Rigidity of quantum steering and one-sided device-independent verifiable quantum computation

The relationship between correlations and entanglement has played a major role in understanding quantum theory since the work of Einstein, Podolsky and Rosen (1935). Tsirelson (1980) proved that Bell states, shared among two parties, when measured suitably, achieve the maximum non-local correlations allowed by quantum mechanics. Conversely, Reichardt, Unger and Vazirani (2013) showed that observing the maximal correlation value over a sequence of repeated measurements, implies that the underlying quantum state is close to a tensor product of maximally entangled states and, moreover, that it is measured according to an ideal strategy. However, this strong rigidity result comes at a high price, requiring a large number of entangled pairs to be tested. In this paper, we present a significant improvement in terms of the overhead by instead considering quantum steering where the device of the one side is trusted. We first demonstrate a robust one-sided device-independent version of self-testing, which characterises the shared state and measurement operators of two parties up to a certain bound. We show that this bound is optimal up to constant factors and we generalise the results for the most general attacks. This leads us to a rigidity theorem for maximal steering correlations. As a key application we give a one-sided device-independent protocol for verifiable delegated quantum computation, and compare it to other existing protocols, to highlight the cost of trust assumptions. Finally, we show that under reasonable assumptions, the states shared in order to run a certain type of verification protocol must be unitarily equivalent to perfect Bell states.


Introduction
Quantum steering correlations first appeared in the seminal paper of Einstein et al [1] to support their argument that quantum mechanics is incomplete. It was later formally introduced by Schrödinger [4]. The observation made, was that measurements performed on one half of a bipartite entangled state can steer the state of the other half. This means that the reduced state of one side can be correlated with the classical outcome of the other party in a way that is possible only if the two parties shared entanglement (assuming the correctness of quantum mechanics). A similar effect occurs when examining purely classical correlations, which led Bell to derive his inequalities and reveal the non-local character of quantum mechanics [5]. The study of correlations that characterise quantum systems has developed much since then, and now includes the already mentioned nonlocal and steering correlations and quantum discord correlations [6][7][8]. Observing these correlations, given suitable assumptions, is an indication that a particular system behaves quantum mechanically and is used to verify the quantumness of that system. Since these correlations are specific to quantum systems, it is also anticipated that they could be the source of certain new practical applications.
In particular, the existence of non-local correlations, apart from revealing a counter intuitive feature of nature, has led to the development of device-independent protocols for quantum key distribution (QKD), quantum random number generation (QRNG) and verified delegated quantum computation (VDQC) [3,[9][10][11][12][13][14][15][16]. In these applications two parties, Alice and Bob, do not trust their devices throughout the run of the protocol. Instead, by obtaining non-local correlations between the classical outputs of their devices, they can test their devices and obtain the correct functionality. This is achieved by confirming that the states they were sharing were entangled and measured in such a way that the resulting correlations could not have come from any classical system. Thus, the two parties either obtain a correct and secure result or detect that the devices are working incorrectly (thus being insecure) and abort. Such protocols are highly desired for practical implementation as they provide a higher level of security, unachievable by classical systems. However, there are certain practical issues that hinder their development such as the need for high detection thresholds, high fidelity transmission channels, space-like separation and a high overhead [13,17].
The practical limitations of device-independent protocols has motivated the revival of research into quantum steering, which has simpler trust assumptions, where the state of one (trusted) side is steered by operations on the other (untrusted) side. The existing research involves the characterisation of steering correlations both analytically and geometrically [18][19][20], their relationship to other types of correlations [21,22] and their application to cryptographic tasks such as QKD and QRNG [23,24]. Experiments testing quantum steering inequalities [25] (loophole-free) and testing local but steerable states [26] have also been performed. In the case of QKD, Branciard et al showed in [23], that there is a natural correspondence between the trust assumptions of the protocol and the types of correlations between the two parties. Using this correspondence, Branciard et al introduced one-sided device-independent QKD, which uses steering correlations in order to distil a shared secret key. In the cryptographic setting, such correlations allow only one device to be untrusted leading to a reduction in the overall experimental requirements of the protocol. To be precise, they showed that in typical device-independent settings, the detection efficiency of Alice and Bob should be above 91.1%, whereas their one-sided protocol lowers that to 65.9%. A similar relation between trust assumptions and correlations is exploited for QRNG as well [24]. In this case it was shown that a detection efficiency of 50% is sufficient for random number generation in the steering setting, versus 70.7% in the device-independent setting.
For VDQC, we will show that using steering correlations leads to a reduction in communication, compared to the device independent setting. However, the VDQC case presents a complication. Firstly, the setting of VDQC is slightly different than that of QKD and QRNG. In the latter two, Alice and Bob are two parties that are working together towards a common objective (obtaining a shared key or certified randomness), using possibly untrusted quantum devices. In VDQC, Alice is a client who is delegating a difficult computation to Bob, an untrusted quantum server. She does not have the resources to perform the quantum computation herself, and while Bob does, he cannot be trusted to do so. So Alice needs a way to verify that Bob is performing the correct quantum computation. To do this, she utilises a quantum device in her local lab which she may or may not trust. Regardless of this, Bob is always assumed to be unstrusted. This is an important distinction from the collaborative setting of QKD and QRNG. Moreover, approaches to QKD and QRNG rely on using a bound on the correlations of the parties' devices in order to derive a bound for a quantity of interest, such as key rate, mutual information, entropy etc [15,[27][28][29][30][31]. In contrast to this, existing protocols for device-independent VDQC use the bound on correlations to recover the underlying quantum state used in the protocol, as well as the operations being performed on this quantum state [9][10][11][12]. This allows for the correctness certification (referred to here as verification) of an arbitrary universal quantum computation strictly from the non-local correlations. To achieve this one needs, at the same time, to obtain close to maximal non-local correlations and not only recover a characterisation of one Bell pair but of a tensor product of Bell pairs. Such a result is possible due to the rigidity of repeated CHSH games, manifesting non-local correlations, as shown in [9]. In this context, rigidity means that if two non-communicating devices playing CHSH games are achieving the optimal win rate, then they share a state which is close to a tensor product of maximally entangled states and, moreover, their strategy is fixed and uniquely determined. In general, we define rigidity as the ability to derive a robust bound on the distance between a real state (the state shared by Alice and Bob) and many copies of some target state (such as a tensor product of Bell pairs) as well as between target measurements and real measurements, from a bound on correlations. This is similar to the concept of self-testing, except that for self-testing one only wants to obtain a single copy of the target state from observed correlations. For instance, it is possible to self-test a Bell state and its associated measurements using the CHSH game. So, one way to arrive at rigidity is to consider multiple CHSH games and combine the self-testing results 3 . However, in general, it is necessary to play a large number of games in order to certify few Bell states. For this reason the existing device-independent VDQC protocols have impractically large communication complexity [9,10,12].
There is an additional aspect to be mentioned. As stated, in the VDQC setting we have a trusted client, also referred to as verifier, and an untrusted server, also referred to as prover. This is the standard cryptographic scenario when considering verification of computation, whether it is quantum or classical [32,33]. The asymmetry in trust is precisely the same as in the steering scenario which is why VDQC is the most natural application for steering correlations. While it is definitely possible to introduce such an asymmetry in QKD, for example, the typical setting is to have the parties involved be identical in all respects.
In this paper, we relax the trust assumptions and derive a rigidity result for quantum steering correlations, showing that it leads to a reduced overhead compared to the setting of non-local correlations. The result proves that observing steering correlations close to their maximal value, implies a tensor product structure of Bell pairs and fixed measurement operators for the untrusted party, up to local isometry. The only assumptions made in deriving this result are the correctness of quantum mechanics and the fact that one party is completely trusted, having a complete characterisation of her Hilbert space and measurement operators. In particular, the rigidity result makes no independent and identically distributed (i.i.d.) assumption regarding the shared state or strategy of the untrusted party. In analogy to one-sided device-independent QKD and QRNG, this leads us to a one-sided device-independent VDQC protocol, having improved round complexity over the device-independent versions. More generally, the rigidity result is relevant in its own right since it is applicable to any protocol that uses steering correlations.
The structure of this paper is organised as follows. In section 2 we give our main result, which is that using maximal steering correlations we determine, up to a local isometry, a tensor product of Bell pairs and the operations of the untrusted party. To derive this result, we first give a procedure to characterise a single Bell pair from observed correlations (single-shot rigidity), in the i.i.d. setting in section 2.1. This is done by making a protocol for self-testing from steering correlations which gives us a bound on the distance of one shared state from a perfect Bell pair. We also prove the optimality of this bound. We then remove the i.i.d. assumption in section 2.2, thus showing that one can extract a Bell pair from the observed statistics even in the fully adversarial (one-sided) setting. Then, in section 2.3 we use the previous result in order to determine a tensor product structure of Bell pairs and the measurement operators of the untrusted party. These steps are shown in figure 1. Note that rigidity does not follow directly from repeatedly applying the single-shot result as this would require independence. Instead, we use an approach similar to that of [9], by defining a quantum steering game and showing that high win rates in this game determine the states and strategies of the players, up to local isometry.
Lastly, in section 3 we briefly discuss existing approaches to VDQC (section 3.1) and then use the rigidity of quantum steering to construct a one-sided device-independent verification protocol (section 3.2). We also show that for the types of protocols we have considered, the required entangled states should be close to Bell pairs (section 3.3).

State and strategy certification via steering
While quantum steering has been studied extensively in the context of verifying entanglement, it is important to elaborate on the subtle difference between verifying entanglement and verifying maximal entanglement and how this relates to the verification of quantum computation. It has already been shown that it is possible to verify, from steering correlations, that a state shared by two parties is entangled. In fact, this type of verification can be done in a fully device-independent way (under certain assumptions), and has been tested experimentally [34,35]. However, it should be noted that these results use steering correlations as a witness for quantum entanglement. The purpose of a witness is to separate between entangled and non-entangled states and its existence is proven through the violation of a steering inequality, in analogy to a Bell inequality. In our setting, we do not just require correlations that violate a steering inequality, rather we require the correlations to saturate the maximum achievable value. This enables us to certify the state and strategies used in producing these correlations, which in turn, can be used for verifying quantum computations. To our knowledge, there are no other results which treat the case of saturated steering correlations.
The setting that we will consider is similar to the one used in [21,23]. This involves two parties, Alice and Bob, where Alice has a trusted measurement device, while Bob has an untrusted measurement device. They share an unknown joint quantum state, |yñ, which without loss of generality can be assumed to be pure. Alice instructs Bob to perform a measurement on their joint state. For example, if the shared state is | (| | ) f ñ = ñ + ñ + 00 11 2 , Alice can instruct Bob to measure the Z observable on his qubit and report the outcome. The measurement steers Alice's qubit to a particular quantum state. She can then measure her state to confirm that her qubit was indeed steered to the expected state. We shall refer to a collection of such measurements as a steering game consisting of rounds of single measurements performed by Alice and Bob. They win a round of the game if Bob's reported outcome matches that of Alice. We elaborate more on this in section 2.3.
The correlations between their outcomes are called steering correlations if they cannot be explained by a local hidden state model. This happens when the expected value for the correlation of their outcomes obeys certain steering inequalities. However, whenever a steering inequality violation is observed, Alice can conclude that her state was indeed steered by Bob via their shared entanglement. In the rest of this section we prove that violating the steering inequalities maximally (up to order ( )  O ) leads to recovering a tensor product of Bell pairs with measurement operators close to ideal and we quantify this 'closeness'. Proving this rigidity result is done as follows. First, building on the work regarding self-testing the singlet [36] by McKague et al, we derive a robust self-testing protocol of a single Bell state, where one side is trusted, while the other is not. This is achieved by using maximal steering correlations in order to fully characterise, up to a bound of order ( )  O , the quantum state shared between the two parties. Importantly, in [36] it is assumed that the quantum states are i.i.d. We also make this assumption in our self-testing result (section 2.1), however we remove it later on (section 2.2). We show that the bound for self-testing is tight up to constant factors. Then, we remove the i.i.d. assumption, arriving at a new bound for characterising the shared state in the completely adversarial setting, from the observed correlations. The way in which we remove the i.i.d. assumption is not specific to steering and can be applied to the non-local setting as well, thus complementing the work from [36]. Using this result, and a gamebased argument we show that saturating the steering inequalities enables us to recover the quantum state of a tensor products of Bell pairs and characterise the untrusted measurement operators acting on these states, thus proving the rigidity of quantum steering (section 2.3). Throughout this paper we use ||| || | y yy ñ = á ñ as the as trace distance. Additionally, for the trace distance of pure states we will write 2.1. One-sided device-independent self-testing (i.i.d.) We start by proving a one-sided device-independent version of robust self-testing, whereby the measurement statistics allow us to determine the existence of a single Bell pair. Specifically, as in [36], successfully self-testing a maximally entangled state between Alice and Bob means: • There exist local bases (local isometry) in which their shared state can be viewed as a Bell pair, possibly in tensor product with some additional state.
• We can infer the existence of local (physical) observables on Alice and Bob's side, which act non-trivially on the shared state.
This is similar to the works of [11,[36][37][38][39][40][41][42] and in fact we adopt a similar notation to that of [36]. The main difference with respect to those works, is that in our case we trust Alice's measurements. The specific observables we consider for her are Pauli X and Y. We will find that Bob must also measure these observables to saturate the correlations of measurement outcomes. The Bell state under consideration is the XY-determined Bell state | (| | ) y ñ = ñ + ñ + 01 10 2 . The result can be generalised for any pair of non-commuting observables and any Bell state. It should be mentioned that a Bell state has a local hidden variable model for Pauli basis measurements by both parties, but it does not have a local hidden state model. This highlights the difference between non-local and steering correlations and emphasises the importance of trusting Alice's system in order characterise the shared state and Bob's measurements. The reason for our choice of observables and state is so that we can easily use this result for a VDQC protocol, presented in the next section, that uses XY-plane states, as explained in section 3. Note that Alice and Bob need to perform multiple measurements in order to approximate the expectation values of their observables. Since we do not trust Bob, we cannot in general assume the independence of his measurements. However, we will make an i.i.d. assumption in the beginning, to prove our main selftesting theorem. We then remove the assumption by modelling the measurement process as a martingale and using the Azuma-Hoeffding inequality [43,44], as is also done in [11,15]. A schematic illustration of our setting can be found in figure 2.
We start by proving a theorem analogous to theorem 1 of [36]. Just as in [36], the primed observables denote untrusted operators. The shared state, which is also assumed to be untrusted is denoted as |yñ. The independence (i.i.d.) assumption means that Alice and Bob share the same state |yñ in each round of measurements. Furthermore, the untrusted measurement observables of Bob can be assumed to be the same each time. This is because his observables can include action on his private ancilla. Since Alice's side is trusted, we assume that she has a single qubit measurement device and so, in each round of measurement, her part of |yñ is a single qubit state. Given this setting, the theorem is stated as follows: Theorem 1. Suppose that from the observed correlations of measurements performed by Alice and Bob and knowing that Alice is measuring the {X , } Y observables (denoted X A , Y A ), one can deduce the existence of local observables { ¢ X B , } ¢ Y B on Bob's side, with eigenvalues1, which act on a bipartite state |yñ such that: Then there exists a local isometry F = Ä F I B and a state | ñ junk B such that Proof sketch. The proof relies on finding an isometry which, given conditions(1)-(3), maps |yñ to an almost perfect Bell state. Similar to [36], M A and ¢ N B are the physical observables of Alice and Bob which act on the shared state. The isometry we considered is illustrated in figure 3, where ( ) = + P X Y 1 2 and the control gates act on the target state when the control qubit is in the |-ñ y state instead of the | ñ 1 state, and act as identity when the control is in the |+ ñ y state instead of the | ñ 0 state. Here, |+ ñ y and |-ñ y are the two eigenstates for the Pauli Y operator, corresponding to the +1 and −1 eigenvalues, respectively. The fact that we are using these states and the P operator is a consequence of shifting everything to the XY-plane of the Bloch sphere instead of the more familiar XZ-plane. It should be noted that M A is trusted and acts on Alice's part of the shared state, whereas ¢ N B , acting on Bob's part of |yñ, is untrusted. However, the action of ¢ N B is equivalent to the honest N B acting on the  ancilla introduced by Φ. Having the isometry, we write out its action on the state |y ¢ ñ M N A B and use inequalities(1)-(3) together with the trace preserving properties of the operators and triangle inequalities to prove condition (4). The full proof of theorem 1 can be found in appendix A. , Our next result is to show that conditions(1)-(3) are satisfied if an almost maximal violation of a particular steering inequality occurs. As mentioned before, the requirement for maximal violation is in contrast to previous work on entanglement detection. In that case, one uses the steering inequality as an entanglement witness to separate the Hilbert space of possible shared states into a subspace of entangled states manifesting steering correlations and its complement. Violating the inequality determines that the shared state lies in the subspace of entangled steerable states. For example, similar to the works of [45,46], assuming Bob measures local observables ¢ X B and ¢ Y B , one could consider the inequality: This inequality holds, whenever there is a local hidden state model for Bob's system. If this is not the case, then the state is steerable. In our case, we do not simply require a violation of this inequality, but we require a (close to) maximal violation. For the above inequality, the maximum achievable violation allowed by quantum mechanics is 2, which also corresponds to its mathematical maximum. Requiring maximal saturation is represented as: for some small ò. Given that this inequality holds we have: Then the conditions of theorem 1 are satisfied with  g = 2 1 and  g = 4 2 .
Proof sketch. The proof reduces to expanding inequality 2 and using the properties of the observables, to arrive at the bounds of conditions(1)-(3) from the previous theorem. Concretely, we see that the correlation of local observables that we consider: is simply a sum of two expectation values which are upper bounded by unity (because the observables have±1 eigenvalues). Hence, to saturate the absolute value of this quantity, it must be the case that both expectation values are saturated i.e. lower bounded by  -1 or upper bounded by  -+ 1 . We will only examine the first case since the second is analogous, so we will drop the absolute value of the expression and simply consider:

A B A B
By expressing each expectation as a trace norm we arrive at conditions (1) and (2). To prove condition (3) we use the Cauchy-Schwarz inequality and the commutators [ ] X Y , , respectively. The full proof can be found in appendix B. , Using the results of theorems 1 and 2, we find that strong correlations between Alice and Bob's measurement outcomes, given that we trust Alice to be measuring the X and Y observables, determine the shared state between Alice and Bob as a Bell state, under local isometry F = Ä F I A B . Additionally, notice that if the steering correlations are ( )  O close to ideal (maximal), we can bound the shared state of Alice and Bob as being ( )  O close to the ideal. The same asymptotic bound is achieved in the case of CHSH games, where both Alice and Bob's outcomes are untrusted. One could expect that the bound we obtained from the steering inequalities is not a tight bound and that it is possible to do better because we trust Alice's measurements. We prove, that in fact this is not the case and the ( ) bound is actually tight: Theorem 3. Suppose that Bob's observables ¢ X B and ¢ Y B with eigenvalues1, acting on a state |yñ, are such that: Then, up to constant factors, the bound of theorem 1 (i.e. inequality (4) with Proof sketch. Theorem 3 essentially shows that the ( )  O bound for the closeness of |yñ to the ideal Bell state |y ñ + is optimal. The proof relies on finding a state and local observables for Bob such that the steering correlation is saturated up to order ( )  O , but the state is ( )  O deviated from the ideal Bell state. We consider such a state which is exactly  -close to the ideal |y ñ + Bell state and which saturates the correlation of observables to  -2 . Furthermore, we consider local observables for Bob which are deviated, as a function of ò, from the ideal observables. Hence, these deviated observables tend to the ideal X and Y observables in the limit where   0. The specific state and Bob's local observables are given in appendix C. , The exact bound for closeness can be computed by simply inserting the constants g 1 and g 2 from theorem 2 in the calculation for ε of theorem 1. This yields a distance of ( )   e = + + 3 2 8 2. This result has important consequences for the application we consider in the next section, the verification of quantum computation. It essentially imposes a restriction on how good the fidelity of the entangled state is, as resulting from the observed correlations. In VDQC we require a complete characterisation of the entangled states that are used and in particular, we require them to be close to Bell pairs. This leads to the requirement of a very tight saturation of the steering correlations. Contrast this to the QKD or QRNG settings where less than maximally entangled states suffice [27,28,[47][48][49].
It should be noted that we used the same notation for Bob's observables in both theorems 2 and 1 since for this particular case they coincide. In general, however, we would have to construct Bob's observables in theorem 1 from the observed correlations, as is done in [36]. An important corollary to these three theorems is the following: Proof. In the proof of theorem 1 we only made use of the anti-commutation properties of the X, Y observables on Alice's side as well as the action of the two operators on the eigenstates of Y. For general observables, A 0 and A 1 this translates to using their anti-commutation properties and the action of the two on the eigenstates of A 1 , for example. Essentially the proof of theorem 1 only changes by relabelling X A as A 0 and Y A as A 1 . On Bob's side, the situation is similar. By relabelling ¢ X B as B 0 and ¢ Y B as B 1 we again have conditions(1)-(3) for these observables, which are then used to construct the isometry and prove the result of theorem 1.
For theorem 2, using the same relabelling we have the inequality: Since the proof of theorem 2, like theorem 1, only relied on the anti-commutation properties and the action of the observables on the eigenstates of one of them, the relabelling does not change anything and the results go through as before.
Lastly, for theorem 3 we use that fact that the observables A 0 and A 1 are linear combinations of Pauli matrices. Depending on which Bell state is stabilised by the actions of these observables we can consider a state that is ( )  O -deviated from that Bell state, similar to the state considered for the proof of theorem 3. Analogously, we will have ( )  O -deviated observables for each Pauli matrix. For example, in the proof of theorem 3 we considered the ( )  O -deviated versions of the X and Y observables. Bob's observables will therefore be linear combinations of these ( )  O -deviated Paulis so as to be ( )  O -close to A 0 and A 1 , respectively. , The result of theorem 2 assumes ideal expectation values for the observables of Alice and Bob. Of course, in practice, after performing a finite number of measurements we obtain an approximation of these expectation values. This can be properly taken into account by considering independent random variables (since we are in the i.i.d. setting) associated with the measurement process and using a Chernoff inequality to bound their expectation values. We do not give a full derivation of this here, since we will give the more general derivation for the non-i.i.d. case in the next section (for which the proof can be found in appendix D). Instead, we simply state the result of this finite analysis: for a fixed  > 0, we require at least ( ) ( )   1 log 1 2 measurements in order to certify that the closeness of each shared state is ( ) to a perfect Bell pair. One can also compute the number of measurements as a function of the desired trace distance for the Bell states. If we denote this distance as  = D c , then the number of measurements must be at least ( . In our case » c 12.3, so that if we wanted the trace distance to be, for example, D = 0.1, we would require at least2.2 10 9 measurements.

Removing the independence assumption
We proceed to remove the i.i.d. assumption from the previous statements. The following theorem essentially states that if Alice and Bob are asked to perform a sequence of measurements, and we notice a close to maximal steering inequality violation from their outcomes, we can conclude that the state shared in a typical round of measurement is close to a Bell pair. By 'typical round' we mean a uniformly randomly chosen round. A similar result is obtained in [50], with the essential differences that their non-i.i.d. result shows that at least one state is close to an ideal Bell pair while both parties are untrusted. In our case, Alice is trusted throughout this process and, without loss of generality, we can assume that she chooses the measurement settings for each round. The notation (·) -Tr i indicates that we are tracing out everything apart from the quantum states that are measured in round i. We also use the notation (·) -Tr R , which generalises the previous notation for a set, R, of rounds (i.e. tracing out all states except those which are used in rounds Î i R).
Theorem 4. Suppose Alice and Bob are required to perform K rounds of measurement and also that: • Prior to the measurements, the shared state of Alice and Bob is assumed to be s, which can be either pure or mixed. The state s is thus the global state which will be used for all K rounds 4 .
• Alice chooses a random set of size K 2, consisting of distinct indices from 1 to K and denoted the reduced state of Alice and Bob in round i, and: as the averaged state. Here i AB 1, 1 denotes the action (measurements) of Alice and Bob on the state sigma up to round i.
Alice measures the observable A r i on her half of r i . A 0 and A 1 are anti-commuting single-qubit observables having1 eigenvalues.
• In round i, Bob is asked to measure B r i . B 0 and B 1 have1 eigenvalues.
• We denote a i and b i , respectively, as the outcomes of their measurements in round i. We also denoteˆ= C a b i i i as their correlation for round i.
as the averaged correlations for the cases where both Alice and Bob are asked to measure the first observable, or both are asked to measure the second, respectively.
If, for some given  > 0 and suitably chosen ) then there exists a local isometry F such that, for a randomly chosen r i , with probability at least 1 operators and AB is the analogous combination of the ideal operators (i.e. A 0 , A 1 , I and the ideal operators for Bob, which for the XY-plane case we considered, are I X Y , , ), as in theorem 1, and where junk is Bob's private system apart from the ancilla introduced by Φ. Alternatively, we have that there exists some stater junk such that: Proof sketch. The proof is broken down into several parts. First, we show that the average observed correlationŝ C 0 andĈ 1 approximates the ideal quantum correlation for the averaged state. The averaged state can be thought of as the state shared by Alice and Bob in each round of measurements, such that the average correlations of outcomes from this state match those observed in the real experiment (i.e.Ĉ 0 andĈ 1 ). Proving this step is done along similar lines to the approaches of [11,15]. The measurement process of Alice and Bob can be viewed as a stochastic process with bounded increment, i.e. a martingale. The specific martingale we consider encodes the correlations of their measurement outcomes. While the individual measurements need not be independent, we can still prove that this observed correlation is, with high probability, close to the ideal quantum correlation. To do this, we use the Azuma-Hoeffding inequality for martingales [43,44]. We then use the result of theorem 2 to show the closeness of the averaged state to an ideal Bell state. Lastly, we prove equation (5) by using an optimisation argument together with properties of trace distance and density matrices. Equation (6) follows from this through an application of the gentle measurement lemma [9]. The full proof is given in appendix D. , measurements however the closeness of a typical state, to a perfect Bell pair, is of order ( )  O 1 6 in this case. For a better comparison we will also compute the number of measurements as a function of the desired trace distance for a typical state. The proofs in appendix D show that the exact number of measurements required is ( , yielding a distance  = D c 1 figure 4. The graphs are represented as functions of the desired (decreasing) trace distance.
It should be noted that in the proof of theorem 4, we did not use the fact that Alice is trusted except when applying the self-testing result (theorem 2). Thus, a similar theorem can be proven in the case where both Alice and Bob are untrusted. In that case, one could simply use the self-testing results of [12,36,41,42] for the i.i.d. setting, and then obtain a statement about the closeness of a typical state to the ideal one in the non-i.i.d. setting using our techniques. For example, if we were to use theorem 2 from [36] we could once again establish from the measurement statistics that a typical state shared by Alice and Bob is close to a Bell state. This result completes the work of [36] for the non-i.i.d. setting.
It should additionally be noted that throughout this section we not only assumed that Alice's device is trusted but that it also measures the ideal Pauli operators. This could seem unreasonable from an experimental perspective, however note that any (fixed) deviation on Alice's measurement operator can be incorporated into ò. In other words, assume Alice's ideal operator is A and the deviated one is dA, such that: It is thus the case that the action of Alice's operators is δ-close to the action of the ideal operators which produce ò saturation. Hence, δ can be added to ò and viewed as a contribution to the total variation from maximal correlations. However, if such a deviation exists we should consider what happens when , then the error on Alice's device is smaller than the precision to which we wish to estimate the saturation of the correlations. Therefore, the saturation can still be considered of order ( )  O and the bounds on the states follow as in the ideal case. However, if  d > then the saturation cannot be estimated within the desired precision. This means that there will be an intrinsic limitation on the determined closeness of the shared states as given by a saturation of order ( ) d O .

Rigidity of quantum steering
We now proceed to prove rigidity of quantum steering games in a manner similar to that of [9]. In this setting, we assume that there is an unknown quantum state shared between Alice and Bob. By asking Alice and Bob to perform repeated measurements we would like to show that this state is close to a tensor product of Bell pairs possibly in tensor product with some additional state, up to local isometry. Additionally, we will show that Bob is essentially performing the correct measurements (recall that we are assuming Alice's measurements are trusted). Self-testing allows us to certify one Bell state and the local observables of Bob in a one-shot manner. Intuitively, it seems that we could perform sequential self-tests in order to certify multiple Bell pairs, thus recovering the tensor product structure. For example, according to theorem 4 we can conclude that after K rounds of measurement the reduced state in one of the rounds is, with high probability, close to a Bell state. We would then simply repeat this procedure N times in order to recover N Bell pairs, each one selected at random from each set of K rounds. This intuitive argument does not hold. As is also noted in [9], Bob's strategy and the untrusted states he prepares for a certain set of measurements can overlap with the states and strategy from another set. Thus, if the reduced state for round i is close to a Bell pair, and the reduced state for round j is close to a Bell pair, we cannot implicitly conclude that the reduced for both rounds i and j is close to two Bell pairs. We resolve this, in a manner similar to [9], by first defining a steering game akin to the CHSH game. We will then use theorem 4 to prove that the real strategy Alice and Bob use to play the steering game is close to the ideal strategy. Intuitively, the steering game is one in which we ask Alice and Bob to measure specific observables on their shared state and check to see if their outcomes match. For example, to saturate inequality 2 we would ask Alice and Bob to both measure the X observable or to both measure the Y observable. Since we trust Alice, we know that she is behaving honestly, whereas Bob could deviate from the ideal strategy. Note that we are assuming that there is a referee asking Alice and Bob to perform these measurements. Since Alice is trusted, we could have her act as the referee and send the instructions to Bob. Indeed that will be the case when we consider the verification setting. However, the two situations are equivalent. For this reason, in our formal treatment of the game we shall consider Alice and Bob to be the players and that there exists a referee which instructs them on what to do. The definition is as follows: Definition 1. We say that a game consisting of players Alice and Bob is a K -round steering game with threshold  T K iff the following conditions are satisfied: • Alice and Bob share a joint unknown quantum state |yñ.
• The game has K rounds.
• In round i, Alice is instructed by the referee to measure her half of |yñ with either the A 0 or A 1 two-outcome, single-qubit, anti-commuting observables, having±1 eigenvalues and record her measurement outcome (keeping it secret from Bob).
• Alice's measurement device is fully trusted to perform the correct measurement, moreover she has a complete characterisation of the device's Hilbert space.
• In round i, Bob is instructed by the referee to measure his half of |yñ with either the B 0 or B 1 two-outcome observables, having±1 eigenvalues and reports his outcome to Alice.
• Alice and Bob win the current round iff their outcomes are identical.
• Alice and Bob win the game iff they win at least T rounds.
Note that in the previous definition we match the conditions of theorem 4. Unlike Alice, Bob is untrusted and so his observables are unknown to Alice (and the referee). Moreover, the state |yñ is unknown and we can assume that it was prepared by Bob. We now define the correlation value of the game.

Definition 2.
Let W be the number of rounds that Alice and Bob win in a K -round steering game. The correlation value for the game is defined as the fraction W K .
It is useful to make the following observation: if we assume that Alice and Bob are measuring the same state, |fñ, in each round, then the correlation value of the game would be: In general, this might not be the case, since Bob is free to use any state in each round. In accordance with theorem 4, the correlation value of the game is then an estimate for the correlation of the averaged state. We use this fact to conclude something about the correlation of the reduced state in a randomly chosen round. This fact will be used to prove rigidity. Alice and Bob will be asked to play multiple steering games. Following the notation of [9] we will denote ρ as their shared state for all these games (unlike |yñ which is the state for one game) and for a specific game, j, we denote the operator associated with Alice's actions (measurements) as  j A and the operator associated with Bob's action as  j B . Thus, for N steering games, the triplet B encodes the strategy of Alice and Bob, where  j N . The ideal strategy, which we denote as  id , is the one in which r id is a tensor product of Bell states and Alice and Bob perform the measurements they are instructed to perform in each round. We need to show that   » id . This was shown in [9] for CHSH games by extracting a tensor structure in the individual Hilbert spaces of Alice and Bob from the tensor structure of their two spaces. In our case, because we trust Alice and her device, we already have a characterisation of her strategy and Hilbert space. Therefore, we need only use this to characterise Bob's strategy. As in [9], we do this by exploiting the following symmetry property of the Bell state , for any 2×2 matrix M. This essentially allows us to shift Bob's measurements to Alice's side, thus eliminating any dependence of his outcomes on previous qubits and establishing a tensor product structure. We will use this to create a strategy in which only Alice performs measurements. In analogy to [9], we start by defining an ò-structured steering game. Definition 3. We say that a K -round steering game is  -structured iff the game correlation value is greater than  -1 .
Alternatively, we can set the winning threshold for the game to . Thus, winning a steering game is equivalent to having an ò-structured steering game. Similarly, one can define an ò-structured strategy.
Note that this means that the majority of steering games, in a strategy, are  -structured. Lastly, we adapt a definition from [9] to characterise the closeness of two strategies. It should be noted that we will define two strategies as being close if the reduced actions of Alice and Bob on N randomly chosen rounds, in the two strategies, are close to each other. This contrasts the definition from [9], where two strategies are considered close if the actions of Alice and Bob for all rounds are close to each other. The reason for the difference is that we are only interested in establishing a tensor product of N Bell states and that Alice and Bob are performing ideal measurements on those N states. However, since we have N steering games, each consisting of K rounds, we will have NK rounds in total. Showing that all of these are close to ideal would lead to a large overhead which we would like to avoid.
be two strategies for playing N sequential Kround steering games. For   0, we say that strategy ò-simulates strategy  iff they both use the same Hilbert spaces and for all j: where R is a set of N round indices, each chosen at random from the N steering games. Additionally: And: Whenever we have that  ò-simulates , or an isometric extension of , we will write  » . This leads us to the main result: be Alice and Bob's ò-structured strategy for playing N sequential K -round steering games. Let be Alice and Bob's ideal strategy for playing N sequential steering games. We have that  ( )  O N 1 6 -simulates an isometric extension of  id .
Proof sketch. Firstly, it should be noted that for all j, id . This is because Alice is trusted and always playing according to the ideal strategy. The proof then consists of two steps. First we show that if the real strategy  is ò-structured, then   » g , where  g is a strategy in which Alice plays honestly and also guesses Bob's measurement outcomes. The guesses provided by Alice are taken to be Bob's outcomes for each game while the action on his subsystem is taken to be identity. The proof of this step relies on characterising the evolution of the quantum state ρ in the two strategies and using theorem 4 together with the ò-structured nature of the strategies. We then show that   » g id . To do this, note that in the guessing strategy we have effectively removed the problem of adaptivity. Since there is no untrusted Bob in  g , the original argument, of sequentially repeating self-testing, goes through. This allows us to show that  g is close to a similar guessing strategy, denoted g , which uses ideal Bell pairs. Lastly, this strategy is trivially close to the ideal one. We can then combine these results to show that   » id . The full proofs are given in appendix E. , Since N represents the number of Bell pairs we wish to certify, we see that in order to obtain a decreasing error, we require ( )  = -O N 6 . We also know from theorem 4 that given ò, the number of games required is of order . Therefore, we must have that ( ( )) = W K N N log 12 . Since each steering game comprises of K rounds, we have KN rounds in total, or ( ( )) W N N log 13 rounds of steering games. This becomes important for use in VDQC.

Comparison with other approaches
Before presenting the VDQC application, we briefly compare our approach to similar results. As mentioned, this paper builds on the work of self-testing the singlet of McKague et al [36]. While we use similar techniques to theirs, we assume that Alice is trusted and thus arrives at an improved bound for the closeness of |yñ to an ideal Bell pair ( ( ) 1 4 ). On the other hand, the results of [9] and [50] do arrive at an ( )  O bound for self-testing. However, we know that their techniques cannot improve the asymptotic closeness, since we have shown in theorem 3 that this bound is optimal up to constant factors.
When comparing the exact bounds, we obtained ( )   + + 3 2 8 2, which is smaller compared to that of [9], approximately  270 . The result of [50] obtained numerically an even smaller factor of  2.2 by using a semidefinite programme. Their technique could, in principle, be used to improve our approach as well. We also mention the result of Šupić and Hoban [51], which appeared concurrently with our own. They also consider the case of self-testing from steering correlations, obtaining an analytic bound of  13 and a numeric bound of  1.19 .
Furthermore, [50] also considers removing the i.i.d. assumption. Their approach is based on hypothesis testing, however the end result is to show that at least one state, out of all measured states, was close to a perfect Bell pair. In our case, theorem 4 establishes that a typical state, out of all measured states, was close to a perfect Bell pair. This is necessary in order to prove the rigidity result and certify a tensor product of Bell pairs.
For the rigidity of steering correlations we employed similar techniques to those of [9] to show that the strategy (consisting of states and measurements) associated with the real scenario is close to that of the ideal scenario. This is done by considering intermediate strategies and showing that they are close to both the real and the ideal one and therefore that the latter strategies are close to each other. The major difference with [9] is that because Alice is trusted, in our case, there was no added overhead in proving the closeness of these strategies to each other. This then lead to a reduced closeness bound.

Verified delegated quantum computation
The idea of VDQC is that a computationally weak verifier wants to delegate a computation to a powerful (quantum) prover, and at the same time be able to verify the correctness of the result received. In characterising VDQC protocols, we use the formalism of interactive proof systems [32,52]. For our setting, the prover is restricted to polynomial time quantum computations. Ideally we would like the verifier to be a fully classical computer, however it is still an open problem if this is possible, when there is a single prover [53]. Instead, it is known that if the verifier has some minimal quantum capabilities, he is able to verify the prover's computation [32,54]. Alternatively, if there are multiple non-communicating provers sharing entanglement it is possible to do verification with a fully classical verifier [9,10,12]. It should be noted that in certain cases not all the provers are quantum computers. For example, in the protocols of [10,11] there are two provers, one is a quantum computer (or server) and the other is an untrusted measurement device. Thus, throughout this paper we will refer explicitly to the provers by their role (i.e. quantum server, measurement device etc).

Existing approaches to VDQC
The first approaches to VDQC relied on having a classical verifier with a minimal quantum device. This device could be either a constant size quantum computer [32], or a single qubit preparation device [54]. In both cases, the verifier has both a classical and a quantum communication channel with the server. The quantum channel is used only in an initial phase to send quantum states to the server. Verification of the computation is then performed via classical communication only. Importantly, the quantum communication is offline, meaning it can be performed before the verifier even decides what computation she would like to perform (she must, however, fix the size of the computation to be performed). We will briefly explain one of these protocols, namely the one by Fitzsimons and Kashefi [54], which we shall refer to as the FK protocol. The reason for choosing this protocol is that many other VDQC protocols that were later developed have been based on FK [10,11,[55][56][57][58]63]. Furthermore the FK protocol is currently the optimal protocol from the point of view of the client's quantum capability requirements. Hence it is a good starting point in further reducing the trust assumptions as we intend to do in this section. We therefore use our results on quantum steering to modify one of the FK-based protocols.
The FK protocol is expressed in the measurement-based quantum computing (MBQC) model of computation and uses universal blind quantum computation (UBQC) [59] as a basis for verification. We succinctly explain the basic ideas behind these concepts as further details can be found here [59,60]. In MBQC, computation is achieved through a sequence of adaptive single-qubit measurements performed on a highly entangled state known as a graph state. It is possible to make this graph state highly regular, by having all qubits prepared in the | (| | ) +ñ = ñ + ñ 0 1 1 2 state and entangling them using the controlled-Z operation into a brickwork structure [54,59]. The qubits are then measured in the basis {| . In the following we give the main idea behind UBQC. A trusted client sends to an untrusted quantum server rotated qubits of the form |+ ñ q with angles θ chosen randomly from the set D. The server is then supposed to entangle these qubits in a generic graph state structure and then measure them in the basis , d Î D, as instructed by the client. The measurement angles are selected and adapted in order to perform a specific computation. Having no knowledge of the initial rotation angles (the θʼs), the measurement angles (the δʼs) will appear random to the server and so he will have no information about the computation being performed, apart from an upper bound on its size (given by the number of qubits). We illustrate this in figure 5. This blind computation procedure can be modified in order to perform verification as well, leading to the FK protocol.
In this case, the client, now known as a verifier, will also send computational basis states {| | } ñ ñ 0 , 1 to the server, interleaved randomly with the rotated qubits. The purpose of these states, called dummy qubits, is to isolate certain rotated qubits from the rest of the graph state qubits. Isolation is achieved because the controlled-Z operation when used with a dummy and a rotated qubit will not perform entanglement. The isolated qubits are called traps because the verifier will instruct the server to measure these qubits in their preparation basis (i.e. the measurement angle δ will match the rotation angle θ for each trap qubit), thus yielding a deterministic outcome. Because of blindness, the position of the traps is hidden from the server and so he is unaware if he is performing a trap measurement or a computation measurement. This allows the verifier to test, on average, the behaviour of the server and abort the protocol if he behaves maliciously. Schematically, this is shown in figure 6.
As mentioned, the FK protocol uses a verifier with a trusted preparation device, while the untrusted server is performing entangling and measuring operations. We refer to this as a prepare and measure type of protocol. There is another class of protocols that have the server prepare the graph state and send the qubits one by one to the verifier who performs single qubit measurements [56,61,62]. In this case, the verifier has a trusted measurement device instead of a preparation device. We refer to the latter class of protocols as measurement-only type of protocols. The main drawback of this approach is that the quantum communication is online (occurs  during the time that the quantum computation is performed). This means that the verifier must commit to the computation she wishes to perform when the quantum communication commences. In contrast to this, the FK protocol is offline and therefore the verifier does not need to make such a commitment. Instead, after the quantum communication has occurred, she is free to choose any computation up to a fixed size and communicate only classically with the server.
All of the approaches mentioned so far, relied on having a verifier with a trusted quantum device. It is also possible to have a fully classical verifier, with no quantum device, if we allow for multiple entangled quantum servers. Such is the case with the protocols presented in [9,12]. Alternatively, the verifier can have an untrusted measurement device and share entanglement with a single quantum server. This scenario is a device-independent version of the the prepare and measure protocols. The two existing approaches are presented in [10,11]. We will briefly describe the operation of these device-independent protocols, since a slight modification of them will lead to our one-sided device-independent protocol.
The setting of device-independent VDQC is the following: • The verifier has an untrusted measurement device. The device can measure the observables . The observables are primed to indicate they are untrusted.
• The server is instructed to initially prepare Bell states and send half of each state to the verifier.
• The measurement device and the server are assumed to be non-communicating.
• The verifier interacts only classically with both of these devices.
The verification protocol consists of the following two stages: 1. Verified state preparation-In this stage the verifier will use the shared entangled states with the server in order to prepare single qubit states on the server's side. These are the states which, in the FK protocol, were sent to the server having been prepared by the trusted quantum device and which will later be used to perform verified computation. In this case, because the measurement device is also untrusted, the verifier will have to interact with the two devices in order to certify the preparation of correct states on the server's side. In the protocol of [10], this is done using the rigidity property of CHSH games, whereas the protocol of [11] achieves this using a modified version of the Mayers-Yao self-test.
2. Verified computation-Having prepared the rotated states and dummy qubits on the server's side, the verifier proceeds to run the FK protocol as if she had sent the qubits to the server. It can be shown that the server is still blind following the preparation stage. Since this stage results in the preparation of imperfect states (ò-close to the ideal), it was necessary to show that the FK protocol is robust to deviations in the initial state.
It is worth pointing-out here, that any deviation of the server on the correctly prepared input of the FK, is detected by the verification mechanism of the FK protocol. In other words, the two stages can be separated, and the verified preparation can happen any time earlier than the verified computation. The main disadvantage of the device-independent protocols is the large round complexity in the state preparation stage, leading to an overall large complexity compared to other approaches. The main reason behind this blow-up, is the number of measurements that need to be performed in order to certify correct state preparation and additionally the measurements that need to be performed to test the honesty of the two devices. A major factor for this increase, is the need to certify the tensor product structure of Bell states shared, before the verifier uses them to prepare the states for the FK on the server's side. By allowing the verifier's device to be trusted, we can eliminate this last set of measurements and gain an advantage in terms of round complexity, leading to a one-sided device-independent VDQC protocol. In this protocol, similar to the measurement-only protocols, the verifier has a trusted measurement device. However, in our case, the (trusted) measurements can occur offline, since they are only involved in the verified state preparation stage.

Verification based on steering correlations
The setting we have, is that the verifier trusts her measuring device, but the server and the shared state, prepared by the server, are not trusted. Since our setting is identical, in terms of trust assumptions, to the one-sided device-independent self-testing scenario, we will sometimes refer to the verifier as Alice and the server as Bob. If Alice knew that the shared state with Bob is a tensor product of perfect Bell states, she could measure her side and collapse the state of the server to the desired input of FK. But since the state is untrusted, we will use the results of the previous sections to characterise the shared state from steering correlations. If Alice observes a close to maximal saturation of the steering correlations, she can conclude that the shared state is a tensor product of Bell pairs. This follows from the rigidity result of theorem 5. The result is analogous to that of [9,10] where the rigidity of CHSH games is used in the same fashion. All of this is encapsulated in protocol 1.

Assumptions
The verifier wants to delegate a quantum computation described by the graph G and specific measurement angles from the set { } p p 0, 4 ... 7 4 chosen to define a desired computation. For the FK protocol, used in stage 2, the graph G is encoded as a different graph,  , having M qubits. The verifier has a trusted single-qubit measurement device. , or the computational basis, but she also instructs the server to measure the corresponding entangled partner in the same basis.
-The server reports the measurement outcomes and if the results are not the same as the verifiers, the protocol is aborted. Stage 2: Verified computation (Robust FK) 3. If the protocol is not aborted in the previous stage, the verifier runs the (robust) FK protocol (given in [10]) with the server, using graph  (i.e. the qubits from the first step of Stage 1are treated as if they had been sent by the verifier to be entangled into the graph  and run the FK protocol).
During the verified state preparation stage, the verifier confirms that all her measurement outcomes agree with the measurement outcomes reported by the server. The number of measurement rounds, i.e. and > c 2048 for [10], respectively. Even though these do not follow from tight bounds, it seems clear that the added trust of the verifier's measurement device leads to a significant reduction in complexity.
Next we examine the verified computation stage. As the input obtained from the previous stage is not exact, but close in trace distance to the ideal state, we need to consider the robust version of the FK derived in [10]. Moreover, to obtain the optimal complexity, instead of using a dotted-complete graph as was done in [10,54], we will use the optimised resource construction introduced in [58], where the number of qubits in the encoded graph,  , is linear in the number of qubits in the computation graph G. This leads us to the following: Lemma 1. Protocol 1, for a computation of size M , utilises ( ( )) Q M M log 13 Bell pairs and has ( ( )) Q M M log 13 round complexity (rounds of interaction between the server and the verifier). The probability that the verifier accepts the outcome of the protocol, assuming honest behaviour by the server, is unity. If h is the probability that the verifier accepts an incorrect outcome in the FK protocol (verified computation stage), the overall probability of accepting an incorrect outcome for protocol 1 is h l + -1 , for some constant l > 1 fixed by the verifier.
Proof. As mentioned, the FK protocol with the encoding (resource state) defined in [58], or using the resource construction procedure of [63], has linear round complexity. Therefore, the round complexity of the verified computation stage is ( ) Q M . The verified preparation stage requires ( ( )) Q M M log 13 Bell pairs which are used to test the saturation of steering inequalities. Therefore, the overall round complexity is ( ( )) Q M M log 13 . In the honest run, the verified state preparation stage leads to preparing the ideal input, and therefore the probability of accepting an honest run is unity. This is because in the honest setting, the server prepares ideal Bell pairs and all states are measured correctly, leading to the correct rotated qubits on his side, which are then used in the FK protocol. The FK protocol also has probability of acceptance unity, when the server behaves honestly [54].
On the other hand, a dishonest run involves deviations in both state preparation and verified computation stages. In the first stage, a dishonest server would prepare states that are at most ( )  O 1 6 -deviated from the ideal by theorem 4. Here, ( )  = Q M 1 6 , in order to have a decreasing error in simulating the ideal strategy. Thus, the deviation per Bell pair is fixed however, the verifier can choose many measurement rounds for the steering games in the state preparation stage, reducing the deviation in the overall (tensor product) state. Concretely, if she chooses to run l M 12 6 steering games, then  l = --M 12 6 , for some fixed λ. The overall deviation, which is of order  M 1 6 , will then be of order l -2 . This constitutes the deviation in the state preparation stage. As explained in [10], the robustness of the FK protocol implies that if the computation stage has probability of acceptance, given dishonest behaviour, η and there is a deviation of order α in the state preparation phase, then the overall probability of accepting an incorrect outcome will be h a + . In our case, a l = -2 , hence the probability becomes h l + -1 . , The resulting protocol's round complexity is an improvement, over the device-independent approaches of [9,10,12]. The reason for this is that we benefited from the fact that Alice is trusted in the rigidity result. In particular, while there is a cost for removing the i.i.d. assumption, in the semi-trusted setting we have no extra cost to recover the tensor product structure from theorem 5. This leads to a better complexity when we extract the tensor product structure of Bell pairs, than the complexity obtained in the completely untrusted (deviceindependent) setting of [9]. On the other hand, in the case of FK where the verifier has a trusted preparation device and sends qubits to the server, the round complexity and number of used quantum states are linear in the size of the computation [58]. In our case, the main sources for overhead are: • Self-testing with i.i.d. states which gives a tight bound for the closeness of the state up order  .
• Gathering sufficient statistics in the non-i.i.d. setting to get a good estimate of the true quantum correlations for the averaged state. This required (( ) ( ))   W 1 log 1 2 rounds of measurements.
• Inferring the closeness of a typical state from the closeness of the averaged state, which gives a bound of order  1 6 .

Verification from partially entangled states
It is known that if the source of quantum states is trusted, then classical-quantum correlations are sufficient for verification [11,54]. Alternatively, in online verification protocols (where computation and quantum communication take place at the same time), it is possible to have an untrusted entanglement source and states which are less than maximally entangled. Our setting is that of offline verification with an untrusted entanglement source. We have seen that in both device-independent verification and one-sided device-independent verification we can characterise the tensor structure of Bell pairs between the verifier and the server from correlations. In both cases, saturating an inequality involving correlations leads to a bound on the trace distance between the shared state and perfect Bell pairs, up to an isometry. While this is sufficient, it does not seem necessary to use Bell states. In fact in QKD and random number generation, as mentioned previously, other types of states can also be used [27,28,[47][48][49] and so it is interesting to examine if this is also the case for verification. Here, interestingly, we show that under reasonable assumptions about the verification protocol, the entangled states must be unitarily equivalent to Bell states.
Quantum steering derives its name from the idea that with an entangled state one party could steer the state of another party through local measurement. The person who performs the steering is untrusted which in our case corresponds to the quantum server. The verifier, having a trusted measurement device, can check through local measurement, if the server behaved honestly and steered the state correctly. We consider such steerable states, r AB , shared between Alice (the verifier) and Bob (the server), which could be useful for verification in the one-sided device-independent scenario. Concretely, the specific type of verification we consider is one which is offline, measurement-only and blind. This is akin to the setting of our steering-based verification protocol, however we no longer assume the use of the FK protocol in the verified computation stage. Instead, we assume independent verification, i.e. a black-box type verification protocol obeying the three conditions we previously stated. Moreover, we assume that the verifier wishes to prepare a specific quantum input for her computation. This input is assumed to be as general as possible. Given these conditions, we wish to know what properties are required of a typical bipartite shared state r AB . Since we are interested in blind verification, it must be the case that ( ) r r = = I Tr 2

A AB B
. Additionally, because the verifier needs to prepare her quantum input on the server's side, and this can consist of a varied set of states, we will also assume that r AB must be completely steerable (i.e. can be steered to any state). We use the definition of complete steering from [64]. This is similar to QKD, where an adversary can have a purification of the state shared by Alice and Bob however he is uncorrelated with Alice or Bob. This is due to the monogamy of entanglement. Our main theorem concerning r AB will justify why this monogamy appears in the case of complete steerability as well. We note that the monogamy of quantum steering has been studied in other works [65,66]. Theorem 6. A bipartite state, r AB is totally steerable by Bob iff r AB is maximally entangled.
Proof sketch. The proof relies on considering r AB in matrix form and expressing constraints on its matrix elements using lemma 2 and the fact that r = I 2 B . Solving the system of constraints leads to a density matrix which can easily be shown to correspond to a pure, maximally entangled state. The complete proof is given in appendix F. , This theorem reveals that the r AB state is unitarily equivalent to a maximally entangled Bell state. Therefore, the monogamy of this state is in fact due to the monogamy of Bell states. Importantly, it shows that two-qubit states which are totally steerable are perfect Bell pairs. This implies that if we are to use total steerability in order to perform verification, we must certify Bell states in particular, rather than any other steerable state. Hence, for the case of offline, measurement-only, blind quantum verification, the quantum resources used for preparing the quantum input, must be unitarily equivalent to Bell states. Intuitively, this can be understood as follows. The verifier wishes to send a certain quantum input to the server. Since this input is as general as possible, the best way to do this is via the general teleportation protocol using Bell states. This also introduces a natural one-time padding to the states, which keeps the protocol blind. It is clear that in order to have perfect fidelity for the teleportation, the shared states must be equivalent to perfect Bell pairs.

Conclusion
We have shown that, in analogy to the rigidity of non-local correlations via CHSH games, we can prove a rigidity property of steering correlations. This allows us to establish a tensor product of Bell pairs in a setting of one trusted party and one untrusted party. However, in the case of steering, the extra cost to obtain a tensor product of Bell states is smaller than in the analogous situation for non-local correlations. While in both cases this overhead is polynomial, the additional trust assumptions of the steering setting allowed for a significantly reduced degree for this polynomial. We arrived at this result by first considering self-testing in the one-sided device-independent setting, using quantum steering correlations. The self-testing result, which makes an i.i.d assumption about the shared state, gives an optimal bound for the trace distance between this shared state and a Bell pair. We then removed the i.i.d. assumption in a generic way which can be applied to any type of self-testing result, allowing for the determination of a single Bell state (one-shot) in a fully adversarial setting. Combining this with a game-based approach for characterising the states and strategies of the two parties, has lead to the rigidity result. It should be noted, that the game-based approach is also used to prove the rigidity of non-local correlations. However, in our setting, because we trust one of the parties it is simpler to obtain a characterisation of the untrusted party's strategy and the shared states. Thus, our result has reduced overhead compared the analogous result for CHSH game rigidity.
We considered an application of rigidity to a verifiable quantum computation protocol. The reason for choosing this particular application is that for verifiable quantum computation the quantum states themselves should be recovered, and thus the necessity to obtain the full tensor product structure of Bell states. This is in contrast to QKD and QRNG where one does not need to recover the quantum state explicitly, rather an information theoretic quantity such as entropy, mutual information, key-rate etc. Using the rigidity of steering correlations we constructed a one-sided device-independent protocol for verifiable delegated quantum computation. The protocol we obtained has fewer requirements than the fully device-independent protocol thus being closer to a practical application. Lastly, we have shown that a certain class of states which are useful for verification, totally steerable states, are necessarily maximally entangled. This for example, rules-out the use of local but steerable states [26] for verification. Since establishing the existence of the tensor product structure of maximal entanglement requires the collection of a significant number of statistical samples, this result gives some indication to the general difficulty of quantum verification.
In this section we give a complete proof of theorem 1 which characterises one-sided device-independent selftesting. Consider the following isometry: An illustration of this isometry is given in figure 3, where the upper part is Bob's system and the lower part is Alice's system. It should be noted that the control gates act on the target when the control qubit is in the |-ñ y state, and act as identity when the control qubit is |+ ñ y . This is in contrast to the standard convention in which the control is a computational basis state. Here |+ ñ y and |-ñ y are the eigenstates of the Pauli Y operator and . We can clearly see that F = Ä F I A B , where F B is determined by the combination of ¢ X B and ¢ Y B operators, from expression (7), which only act on Bob's system. We proceed to show that when conditions (1)-(3) are satisfied, we obtain condition (4). First, we show that: Because M A only acts on Alice's system, whereas the isometry is local on Bob's system, M A trivially commutes to the left so that ( .
At the same time, the ideal Pauli operator Y B , acting on Bob's ancilla, has the following effect: This is because | | + ñ = + ñ Y y y and | | -ñ = --ñ Y y y and we notice that the two expressions are identical. Lastly, when ¢ = ¢ N X B B we have: And the action of the ideal operator yields: This is because | | + ñ = -ñ X i y y and | ( )| -ñ = -+ ñ X i y y . Using the approximate anti-commutation of ¢ X B and ¢ Y B , as given by condition (3), we notice that commuting ¢ X B to the left in ( | ) y F ¢ ñ X B will lead to the same expression as for (| ) y F ñ X B up to g 2 2 error. Thus: We therefore, only need to examine the closeness of (| ) y F ñ to the ideal Bell state tensored with some junk state. Start by considering the state: We will show that (| ) y F ñ and |fñ are close in trace distance. Firstly, from conditions (1) and (2) using suitable triangle inequalities and the unitarity of operators X A and Y A which do not increase trace distance, it can be shown that: Expanding the trace distance of (| ) y F ñ and |fñ we have: And using the above results it follows that: a a a a ñ = + ñ ñ + ñ + + ñ ñ -ñ Using the following identities: a a a a ñ = + ñ ñ + ñ + + ñ ñ -ñ The terms with b coefficient cancel out and we are left with:

B y y A y y A
This state is equivalent to: We would like to equate this to | |y ñ ñ + junk B A B , however, the state we have is unnormalized unless = a 1 2. We therefore compute a bound on | | a to determine the error introduced by the unnormalized state. Condition (1) can be rewritten as: By expanding |yñ, applying the operators X A , ¢ X B and using the facts that | | | | + = a b 1 2 2 and that ¢ X B is hermitian and has±1 eigenvalues, we obtain: And since for small g 1 we know that g -1 2 . Thus, it follows that: Lastly, together with inequality (11) and a triangle inequality, we get: Appendix B. Proof of theorem 2 Theorem 2 shows that saturating the correlation of observables on Alice and Bob's side, with Alice being trusted, leads to the necessary conditions of theorem 1 which imply that the shared state is close, up to local isometry, to a Bell state. Similar to theorem 1 we start the proof by denoting B 0 as ¢ X B and B 1 as ¢ Y B . Splitting equation (2), we have: However, it is clear that: So, it follows that:

A B
This allows us to derive conditions (1) and (2), since: Hence, in theorem 1,  g = 2 1 . Let us now denote: Computing S 2 and using the fact that A , we can alternatively write this as: The Cauchy-Schwarz inequality together with inequality (16) give us: Substituting S 2 : Hence: Expanding the commutators yields:

A A B B A A B B A A B B A A B B
By splitting into terms, as we did with inequality (16), we have that: Now using the fact that , we have: And using a triangle inequality, we have: Additionally: And from inequalities (19) and (20) we get that: Similarly, using inequalities (17) and (18), we have: Which leads to: Thus satisfying condition (3), with  g = 8 2 , and concluding the proof.

Appendix C. Proof of theorem 3
Theorems 1 and 2 show that if the correlation of local observables is saturated up to order ( )  O , the shared state is close, up to local isometry, to a Bell state up to order ( )  O . Theorem 3 shows that this bound is tight, up to constant factors. We prove this theorem by contradiction. Assume the bound of theorem 1 is not tight and it is possible to derive an asymptotically better bound for the shared state of Alice and Bob. In particular, this means that there is no state |yñ which is ( )  O -close to the |y ñ + state and there are no observables B 0 and B 1 such that inequality 3 is satisfied. However, letting   ¢ = 2, consider the following state: We have that: Notice that: Substituting this into the previous expression, and taking the first order term we have: Consider also the observables: . Importantly, we have that: And therefore: Thus, inequality 3 is saturated. But this should not be possible under the assumption that the bound on |yñʼs closeness to |y ñ + is not tight. Therefore, the assumption is false and the ( ) bound is tight for this type of steering inequality. Note that this result still holds under local isometry since the isometry is, by definition, distance preserving and so under the local isometry the state is still ( )  O -close to a Bell pair.

Appendix D. Proof of theorem 4
Theorem 4 shows that from the observed outcomes of Alice and Bob, after K rounds of measurement, we can conclude something about their shared quantum state in a single round, even without assuming independence. Simply stated, if the shared state of Alice and Bob is σ, we need not assume that σ is a tensor product of identical states. Nevertheless, denoting the state of round i as , from their shared correlations we can deduce that r i is close in trace distance to a perfect Bell state (under a suitable isometry). The proof consists of a number of steps: 1. Firstly, we show that the observed correlations of Alice and Bob's, given fixed measurement settings, is a good estimate for the true quantum correlation assuming they shared multiple copies of the averaged state r r = å = 3. Lastly, we prove that if the averaged state is close to a Bell state (possibly in tensor product with some mixed state), then a typical state r i is also close to that pure state and we compute the exact bound for the trace distance.
We start by proving the first step: be the history of their measurement outcomes up to, but not including round i. Finally, letting (ˆ| ) = C E C H i i i to be the conditional expectation value of the correlation given the previous history of outcomes, we have that for any d > 0: Proof. The variable C i represents the true correlation of the outcomes in round i, as determined by the shared state of Alice and Bob. If the shared state in round i is r i then ( ) r = C A B Tr i i . As mentioned, while we trust Alice and know that she is indeed measuring the observable A, we can still assume that Bob is measuring the observable B in each round. This is because the observable B is unrestricted (apart from being a two-outcome observable) and can in principle act on Bob's ancilla as well. Furthermore, we make no assumption about the state r i , since it is prepared by Bob. Another way in which we can express C i is using its definition, which leads us to: We now define the random variables: Notice that for any  j n, | |  - Therefore, { } X j forms a martingale. We can therefore apply the Azuma-Hoeffding inequality [43], in a manner analogous to [11,15]. Setting j=n, we have that for any > t 0: Expanding, we have that:  Thus concluding the proof of lemma 3. , We move on to the second step: Lemma 4. Suppose Alice and Bob are required to perform K rounds of measurement and also that: • Prior to the measurements, the shared state of Alice and Bob is assumed to be s.
• Alice chooses a random set of size K 2, consisting of indices from 1 to K and denoted Alice measures the observable A r i on her half of r i . A 0 and A 1 are anti-commuting single-qubit observables having 1 eigenvalues.
• In round i, Bob is asked to measure B r i . B 0 and B 1 have1 eigenvalues.
• We denote a i and b i , respectively, as the outcomes of their measurements in round i. We also denoteˆ= C a b i i i as their correlation for round i.
as the averaged correlations for the cases where both Alice and Bob are asked to measure the first observable, or both are asked to measure the second, respectively.
If, for some given  > 0 and suitably chosen ) then there exists an isometry Φ and a mixed state r junk such that: where  AB is some combination of the A A B B , , , Proof. We will prove the caseˆˆ  + - the derivation is similar. Additionally, we only consider the case  = I 0 0 1 1 Using theorem 2, it follows that there exists a local isometry Φ and a state | ñ junk such that, with probability ( )  --K 1 exp 16 2 , we have: This also implies: As mentioned, we are only considering the case of I acting on the state |zñ. Of course, the argument proceeds identically, when considering |z ¢ ñ M N A B , as in theorem 1, leading to the  ¹ I AB cases. It should be noted that from the construction of Φ (in theorem 1), in the case where the shared state is a purification of some mixed state (as is the case with |zñ and r avg ), the isometry does not act on the quantum states used for purification. Therefore, we can trace out those states, and since this operation cannot increase trace distance we have that: we are left with: avg junk Analogously, we get: , .

AB AB avg junk
Concluding the proof of lemma 4. , The final step towards proving theorem 4 is to prove the following statement: Lemma 5. Let r be a general quantum state which we can write as r r = å = n i n i 1 1 , for some > n 0 and density matrices r i . If it is the case that, for some pure state |fñ and g > 0: .
Then for a uniformly at random chosen , with probability at least g -1 1 3 we have that: Proof. Starting with the bound on the trace distance and the relation between trace distance and fidelity (when one state is pure), we obtain: where the second inequality follows from convexity and for convenience we defined This gives a lower bound on the average q i (average fidelity squared). To provide an upper bound on the average q i , we do the following. We let p be the fraction of iʼs such that  g d -- we have that with probability at least g -1 1 3 : We can now use these lemmas to prove theorem 4.
Proof of theorem 4. We have the same assumptions as in lemma 4 and from it we know that after (( ) ( ))   = W K 1 log 1 2 rounds of measurements, if the observed correlations are saturated up to order ò we have: , .

AB AB avg junk
We would now like to apply lemma 5, however because of r junk we do not have a pure state in the trace distance expression. Therefore, we trace out the junk subsystem, and since tracing out can only decrease trace distance we have that: , we can now apply lemma 5. Note that ( ( (·)))  F Tr AB junk is a linear map, since it is the composition of linear maps. Therefore, it is the case that: ( ( ( ))) ( ( ( )))   This leads to: Appendix E. Proof of theorem 5 As mentioned, we prove theorem 5 by showing that the actual strategy  of Alice and Bob is close to a strategy  g in which Alice guesses Bob's outcomes, which in turn is close to the ideal strategy  id .
be Alice and Bob's ò-structured strategy for playing N sequential K -round steering games in which Alice plays honestly. Let B be Alice and Bob's ò-structured strategy for playing N sequential K -round steering games, in which Alice plays as in  but also guesses Bob's outcomes. Specifically, Bob's operator will be  i B , which yields Alice's guesses for Bob's outcomes. We have that  ( Proof. Without loss of generality, it can be assume that the initial state ρ is a pure state. Also note that Alice's action is given by B the action of Alice and Bob on the state of the ith game, corresponding to the true strategy  . Note that we can assume the same Hilbert space in both strategies. The reason for this is that Alice's side is trusted in the two strategies, so her Hilbert space is determined and fixed. On Bob's side, assume we have Hilbert space  B in strategy  . In strategy  g we are ignoring Bob's outcomes and replacing them with Alice's guesses. Therefore, we can assume any Hilbert space on Bob's side, so without loss of generality we assume it is  B . Thus strategies  and  g use the same Hilbert space. We to be the first j random indices (i.e. the randomly selected rounds up to game j). We would like to compute a bound for: We do this inductively, starting with the first steering game. Theorem 4 tells us that for a K-round steering game, if we observe a steering inequality saturation of order ( )  O the reduced state in a randomly chosen round will be ( )  O 1 6 close to a Bell state. Since we know that strategies  and  g are ò-structured, it follows that for the first steering game we have that: The specific isometry we have considered acts locally in each round (i.e., in each round it only acts on the reduced state of that round and introduces one ancilla qubit). Thus, it is possible in this case to commute the isometry with the tracing out operation, and then remove it completely from the inequality, since it is distance preserving. Of course, the tracing out operation will be acting on a different system (the non-isometrized system), requiring a different notation. In order to avoid complicating the notation, we use the same expression for the tracing out operation, and it is to be understood that we trace out all systems apart from the ones used in round 1. We therefore have: This is the base case of our induction. Assume now the following holds: We would like to show: For the set of rounds from game j we can again apply theorem 4, and use the closeness bound for the state from round k j . Note that for the first game, the shared state of Alice and Bob was |yñ, while the state in game j need not be a pure state. We can, however, still apply theorem 4, regardless of the action of previous games, since the theorem assumes that Alice and Bob share some state σ which can be either pure or mixed. Moreover, as before, we will have thatˆ  = j AB j AB 1, 1, , hence the reduced state in round k j from strategy  is ( )  O 1 6 -close to the state in round k j from strategy  g . This together with equation (23) and a triangle inequality lead to: Hence, strategy  ( )  O N 1 6 -simulates strategy  g . , B be Alice and Bob's  -structured strategy for playing N sequential K -round steering games, in which Alice plays as in  but also guesses Bob's outcomes. Specifically, Bob's operator will be  i B , which yields Alice's guesses for Bob's outcomes. Let be the ideal strategy in which r id is a tensor product of Bell pairs and Alice and Bob play N sequential K -round steering games ideally (i.e. they measure the same operators on their shared state). We have that  g ( )  O N 1 6 -simulates an isometric extension of  id , or   » g id .
Proof. We shall first consider another guessing strategyˆ( . This strategy is identical to  g except for the fact that it uses the ideal state (the tensor product of Bell states) as opposed to the real state, ρ. Note that r id must lie in the same Hilbert space as ρ. Without loss of generality, we can use some isometry to take a tensor product of Bell states and map it to the Hilbert space of ρ and denote that state as r id . It is easy to see that   » g g . On the one hand, both strategies use the same operators for Alice and Bob (and in fact will produce identical statistics). On the other hand, since Alice is effectively guessing for Bob and the action on his subsystem is identity, there is no adaptivity in his strategy or outcomes. Combining this with the fact that the strategies are ò-structured, means that we can extract individual Bell pairs from each steering game and hence: We now show  » g id . First note that, as before, { }  i A corresponds to the ideal strategy for Alice and appears in both g and  id since she is always honest. Additionally, as mentioned in the previous proof, because she is playing honestly according to the ideal strategy, her guesses for Bob's outcomes will be exactly her own measurement outcomes. This mimics the ideal strategy. In the ideal strategy Alice and Bob measure the same operators on their shared state. Moreover, both strategies are using the ideal state r id . This directly implies that: ( ( ( )) ( ( ))) ( )     r r Alternatively, we could have used the fact that g and  id use the same state and both strategies are ò-structured, as in the previous lemma, to prove the same thing. Thus, it follows that strategy  g ( )  O N 1 6 -simulates an isometric extension of strategy  id , or   » g id . , It is worth mentioning that in the case of steering, unlike CHSH, the outcomes are deterministic, so Alice can guess perfectly for Bob. This led to a simplified rigidity proof compared to the one for CHSH games from [9]. Finally, we prove theorem 5.
Proof. From lemmas 6 and 7 we have that   » g and that   » g id . Since in lemma 7 we have shown that  g ( )  O N 1 6 -simulates an isometric extension of  id we can consider an isometric extension of  id , denoted  ¢ id that has the same Hilbert space as strategy  . Using a triangle inequality it follows that   » ¢ id . Thus  ( )  O N 1 6 -simulates an isometric extension of the ideal strategy  id . ,