B is unitary and its definition, respectively. The third equality is a consequence of the fact X A is unitary which implies that |X A X B | = |X B |, and, finally, the inequality and the last equality follow from the operator inequality M ≤ |M| and Eq. (18).
We are now ready to state and prove our first main result.
Theorem 3. Let {|ψ , A i , B i } be the state and the measurements maximally violating the chained Bell inequality (3). Then the unitary operation Φ defined above is such that for any where |ϕ is some state, |φ + is the two-qubit maximally entangled state, and A i and B i are given by Eq. (8).
Proof. Let us first consider Eq. (22). Owing to the linearity of Φ in both Alice's and Bob's measurements and the fact that for even n (see Lemma 7 in Appendix B): the left-hand side of Eq. (22) can be rewritten as Then, it follows from Eqs. (18) and (19) that X A X B |ψ = Z A Z B |ψ = |ψ and X A Z B |ψ = −Z A X B |ψ , and therefore we only need to check how the map Φ applies to |ψ and X A Z B |ψ .
In the first case, one has Exploiting Eqs. (18) and (20) to convert Z B to Z B and then Z B to Z A , and the fact that Z A has eigenvalues ±1, meaning that (1+Z A ) and (1−Z A ) are projectors onto orthogonal subspaces, one finds that the terms in Eq. (27) containing the ancillary vectors |01 and |10 simply vanish, and the whole expression simplifies to Using then the fact that (1 ± Z A ) 2 = 2(1 ± Z A ), the anticommutation relation (19) and the identities (18) and (20), we finally obtain In the second case, i.e., that of Φ(X A Z B |ψ |00 ), one has Exploiting the properties (18) and (20), the anticommutation relation (19), and the fact that , one can prove that the terms in Eq. (30) containing kets |00 and |11 are zero and the whole expression reduces to By applying then Eq. (18) and the anticommutation relation (19) in the second term of Eq.
(31), one can rewrite it as After plugging Eqs. (29) and (32) into Eq. (26) and using the fact that the Pauli matrices X and Z anticommute and satisfy X A X B |φ + = Z A Z B |φ + = |φ + , we arrive at which by virtue of the formulas (8) is exactly Eq. (22). Let us now prove Eqs. (23). From the the linearity of Φ and Eq. (25), we get Following the same steps as above, one can prove the following relations which when plugged into Eq. (34) leads, in virtue of Eq. (25), to the first part of Eq. (23).The second part of the same equation can be proven in exactly the same way.
Corollary. An important corollary following directly from Theorem 3 is that the probability distribution {p(a, b|i, j)} with being the conditional probability of obtaining the outcomes a and b upon performing the ith and jth measurement, respectively, is unique. In other words, there is no other probability distribution maximally violating inequality (3) different than the one above.
Let us alsonotice that in order to prove the uniqueness of correlations maximally violating the chained Bell inequality one needs only the conditions (23) and (24); the conditions (22) are superfluous. This is because where the first equality follows from the fact that Φ is unitary and and second from Eqs. (23) and (24).

Robustness
For practical purposes, it is important to estimate the robustness of self-testing procedures, as in any realistic situation it is impossible due to experimental imperfections to actually reach the maximal violation of any Bell inequality. One expects, however, self-testing procedures to tolerate some deviations from the ideal case, that is, if the violation of the given Bell inequality is close to its maximum quantum value, the state producing the violation must be close to the state maximally violating this Bell inequality. In [21] it has been proven that SOS decompositions allow one to reach the best known robustness of all analytical self-test protocols.
Here we study how robust is the above self-testing procedure based on the chained Bell inequality. Assuming that the physical state |ψ and the physical measurements A i and B i violate the chained Bell inequality by B max n −ε with some sufficiently small ε > 0, we estimate the distance between |ψ and the reference state, and how this distance is affected when physical measurements are applied to it. For simplicity and clearness we give bounds for the case when the number of measurements is even; the bounds for in the odd n case can be determined in an analogous way.
Equipped with these tools we can state and prove the second main result of this paper.
Proof. As the norm N of |ϕ cannot be computed exactly, it turns out that to prove this theorem it is more convenient to first estimate the following distance and then show that the error we have by doing so is small for sufficiently small ε. From now on we will mainly follow the steps of the proof of Theorem 3 replacing the identities by the corresponding inequalities. First, let us notice that for any i = 1, . . . , n (see Appendix C for the proof): where g ev and h ev are given in Lemma 10 of the Appendix. Denoting by A i and B i the operators appearing in the parentheses in (47), we can write and, by further exploitation of the fact that Φ is unitary, the first norm can be upper bounded as where to obtain the second inequality we have used the standard trick of adding and subtracting the term A i B j |ψ , the triangle inequality for the norm, and the fact that A i is unitary and that the spectral radius of B j is not larger than one. The third inequality in (49) stems directly from (47). In the cases when A i or B j are equal to the identity operator 1, the above bound is replaced by h ev and g ev , respectively, while in the case A i = B j = 1, this distance is simply zero. Let us then concentrate on the second norm on the right-hand side of (48). Exploiting the explicit forms of the operators A i and B i and the measurements A i and B i , one has Let us consider the first and the last norm on the right-hand side of this inequality. With the aid of inequalities (38) and the fact that X A X B |φ + = Z A Z B |φ + = |φ + both can be upper bounded by √ ε 1 + Φ(|ψ |00 ) − |ϕ |φ + . Then, from the definition of the unitary operation Φ and the state |ϕ it follows that the latter norm can be upper bounded as To upper bound the first two norms in (51) we first exploit inequalities (38) and (39) which allow us to "convert" Z B to Z B and then Z B to Z A introducing an error of 8 √ ε 1 , and then we use the fact that (1 + Z A )(1 − Z A ) = 0. To upper bound the last norm in (51) we first use the anticommutation relation (40) which leads us to One then uses again inequalities (38) and (39) in order to "convert" Z B to Z B and then Z B to Z A . This gives After applying (40) and then (38) and (39), one finally arrives at Taking all this into account, we have that Let us now pass to the second norm in (50) and notice that by using inequality (38) and the fact that Z B |φ + = Z A |φ + , it can be upper bounded in the following way Let us consider the first two norms appearing on the right-hand side of (56). Exploiting the anticommutation relation (40) and then inequalities (38) and (39) to convert Z B to Z A , we can bound each of these norms by 4 √ ε 1 + 2ω ev (n). Using then the inequality (40), the third term is not larger than 2ω ev (n). To bound the fourth term in (56), let us use the fact that 1 + Z A ≤ 2 to write Subsequent usage of inequalities (38) and (39) to Z B and X B gives which after double application of (40) yields This together with previous estimations finally implies that In a fully analogous way one can estimate the third term on the right-hand side of (50) By plugging all these terms into (50) and then the resulting inequality together with (49) into (48), one obtains The terms from (42) can be treated in almost exactly the same way, giving while the estimation of the corresponding expression from 42 follows from the application of inequality (38) to (63), meaning that an additional error of √ ε 1 has to be taken into account, which gives Finally, the case of A i = B j = 1 has already been derived in (55).
The distance between the normalized state |ϕ and the unnormalized one |ϕ is estimated in Lemma 11 to be where ω is equal to ω ev for an even number of inputs. In order to obtain inequalities (41) and complete the proof we use the triangle inequality for the vector norm to write and then apply the previously determined inequalities (55), (62), (63), (64) and (65). All terms contributing to the functions f (ε, n), f B j (ε, n), f A i (ε, n) and f i j (ε, n) scale at most as O(n 2 √ ε). The more detailed analysis of the asymptotic behaviour of different contributions is discussed in Lemmas 9 and 10 in Appendix C.
Let us remark here that we have not checked whether the bounds (41)-(44) are optimal both in the distance from the maximal quantum violation ε and the number of measurements n. Thus, it is still possible that these robustness bounds scale better that quadratically with the number of measurements. However, in order to determine such tighter bounds one would need in particular to optimize the above method over all SOS decomposition, which is certainly a difficult tasks.

Randomness certification with the chained Bell inequalities
It has been shown in Ref. [16] that by exploiting the symmetry properties of the chained Bell inequality, one can certify two bits of randomness when the maximum quantum violation of this inequalities are obtained, provided this maximal quantum violation is unique. However, a proof of the latter fact has not been known so far. Thus, our paper completes the result of Ref. [16].
Let us now provide an alternative way of certifying two bits of perfect randomness with the aid of the chained Bell inequality. For this purpose, we consider the following modification of the chained Bell inequality in which Alice, as before, can measure one of n observables A i while Bob has n + 1 observables B i at his disposal, where n is assumed to be even. It is not difficult to see that the maximal quantum violation of this inequality amounts to B max n = B max n + 1. Let us now assume that |ψ and A i and B i are the state and the measurements maximally violating (67). Denoting then by B n = B n + A 1 ⊗ B n+1 the corresponding Bell operator, one has ψ|( B max n 1 − B n )|ψ = 0, which, owing to the fact that |ψ also violates maximally the chained Bell inequality and that B max n is its maximal quantum violation, simplifies to 0 = ψ|(1 − A 1 ⊗ B n+1 )|ψ = (1/2) ψ|(1 − A 1 ⊗ B n+1 ) 2 |ψ , where the second equality is a consequence of the fact that A 1 and B n+1 are unitary and hermitian. This implies that This property implies in particular that B n+1 = A 1 , which, taking into account the fact that for the maximal quantum violation of the chained Bell inequality A i = 0 for any i = 1, . . . , n, implies B n+1 = 0. In a quite analogous way we can now prove that the expectation value A n/2+1 B n+1 = ψ|A n/2+1 ⊗ B n+1 |ψ vanishes. Exploiting Eq. (68), we can rewrite it as ψ|A n/2+1 ⊗ B n+1 |ψ = ψ|A n/2+1 A 1 |ψ . Then, due to the fact that the expectation value ψ|A n/2+1 ⊗ B n+1 |ψ is real and both operators A n/2+1 and B n+1 are hermitian, which means that ψ|A n/2+1 A 1 |ψ = ψ|A 1 A n/2+1 |ψ , this can be further rewritten as We have already proven that if |ψ and A i and B i violate maximally the chained Bell inequality, then {A 1 , A n/2+1 }|ψ = 0 which implies that A n/2+1 B n+1 = 0, which together with A 1 = B n+1 = 0 mean finally that with a, b = 0, 1. All this proves that any probability distribution p(a, b|A i , B j ) with i = 1, . . . , n and j = 1, . . . , n + 1 maximally violating the modified chained Bell inequality (67) is such that all outcomes of the pair of measurements A n/2+1 , B n+1 are equiprobable (70) and thus perfectly random, meaning that (67) certifies two bits of perfect randomness. The intuition behind the above approach is very simple. At the maximal quantum violation of (67) the measurement B n+1 must be "parallel" to A 1 [cf. Eq. (68)]. Therefore it is "orthogonal" to A n/2+1 as the latter is orthogonal to A 1 , meaning that A n/2+1 B n+1 = 0 which is basically what we need. It is worth noticing that in the even n case all pairs A 1+i , A n/2+i with i = 1, . . . , n/2 − 1 of Alice's observables are orthogonal, and therefore our argument can be extended to any pair A n/2+i , B n+1 , that is, A n/2+i , B n+1 = 0 provided the Bell inequality I n ch + A n/2+i B n+1 ≤ 2n − 1 is maximally violated. Unfortunately, this approach does not work in the odd n case as no pair of observables at Alice's or Bob's sides are orthogonal.

Discussion
In this work, we developed a scheme for self-testing the maximally entangled state of two qubits using the chained Bell inequalities. Since our results hold for any number of inputs, this allows to self-test measurements on the whole XZ plane of the Bloch sphere. Some of the previous self-testing techniques found an application for blind quantum computation protocols (See [3]). The fact that chained Bell inequalities involve and certify a quite large class of measurements makes this self-testing protocol a good candidate for some future application in blind quantum computation processes. Beyond their interest as a protocol in quantum information processing, our results also have fundamental implications, since they prove the uniqueness of the maximal violation of the chained Bell inequalities. In [16], this property was assumed to be true to argue maximal randomness certification in Bell tests: with our proof, their results are now confirmed. Contrary to the expectations, when increasing the number of measurements, the robustness of our protocol diminishes. An interesting open question is to see whether it is possible to improve this scaling. Another open question concerns chained Bell inequalities with more outcomes: can they also be useful for selftesting? If so, one could also make use of these results for certifying random dits in systems of dimension larger than two.

Appendix A. Proving the SOS decompositions
Here we provide more detailed explanation of the SOS decompositions (10) and (14).
To verify the validity of the the first decomposition one expands the first sum of its righthand side and notices that apart from the terms forming the shifted Bell operator B max n 1 − B n there are some additional terms of the form B k B k+1 . These are cancelled out by the same terms appearing in the second sum on the right-hand side of Eq. (10). The only trouble one has to face in reducing all the remaining terms to the shifted Bell operator is to prove that the coefficient multiplying the identity operator 1 is exactly 2n cos(π/2n). Let us now prove that indeed this is the case. To this end, we write this coefficient as with ω = α, β , γ. Recall that the coefficients α i , β i and γ i are defined in Eqs. (11), (12) and (13). Let us now compute each term ∆ ω separately, starting from ∆ α . Exploiting Eq. (11) we can write sin(π/n) 4 cos 2 (π/2n) Now, we utilize the fact that Let us then compute ∆ β . Using Eq. (12), it can be explicitly written as which with the aid of the elementary trigonometric property that sin(x + y) = sin x cos y + cos x sin y, rewrites as This, by virtue of (A.5), finally gives ∆ β = (n − 1) cos(π/n) 4 cos 2 (π/2n) . (A.9) Let us finally compute ∆ γ . From (13) it can be written explicitly as Writing then sin(iπ/n) = sin[(i + 1 − 1)π/n] and using again the above trigonometric identity, one obtains which, taking into account Eq. (A.5), simplifies to ∆ γ = (n − 1) cos(π/n) 4 cos 2 (π/2n) . (A.12) Plugging then Eq. (A.6), (A.9) and (A.12) into (A.1) and using some elementary properties of the trigonometric functions, one eventually obtains ∆ = 2n cos(π/2n).
To confirm validity of the second degree SOS decomposition (14) we follow similar argumentation. The first parenthesis on the right hand side of (14) introduces terms that up to some multiplicative factors belong to the following set {1, The terms A i A j B k B l are directly cancelled out by the same terms stemming from the second and the third parenthesis. Then, the terms A i A i+1 and B i B i+1 enter with the coefficient 2/[8n cos(π/2n)] and together with the same terms resulting from the second parenthesis and entering with the coefficient (n − 2)/[8n cos(π/2n)] they are cancel out by those resulting from the third line of (14). The terms A i B i and A i B i−1 give rise to the shifted Bell operator, and, finally, the identity operator 1 is multiplied by the following expression 1 8n cos(π/2n) 8n 2 cos 2 ( π 2n ) + 4n + 4n(n − 2) + 4n + n cos(π/n) 2 cos 2 (π/2n) (A. 13) which after some movements simplifies to 2n cos(π/2n). This is exactly the multiplicative factor of identity operator in the shifted Bell operator.

Appendix B. Exact case
Here we present detailed proofs of the anticommutation relation (19), and also of some auxiliary relations for the measurements A i and B i . Before we proceed let us note that in some of the following expressions operators might be indexed by any integer (not just from the set {1, . . . , n}), and in those cases we use the notation C n+i = −C i and C −i = −C n−i . The intuition for this notation can be found on Bloch sphere representation of the measurements (1), where we can see that if one would draw the next measurement after C n , and note it as C n+1 it would be parallel to −C 1 , and similarly for any C n+i . Let us start by proving the following lemma. for i = 1, . . . , n, for i = 1, . . . , n − 2, j = 1, . . . , n and C = A , B , and for i = 1, . . . , n.
Having all these auxiliary identities at hand, we are now in position to prove Eq. (B.5). To this end, we first rewrite its left-hand side as where the first equality was obtained with the aid of the identity (B.1) for i = n/2 + 1, while the second one follows from Eqs. (B.10) and (B.11). Then, the formulas (B.3) and (B.4) imply that and hold for any j = 1, . . . , n. After setting j = n/2 in the latter identities and inserting them into Eq. (B.12) we eventually obtain (B.5).
Odd number of measurements. Before passing to the anticommutation relation (B.6), we need some auxiliary relations for the measurements A i and B i . In order to derive the first one, we shift k → k − 1 in Eq. (B.9) and add the resulting equation to Eq. (B.7), obtaining Then, setting i = 1 and shifting j → j − 1 in Eq. (B.2) we arrive at (C j+1 +C j−1 )|ψ = 2 cos π n C j |ψ , (B.16) which after being plugged into Eq. (B.15) gives rise to the following identity where ζ i = 2 cos(iπ/n). Then, by setting j = (n − 1)/2 in Eqs. (B.13) and (B.14) and adding the resulting equations we obtain which can be further simplified by using Eq. (B.17) with i = (n − 1)/2 and k = n, giving Analogously, by setting j = (n + 1)/2 in Eqs. (B.13) and (B.14) and adding them, one obtains which, after application of Eq. (B.17) with i = (n − 1)/2 and k = n + 1, further simplifies to Now, we can rewrite the left-hand side of the anticommutation relation Eq. (B.6) as Exploiting once more Eq. (B.17) one obtains the following equalities  Proof. Let us begin with the even n case. By setting k = 1 + n/2 and shifting i → 1 − i + n/2 in Eq. (B.17) one obtains for i = 1, . . . , n/2, where we have additionally exploited the fact that C n+i = −C i and C −i = −C n−i for any i. To prove Eq. (B.31) for i = n/2 + 1, . . . , n/2 one has to use (B.7) but coefficients α i , β i and γ i are not defined for i < 0. However, once Eq. (B.31) is derived for i < n/2 + 1, it is easy to note that the cases when i > n/2 + 1 are already contained in the proof. This is due to the fact that any expression obtained when i > n/2 + 1, is the same as the expression proved for n + 2 − i < n/2 + 1.
On the other hand, fixing k = 1 and shifting i → i − 1 in Eq. (B.17), one can deduce the following equality In order to prove the second identity (B.28), we fix k = n/2 and shift i → n/2 − i in Eq. (B.10) which leads us to This equation is satisfied for all i = 1, . . . , n, but it could formally be derived only when i < n/2. The cases i = n/2, n/2+1 are trivially satisfied. Similarly to the discussion following Eq. (B.31) it is easy to check that for every i > n/2 + 1 Eq. (B.33) is the same as for the case n + 1 − i < n/2, which has been formally proven. Now we note that by shifting i → i − 1 in Eq. (B.11), one obtains the following equation which when combined with Eq. (B.33) directly implies Eq. (B.28), completing the proof. Now we move to the odd n case. First in Eq. (B.10) we fix k = (n + 1)/2 and shift i → (n + 1)/2 − i to get for odd n. For any fixed n the right-hand sides of both inequalities vanish if ε → 0 and for sufficiently large n both functions scale quadratically with n.
Proof. The proof goes along the same lines as that of Lemma 6, however, at each step we need to take into account the error stemming from the fact that now the Bell inequality is not violated maximally. We prove the cases of even and odd n separately. Even n. We first need to prove the approximate versions of the identities (B.10) and (B.11). By substituting j = k − i in (C.2) we obtain Then, by shifting i → n − i − 1 and setting j = k + i + 1 in (C.2), we have for any k = 1, . . . , n and i = 1, . . . , n − 2. The case when i = n − 1 or i = n are trivial because they represent the definition of C k,k+1 . Then, by using Eq. (C.7) with k = n and Eq. (C.8) with k = 0, one can prove the following inequality To upper bound the above two terms, we will use approximate versions of Eqs. (B.13) and (B.14) First, it follows from the SOS decomposition that for any j = 1, . . . , n: 13) which by virtue of the triangle inequality for the norm and concavity of the square root implies (C.14) Analogously, the SOS decomposition (14) implies that from which, by using similar arguments as above, one infers that (C. 16) Substituting j = n/2 and applying both inequalities (C.14) and (C. 16) to (C.12) one finally obtains (C.5).