General quantum Bernoulli factory: framework analysis and experiments

The unremitting pursuit for quantum advantages gives rise to the discovery of a quantum-enhanced randomness processing named quantum Bernoulli factory (QBF). This quantum enhanced process can show its priority over the corresponding classical process through readily available experimental resources, thus in the near term it may be capable of accelerating the applications of classical Bernoulli factories, such as the widely used sampling algorithms. In this work, we provide the framework analysis of the QBF. We thoroughly analyze the quantum state evolution in this process, discovering the field structure of the constructible quantum states. Our framework analysis shows that naturally, the previous works can be described as specific instances of this framework. Then, as a proof of principle, we experimentally demonstrate this framework via an entangled two-photon source along with a reconfigurable photonic logic, and show the advantages of the QBF over the classical model through a classically infeasible instance. These results may stimulate the discovery of advantages of the quantum randomness processing in a wider range of tasks, as well as its potential applications.


I. INTRODUCTION
Quantum computers are trusted to be advanced over the classical machines in information processing, because of the counterintuitive features of quantum mechanics [1][2][3][4][5][6].Conventional efforts for quantum computing achieve the milestone named "quantum computational advantages" by building large-scale controllable computing devices [7][8][9][10][11].However, there exist tasks where the advantages of quantum system over the classical system can be realized without building large quantum systems, such as the quantum Bernoulli factory [12].
Consider the following problem: given a biased coin with unknown probability p for head, by tossing this coin, can we exactly simulate a coin with probability f (p) to get a head?For example, if f (p) = p 2 , we can toss the coin twice and claim a head if both the results are head.In this case, we obtain a classical Bernoulli factory (CBF) for function f (p) = p 2 [13][14][15].Any function f (p) is "constructible" if there exists such a process that its success probability is f (p) regardless of the value of p, which also corresponds to simulate a biased coin with probability f (p) for head (denoted by f (p)-coin for simplicity).Importantly, the process should be expected to finish in finite steps, which means the expected number of coins consumed in the process is also finite.This type of processes is flexible and efficient in generating a variety of binary distributions, and have been applied in scenarios such as enhancing the Markov chain Monte Carlo process for intractable distributions [16][17][18][19], exact simulations of diffusions [20,21] and the estimation for ocean circulations [22].
Unfortunately, for any classically constructible f (p)-coins, the function f (p) is bounded by three conditions [23]: (i) The function should be continuous on its domain; (ii) The function should not reach 0 or 1 within its domain; (iii) The function should not approach 0 or 1 exponentially fast near any edge of its domain.Functions violating the conditions require infinite coin tossing if they are intended to be exactly constructed, such as the "Bernoulli doubling" function f ∧ (p) = 2p, p ∈ [0, 0.5], which is believed to be fundamental for other classical Bernoulli factory processes [24].
To push this limit of the CBF, it can be generalized to a quantum version named quantum Bernoulli factory (QBF), which can accelerate the construction processes as well [12].The QBF is a randomness processing task which applies quantum coins (or quoins) to produce classical coins.It starts from a group of identical quoins, each of which is actually a single-qubit state |ψ p = √ p|0 + √ 1 − p|1 where p is the unknown parameter.With the quantum coherence and entanglement, the QBF is capable to produce strictly more results than those can be produced in CBF, including the Bernoulli doubling function, and the experimental demonstration of this phenomenon requires quite few physical resources [25,26].
However, the proposed works of the QBF mainly analyze the advantages that can be obtained by utilizing quantum coherence.Meanwhile, previous efforts only focused on specific cases such as the QBF for the Bernoulli doubling function, or analyzed the range of constructible quantum states in single-qubit cases, while the multi-qubit cases were not sufficiently studied [27,28].
Addressing these problems, in this work, we completely analyze the evolution of multi-qubit quantum states in the QBF for classical coin generation, and found that the arbitrary constructible states can be characterized by a field structure.We then analyze the impacts of different capabilities of the quantum processors on the range of constructible coins and the construction performance.Finally, we experimentally realize the framework of QBF and show the advantages of quantum randomness process over its classical counterpart through a classically infeasible instance.Our work indicates the potentials of QBF in accelerating the applications where the CBF were already applied, and may motivate the interdisciplinary studies of quantum computing and randomness processing.

II. CONSTRUCTIBLE STATES IN THE QBF
The key to push the limits of the CBF is to construct proper quantum states.In QBF, the quantum states are evolved from several copies of the state |ψ p = √ p|0 + √ 1 − p|1 , where p is the unknown parameter corresponding to the p-coin in the CBF.The goal of this analysis is to find out whether a p-involved state (i.e.any amplitudes of these states are functions of p) can be obtained from |ψ p , and a state is constructible if it can be transformed from |ψ p in finite steps with a nonzero probability.In each step, one can apply unitary operations or measurements.The states which already have been constructed can be used as auxiliary qubits.
Firstly, we briefly review the single-qubit cases [27].Generally, a single-qubit p-involved state can be represented by |ψ o = k 0 (p)|0 + k 1 (p)|1 , where k 0 (p) and k 1 (p) are functions of p, satisfying |k 0 (p)| 2 + |k 1 (p)| 2 = 1.We concentrate on the amplitude of the |0 basis, and rewrite the state as where c(p) is the coefficient for normalization, and h(p) = k 0 (p)/k 1 (p) is called the relative amplitude.It has been proved [27] that a single-qubit state |h(p) is constructible if and only if h(p) belongs to the field M which is spanned by p-involved term p 1−p and the complex field, that is where g i (p) are polynomials in p with complex coefficients.Note that here our goal is to construct the state |h(p) exactly with the unknown parameter p.Though we can approximate any well-behaved functions with polynomials, which however requires extremely large number of steps to reach a certain accuracy.Besides, since the relative amplitudes of the constructible quoins form a field, the unitary operations corresponding to the basic operations defined for this field provide a general approach to produce arbitrary constructible states.However, since the produced states are limited in single-qubit cases, it is unable to perform the joint measurement on the result state to obtain classical probability as done in ref [12,26].
To tackle this issue, we generalize this result to multi-qubit cases.For a general QBF process, it produces an n-qubit state |K(p) = 2 n −1 i=0 k i (p)|i from several copies of |ψ p in finite steps with a nonzero probability, where n ≥ 1 and k i (p) are functions of p, satisfying In each step, one can apply arbitrary unitary operations, or measurements on any part of this state.Here we are using |i to represent an n-qubit computational basis, with its binary form representing the states of all the qubits, i.e.
We denote all the constructible states by the notion of Bernoulli states.We then rewrite the n-qubit Bernoulli state as where is the relative amplitude, and c(p) is used for normalization.Our result is the following theorem.
Theorem.An n-qubit state |K(p) = c(p) Here we show the key steps to prove this theorem, and the detailed proof can be found in the supplementary information.Let S be the set of the relative amplitudes of all constructible states, then our goal is to prove S = M.The necessity (that is S ⊆ M) is easy to show based on the conclusion of ref. [27].For the sufficiency (that is M ⊆ S), since any two amplitudes can be switched under specific unitary operations, in the following we focuses on h 0 (p) without lossing generality.Suppose that we have a multi-qubit state |K(p) as described by eq. ( 3) and a single-qubit state |l(p) = l(p)|0 + |1 , then the target is to find a group of unitary operations to construct the following states: where the c i (p) are the coefficients for normalization.These unitary operations only changes the relative amplitude of the |0 basis, and therefore respectively realizes the three field-operations including inversion, multiplication, and addition operation.This indicates that the set S is closed under these three operations, and therefore it is exactly the filed M.

III. THE FRAMEWORK OF THE QBF
Basically, the process in QBF can be divided into two phases, the quantum state evolution and the classical coin tossing, and the quantum measurements act as the bridge linking the two phases.The capability of the quantum processor is a key factor to the performance of the QBF.For the CBF, there exist no quantum operations, as shown in Fig. 1(a).The gradually release of the capabilities of the quantum processors raises three types of QBF, as shown in Fig. 1(b).
The first type is the QBF that supports only single qubit unitary operations for quantum state evolution.As has been proved that to cover the whole range of constructible coins of the QBF, the only single-qubit unitary operation used is in the following form [12].
where a is a real number.The functions constructed from the quantum evolution are in a fixed format of , which form a set denoted by Q 1 1 .In this notation, the '1' in the superscript represents that the output states is limited in single-qubit, and the '1' in the subscript indicates that the unitary operations are restricted in single-qubit.For a ∈ (0, 1), f a (p) is not classically constructible because f a (p) reaches 0 when p = a.Then, if associated with the further classical processing, it can reach a result set Q 1  1 C that is strictly larger than that in the CBF.
For the second type, the QBF is enhanced by allowing arbitrary quantum unitary operations for state evolution, but only constructing single-qubit states 2 -coins for further classical processing.During the process, the quantumly constructed coins form a set denoted by Q 1 , and finally the classical processing can reach a set labelled as , the quantum processor in the type-2 QBF can be completely replaced by a type-1 QBF, while the following duplicated classical processing can not offer new results.This means that the type-2 QBF is structurally equivalent to a type-1 QBF followed by a classical coin processor (see supplementary for details).This obviously indicates that they are equivalent in terms of the range of constructible coins, i.e.
The enhancement on the quantum processor mainly accelerate the construction for some specific functions [12,26].
The type-3 QBF uses a quantum processor which supports arbitrary quantum unitary operations and measurements, and generates an n-qubit Bernoulli state (see equation ( 3)).Then we can apply joint measurement on this state, and construct a classical coin with success probability of where B is the set of chosen bases of measurement corresponding to full probability, and H ⊆ B is the set of bases chosen for a head output.The results obtained beyond set B are discarded.Here we only consider the measurement in the computational basis, since other bases can be converted into computational basis through proper unitary operations.The joint measurement on multi-qubit states allows a wider range of quantumly constructible coins, which forms the set denoted as Q, and the complete set after classical processing is denoted as QC.The proposed experiment in ref. [26] for 4p(1 − p)-coin is an instance of this strategy, which optimized the experimental realization by directly applying Bell measurement on a 2-qubit state |ψ p |ψ p where |ψ p = √ p|0 + √ 1 − p|1 .Similarly, we can prove that Q Q 1  1 C, which further indicates the equality between Q 1 1 C and QC.We place the complete proof in the supplementary methods.In summary, the relationship of the constructible sets can be described by as shown in Fig. 1(c).

IV. EXPERIMENTAL DEMONSTRATION
In the experimental demonstration, the hardness concentrates on the implementation of the quantum processor.Without losing generality, we implement the quantum processor of the type-2 QBF, which is the special case of the type-3 QBF and is also an important part of the quantum state generation in the type-3 QBF.The goal of this experiment is to demonstrate the basic operations for manipulating the relative amplitude of an arbitrary given state, as shown in Fig. 2(a).
We design the quantum circuits for these operations, as shown in Fig. 2(b-d).Since the inversion requires only a Pauli X gate, we focus on the realization of the multiply and add operations.The multiply operation can be implemented with two qubits and a C-NOT gate.The simplified circuit for add operation uses a C-M 0 X gate, which is implemented by adding control to a group of gate operations [29,30]   the quantum Bernoulli factories with different quantum processors.They first evolve the p-quoins (|ψp ) with supported operations, and transform the result states into classical probabilities through the measurement which respectively constitute constructible sets denoted by Q 1  1 , Q 1 or Q, where the superscript and subscript respectively represent that the constructible states and the unitary operations in the quantum processor are restricted in 1 qubit.The whole QBF processes can construct coins from set Q 1 1 C, Q 1 C and QC respectively.(c) The relationship between the constructible sets.We find the equality among the QC sets.In summary, we have where M 0 (M 1 ) is the projection operator corresponding to |0 (|1 ).Note that these circuits apply for arbitrary given states.
We built a configurable two-qubit photonic processor, as shown in Fig. 2(e).In the setup, entangled photons are generated through the type-I spontaneous parametric down-conversion (SPDC) process by focusing a diagonally polarized continuous-wave laser beam with central wavelength of 405nm onto two orthogonal BBO crystals, generating state |ψ 0 = (|HH +|V V )/ √ 2, where |H and |V represent the horizontal polarization state and vertical polarization state respectively.Then the entangled photons are injected into two Sagnac structures.Within the Sagnac loops, the entangled photons are converted to be spatially entangled through the PBS part (the red reflecting surface) of the PBS/BS mixed crystal.In each spatial path, a half-waveplate and a quarter-waveplate are used for encoding the input state where the h 1 and h 2 are parameters of the input Bernoulli states, which have been assigned specific values in the realization.The four spacial modes pass through different optical elements.The polarizers in the "1T" and "1R" paths are fixed to be horizontal and vertical respectively.By placing different combinations of optical elements in the configurable parts labeled as A and B in the logic, we can implement different two-qubit operations.After being mixed in the BS part of the mixed crystal (the reflecting surface marked blue), and further operated by the configurable parts C, the state becomes The state identification is done through a polarizer associated with a quarter-waveplate and a half-waveplate, and another polarizer is used for post-selection.At last, photons are filtered with two 3nm band filters.
For the multiply operation, the photonic logic is configured as a C-NOT gate.Specifically, the parts A and C are configured as identity gates, part B is configured as a Pauli X gate.We then measure the second qubit.If we get |H , the remaining qubit collapsed to |ψ × = h 1 h 2 |H + |V .Note that the result state is not normalized.For the add operation, the first X gate can be merged into the state initialization by preparing the initial state to be |h −1 1 |h 2 , and then we configure A as an identity gate, B as the combination of an M 0 gate and an X gate, and C as a Hadamard gate.We then measure the first qubit, and if we get |H , the remaining qubit will collapse to |ψ 1.000 -1.000 2.000 -2.000 0.000 0.000 0.000 Our setup employs entangled photons for quantum operations.Recently, a similar experiment was proposed which applied single photons for the realizations of the operations [28].Compared with our non-unitary realization which directly completes the add operation, they implemented a unitary operation slightly different from the original one from Ref. [27], and required one more step to complete the add operation.
The key part of the photonic logic is the CNOT gate.We evaluate its fidelity [31], and gives that its process fidelity F p can be bounded as 91.40% ≤ F p ≤ 94.16% (see supplementary information for details).To assess the realized operations, we then take some typical states or random states as input, then measure the fidelities of the output states.The average fidelity of all the states generated by multiply operations and add operations are 95.58 ± 4.29% and 96.52 ± 4.41% respectively.The results and the parameters of the input states are shown in Fig. 3.More detailed data can be found in the supplementary information.

V. EXPERIMENTAL EXAMPLE OF THE QBF
Actually, the quantum devices can only approximate the target function, which makes it possible to produce the experimental results with classical protocols.In this case, we show that quantum protocols can also show advantages over the classical ones.We take an example of a f c (p)-coin, where the function f c (p) is given by Theoretically, this function is infeasible for classical Bernoulli factory because f c ( 1 2 ) = 0, while it can be constructed by directly measuring the Bernoulli state |f q (p) = c q (p)((2p − 1)|0 + |1 ).We design the circuit for this state by the basic operations, and then simplify it to suit our photonic logic.Specifically, part A and part B are configured so that the sagnac loops act as a C-NOT gate, and part C is consisted of a Hadmard gate and a following Pauli X gate.
We measured the fidelities of the outcome states, and then get the success probability of the output coins by measuring the output state in σ z basis.The average fidelity of the states is 98.23%, and the results agree the theoretical values well, as shown in Fig. 4. The success probability of the construction is Pr c = (2p − 1) 2 + 1 /16, which reaches the minimum value of 1/16 when p = 0.5, this indicates that ideally we need 32 quoins to construct an f c coin.However owing to the photon loss during the computation, this number would goes up to ∼ 54 (see supplementary information for details).value of p, where the error bars are too small to be visible (see supplementary information for detailed data).The shaded area is the confidential bound of f (p) estimated according to the fidelities of the produced states.The probabilities (red circles) are obtained through coincidence counts with the total counts accumulated for about 1 minute, and the photon-pair counts recorded ranges from around 400 to about 1,000 according to the different value of p.
For comparison, we provide an efficient classical approach to reproduce the experimental results.Note that the target function can be rewritten as where g(p) = 4p(1 − p).Obviously, the hardness centers on generating g(p)-coins [12,25].The generation of g(p)coin can be realized through constructing function f 1 (p) = 2p(1 − p) and f 2 (p) = 2p.For 2p(1 − p)-coins, they can be easily constructed by tossing a p-coin twice.However, ideally the 2p-coin is infeasible for the classical process, but the experimental error results in the subtle rotation of the line.By fitting the experimental results, we found that it only requires to construct a 1.868p-coin for p ∈ [0, 0.5] to fit the experimental results.Following ref. [32], the coin consumption is bounded by 9.5C/ where C = 1.868 and = 1 − C/2.The overall coin consumption is N c ∼ 1.080 × 10 3 .This protocol consumes 2 orders of magnitude less resources than the related results presented in ref. [26] for the linear function, but still consumes about 20-fold more resources than that of the quantum protocol.
To the best of our knowledge, this protocol is nearly optimum.Note that in this case the coin-consumption in the classical protocol scales with the experimental error as N c ∼ O( −1 ) [32], while in the quantum protocol, the average quoin-consumption is constant after the experiment has been set up.Besides, with the improvement of the experiment accuracy, the corresponding resource consumption of the classical protocol would increase dramatically.In our realization, we presented a more complicated physical realization of the QBF, which corresponds to the basic operations defined in the type-2 QBF, and still demonstrates the advantages over the classical protocol.

VI. DISCUSSION
In this work, we thoroughly answer whether a p-involved state can be implemented from |ψ p , regardless of the limit on the quantity of qubits.We find the general field structure of the arbitrary Bernoulli states, and show how the multi-qubit states can be used for generating classical probabilities.We further compare three types of quantum Bernoulli factories, and show that the enhancement of the quantum processor can enhance the construction efficiency and reduce the resource consumption.
We experimentally demonstrate the framework of the quantum Bernoulli factory and discuss its advantages in the efficiency and the resource consumption compared with the classical model.Although our quantum realization is not optimal to construct the target function f c (p), it offers universality for producing a wider range of possible outcomes.The experimental complexity of multi-qubit system introduces more experimental loss, and makes it more sensitive to noise or subtle imperfect settings of the optical elements.But it still shows superiority over the classical protocols.These results may stimulate the potential of the QBF in accelerating the applications where the CBF has already been applied.

I. THE CONSTRUCTIBILITY OF THE BERNOULLI STATES A. Proof of the main theorem
Our analysis focuses on what quantum states can be constructed from a set of |ψ p = √ p|0 + √ 1 − p|1 .Firstly, we consider the constructibility of the single-qubit Bernoulli states, which is the main theorem of ref. [S1].
Theorem [S1].An single-qubit state is constructible if and only if every h(p) belongs to M. Note that in this presentation of |h(p) , the coefficient c(p) appeared in eq. 1 is ignored.Similarly, we will omit the normalizing coefficient in the following.
Proof.We briefly review its proof.Let S be the set of h(p) of the constructible single-qubit states, and we need to prove S = M.
• Necessity (S ⊆ M): The necessity can be easily obtained from the following statement: Statement [S1].For any constructible |φ = j s j (p)|j , the ratio of arbitrary two amplitudes of |φ belongs to M. It is easy to find that this statement keeps true under any unitary operations and measurement operations.Meanwhile, if this statement is true for n qubit cases, then it is easy to find that it is also true for n + 1 qubit cases.Based on these two features, this statement can be proved.
• Sufficiency (M ⊆ S): Because set M is the field generated by the complex field and p 1−p , we need to confirm that p 1−p ∈ S, and S is a field.

Since we have the initial state as |ψ
Also, because all the constant states are constructible, we can know that the complex field is contained in S. The key of the proof resides on that the multiplication, addition and the multiplicative inversion on p-involved states are closed in S.
Suppose that we have h 1 (p), h 2 (p) ∈ S, all we have to do is to find unitary operations which realize the three operations.
-Inverse: Apply Pauli-X on |h 1 (p) , and we get and then measure the first qubit.If we get |0 , the rest qubit will be in state . Then applying the inversion and multiplication, we can know that h 1 (p) + h 2 (p) ∈ S, and the set S is closed under addition.
So S is a field, and we complete the proof.Now we move to our main theorem, which is a generalization of the theorem in ref. [S1].Here we recall our main theorem: Theorem.An n-qubit state Proof.Let S be the set of relative amplitudes of any constructible states.Here we prove S = M.For simplicity, we omit the normalization coefficient c(p) appeared in equation (3) in the main text.
• Necessity (S ⊆ M): The necessity can be proved according to the same statement.
• Sufficiency (M ⊆ S): Suppose we have implemented a state |K(p) = Thus h 0 (p)l(p) ∈ S. -Add: it requires an specific 2 n+1 × 2 n+1 unitary B n .This unitary looks like an eye matrix, with part of its diagonal similar to a Hadmard matrix The up left 1 √ 2 appears at the 2 n -th diagonal position, and the bottom right 1 √ 2 is in the (2 n + (k + 1))-th position, where |k is the basis to conduct the add operation.Without loss of generality, we are going to manipulate the relative amplitude h 0 (p) with k = 0. Then we apply B n on |L(p) |K(p) , and measure the first qubit.If we get |1 , the state will collapse to Therefore, S is a field.We initially have access to |p and arbitrary constant qubits, so the generator of S contains p 1−p and the complex field, and we conclude M ⊆ S. Combining the necessity and sufficiency, we complete our proof.
By using the operations, we know that each amplitude can be manipulated without changing other amplitudes, i.e. each amplitude can be manipulated independently.To apply the basic operations on different amplitudes, one can just slightly modify the auxiliary states and unitary matrix used, and follow the same procedure. For 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 and we have Then, we measure the first qubit.If we get |1 , we then obtain and the other relative amplitudes are not changed.

B. The algorithm for generating arbitrary constructible n-qubit states
If n = 1, i.e. we are going to construct a single-qubit Bernoulli factory, we can construct it following the procedure in ref. [S1].
If n > 1, our method starts from a constant balanced n-qubit state (not necessarily normalized) and then multiply |f i (p) with |Ψ on the corresponding basis one by one.

II. THE FRAMEWORK ANALYSIS OF QUANTUM BERNOULLI FACTORY
We divided the QBF into 3 types according to the capabilities of their quantum processors.The type-1 QBF supports only single qubit operations, the type-2 QBF supports arbitrary unitary operations but only produces single-qubit states, and the type-3 QBF provides a universal condition for states construction.Now we provide more details about the analysis of the bound of the constructible sets of these three types of QBFs.
Recall that Q 1 1 C is the final constructible set of type-1 QBF, and Q is the set of classical coins that can be generated by measuring a Bernoulli state that contains no less than one qubit.
(2) Both Z = z i : f (z i ) = 0 and W = w i : f (w i ) = 1 are finite sets.
(3) ∀z ∈ Z, there exist constants c, δ > 0 and integer k < ∞ such that The difference is concentrated on dealing with the continuity of f .
For the classical coins from Q where B is the set of bases remained within the post selection of the measurement, and H ⊆ B is the set of bases chosen for a head output.According to the main theorem, there exist a series of complex multivariate polynomials R i (x 1 , x 2 , x 3 ), such that For arbitrary f (p) ∈ Q, we prove that f (p) satisfies the SPB conditions.
• (1) f (p) is continuous.The only issue to consider about is that there might be some strange points that belong to both the zeros of the dominator and numerator.For example, we can construct a state Note that this state is not normalized.Then we can obtain the classical function Fortunately, we can handle this exception by using a small trick.Let f e (p) be the function after extracting factors involving the common zeros, so that there is no common zero between the numerator and dominator in f e (p) (such as s e (p) in equation (S18)).We denote the zeros of R i as Z i .It is easy to show that f (p) is continuous in [0, 1] − i∈B Z i , and obviously, f e (p) is continuous in [0, 1], and therefore f e (p) satisfies the SPB conditions, i.e. f e (p) is constructible, it is of course that f e (p) is constructible when we limit the range of p, i.e. f e (p) is constructible for p ∈ [0, 1] − i∈B Z i .Therefore, we can simulate f e (p) for p ∈ [0, 1] − i∈B Z i , which is equivalent to simulate f (p).In other words, we can extended f (p) to [0, 1], which is exactly f e (p).In this way, we can handle the continuity of the functions.
, and has finite zeros in [0,1].We can then find out that the set of Z is and obviously Z is finite.Similarly, W = i / ∈H Z i ∩ [0, 1] is finite.In summary, both Z and W are finite.It is worth noting that at the breaking points of f (i.e. the joint set of all Z i for i ∈ B), the function f can be extended to be a continuous one with the inserted value given by equation (S18).
• (3) ∀z ∈ Z, there exist constants c, δ > 0 and integer k < ∞ such that This can be easily checked using Lemma 2.
• (4) ∀w ∈ W , there exist constants c, δ > 0 and integer k < ∞ such that This just requires to have 1 − f (p) ≥ c(p − w) 2k .Note that w is then one of the zeros of 1 − f (p).Therefore the satisfiability of this condition can be similarly obtained through Lemma 2.

B. The equality of the QC sets
We provide an illustrative proof for this result, as shown in Fig. S1.We firstly show that QC = Q 1 1 C.The quantum operations for type-3 QBF can reach a set denoted as Q, and with the above results, we know that Q ⊂ Q 1  1 C. Therefore, we can just replace the quantum processor of type-3 QBF with a complete type-1 QBF.Then, because of that Q 1 1 C is closed under the classical processing, the whole process is equivalent with a standard type-1 QBF, and we obtain the result that QC = Q 1  1 C. Owing to the same reason, we also have that Here we show protocols in view of the framework of QBF for constructing function g(p) = 4p(1 − p).The classical function g(p) is an important function, that servers as the core elements for many other functions.In ref. [S3], this function is experimentally constructed utilizing quantum coherence, and the results showed that quantum entanglement is not necessary for the construction.However, it has been experimentally shown that when utilizing quantum entanglement, the construction efficiency can be greatly enhanced, along with the reduction of resource consumption by orders of magnitudes compared with the cases where only single-qubit operations are used [S4].
The type-1 QBF protocol.The first protocol uses single-qubit operations, which has the following procedures.
1. (Quantum processing) generate a p-coin, which is done by directly measuring |ψ p in σ z basis.Recall that a f (p)-coin is a classical coin with probability f (p) to output a head, and 1 − f (p) to output a tail; 2. (Quantum processing) generate a q-coin, where q . This coin can be constructed by applying Hadmard gate on |ψ p and then measure it in σ z basis, or directly measuring |ψ p in D/A basis; 3. (Classical processing) construct an m-coin from p-coins, where m = 2p(1 − p).This is a purely classical process by tossing the p-coin twice.Similarly, one can construct an n-coin where n = 2q(1 4. (Classical processing) construct a s-coin from m-coins, where s = m/(m + 1).Toss the m-coin twice, if the first toss is tail, then output tail; otherwise if the second toss is tail, output head; otherwise if both tosses are head, repeat this step.Similarly, construct a t-coin from n-coins, where t = n/(n + 1); 5. (Classical processing) construct a g(p) = 4p(1 − p)-coin by toss a s-coin and then toss a t-coin.If the first toss is head, and the second toss is tail, then output head; if the first toss is tail and the second toss is head, then output tail; otherwise repeat this step.

p-quoin
Step 1: Step 2: Set quantum operations on 1-qubit states constructing coins from 1-qubit states The quantum state evolution in these procedures involves only single-qubit operation, which can be easily done on our photonic processor.
The type-2 QBF protocol.The second protocol for g(p)-coin is finished in type-2 QBF, where arbitrary quantum operations can be applied for generating a single-qubit Bernoulli state, which is then measured to produce a classical coin for classical processing.Note that in this case, the joint-measurement is not allowed because this kind of operations are equivalent to multi-particle operations.Therefore the Bell-measurement protocol metioned in ref. [S2] is beyond the capability of type-2 QBF.In type-2 QBF protocol, the g(p)-coin can be generated by solely quantum operations and no more classical processes are required, because there exists a single-qubit state for the g(p)-coin: Measuring |ψ g in σ z basis can directly obtain the g(p)-coin.Assuring the existence of the corresponding Bernoulli state, we can then optimize the circuit that constructs |ψ g , as shown in the following procedures.
1. (Quantum processing) apply CNOT on |ψ p |ψ p , resulting in 2. (Quantum processing) apply Hadmard operation on the first qubit to obtain 3. (Quantum processing) apply CNOT on |ψ 2 , and post-selecting the second qubit in |1 basis will give 4. (Quantum processing) measure |ψ g will result in the target function.
The type-3 QBF protocol.The third protocol for g(p)-coin is generating a multi-qubit Bernoulli states for probability measurement.In fact, we just need to prepare |Ψ ini = |ψ p |ψ p , and choose the set of measuring base as Note that in this case what B and H contain are not the computational bases, and eq.6 obtained can be described by: To show this more clearly, we finish this process in computational bases.The first two steps are the same with the second protocol, then we directly measure the probability from this 2-qubit state |ψ 2 (see eq. S24), and g(p) is the probability of obtaining |01 on condition of obtaining |01 and |10 Obviously, the type-3 QBF protocol is the most efficient.This indicates that with the enhancement of the quantum processors, the whole process can be accelerated.

D. The definitions of the sets
During the analysis, there appears various sets of constructible functions.Here we list the definitions of the sets.

• Set M and set S
The set M is the field generated from p 1−p and the complex field, where p is an unknown parameter.The formula form of set M is shown in eq. 2. S is the set of all the possible relative amplitudes of the constructible states, which is equal to set M.

• Set C
This set contains all constructible functions of classical Bernoulli factory.The characterization of this set can be described by the three conditions [S5]: (1) The function should be continuous on its domain; (2) The function should not reach 0 or 1 within its domain; (3) The function should not approach 0 or 1 exponentially fast near any edge of its domain.
It is the set of classical functions constructed by the quantum processor that evolves |ψ p using a specific type of unitary (eq. 5 in main text), and therefore this set can be written as where . These functions are those used in the method of ref. [S2].
This set contains the constructible functions by using the quantum processor embedded within the type-2 QBF to construct a single-qubit Bernoulli state, and then measure this state to obtain a classical result.Specifically, where k 0 (p) and k 1 (p) are functions of p and satisfy |k 0 (p)| 2 + |k 1 (p)| 2 = 1.
• Set Q This set contains the constructible functions by the quantum processor of type-3 QBF.This is the general case for set Q 1 where the states generated are free of restrictions on the number of qubits.Specifically, we generate an n-qubit Bernoulli state |K(p) = c(p)

and obtain a function in set
where each h i (p) is the relative amplitude of |K(p) , B is the set of bases corresponding to the full probability in the measurement, and H ⊆ B is the set of bases chosen for a head output.
• Set Q 1 1 C This set is the constructible functions of the type-1 QBF obtained by feeding functions in Q 1  1 into the classical processing.This set is bounded by three conditions: (1) the function should be continuous in its domain.(2) this function should reach 0 or 1 in its domain for finite times.(3) The function should not approach 0 or 1 exponentially fast on any edge of its domain.The detailed characterization of this set is analyzed in [S2].
This set contains the constructible functions of the type-2 QBF, obtained by feeding functions in Q 1 into the classical processing.We find that this set is equal to Q This set contains the constructible functions of the type-3 QBF, obtained by feeding functions in Q into the classical processing.We find that this set is equal to Q 1 1 C.

III. EXPERIMENTAL DEMONSTRATION OF THE FRAMEWORK OF QBF
FIG.
2(e) in the main text shows the experimental proposal.The entangled photons are obtained through the type-1 SPDC process.Before being injected into the two Sagnac interferometers, the photons are in the following state: where |0 and |1 represent the horizontal and vertical polarization respectively.Then each of the two photons goes into a Sagnac interferometer, which consists of a PBS/BS mixed crystal and three prisms.The PBS part of the cube converts the polarization-entanglement to the spatial entanglement, so that the state becomes: where 1T , 2T , 1R and 2R represent different spatial modes labelled in FIG.2(e) (main text).Four groups of waveplates (including one HWP and one QWP), denoted by T 1H , T 1V , T 2H and T 2V (the labels are not marked in the figure) are placed in each path.These waveplates work on the polarization of the four spacial modes, and prepare the states into The initial state for the operations can be represented by The configurable parts in each spatial mode are then applied to the states.In our implementation, the elements placed in modes of 1T and 2T are fixed to be the projectors in horizontal and vertical polarizations respectively, with the elements in the other two spatial modes reconfigurable.These optical elements turn the state to where M 0 and M 1 are the projectors to |0 and |1 respectively.The success probability of this step is 1/2.A and B denote the two sets of configurable elements.After this operation, the spatial modes are mixed in the BS parts of the crystals.We post-select one of the ports of each crystal (where the probability amplitude is 1 √ 2 for each photon), eliminating the path information, and the state becomes with success probability of 1/4.Finally, the configurable element C before the detector for the first qubit is applied on this state, and we obtained the final state (S37) By configuring A, B, and C, we can realize different operations.It is worth noting that the reflection of the beam on the surfaces of prisms and the PBS/BS cube act as Pauli-Z gates, and can be compensated by a half-wave plate fixed at 0 • .

A. State evolution within the multiply operation
In multiply operation, the circuit is shown in Fig. 2(c), where the Sagnac interferometers are configured to be a C-NOT gate.Specifically, the parts A and C are configured to identity using half-waveplates fixed at 0 • , and B acts as a Pauli-X gate, via a half-waveplate fixed at 45 • .For simplicity, the states in the following discussion are not necessarily normalized.The initial states are prepared to be where h 1 and h 2 are the relative amplitudes of the input states, which are constant numbers or functions of p. Theoretically, the relative amplitudes are functions of p, while within the experiments, the parameters are usually assigned specific values.Note that the states are not necessarily normalized.We can obtain a final state from equation (S37), that is Combine equation (S38) and equation (S39), the result state is We then post-select the second qubit in |0 basis, and the result state collapses to Interestingly, if we post-select the second qubit of |ψ o in |1 basis, we can implement a division operation instead, turning the outcome state to be |ψ d = h1 h2 |0 + |1 .

B. State evolution within the add operation
The circuit to implement the add operation is quite complicated, which is to implement a unitary denoted by B: The circuit requires 3 qubits and 5 control-operations.where the unitary B consists of 4 C-NOT gates and 2 single-qubit rotation gates.By applying unitary B on the first 2 qubits, we obtain The post-selection of the first qubit in |1 basis makes the second qubit collapse into: Then multiply |ψ o2 with a constant state ( √ 2|0 + |1 ) produces the final state: We simplify the circuit, as shown in Fig. 2(d) in main text.Practically, the reversion on the first qubit is merged into the initial state preparation, that is, we prepare the initial state to be The configurable elements are then reconfigured for the add operation.Specifically, A is configured as identity using a half-waveplate fixed at 0 • , B is the M 0 X gate by using a half-waveplate fixed at 45 • and a polarizer that filters photons with horizontal polarization, and C is the Hadamard gate (using a half-waveplate fixed at 22.5 • ).Combining with equation (S37), the output state before the post-selection is Then, post-select the first qubit in |0 basis, and we will obtain the final state of |ψ a as shown in equation (S45).Similarly, if we post-select the first qubit in |1 basis, we can implement subtract operation instead.

C. Success probability of the operations
As discussed in the above section, the final state is obtained through several cascades of poet-selections.From the representations of the final output state, we can find that the success probability is different according to different values of h 1 and h 2 .
The success probabilities for the multiply operation and add operation can be calculated by .

(S48)
It means that for some specific values of h 1 and h 2 , the success probability to obtain the result states become quite low, making it more difficult to evaluate the fidelity of the output state.The maximum success probability for multiply operation reaches

D. Evaluation of C-NOT gate
We configure the photonic logic to be a C-NOT gate, and then use the method proposed in [S6] to evaluate the C-NOT gate.The process fidelity of the C-NOT gate can be evaluated through the measurement of two truth tables in complimentary basis and then calculate the classical fidelities of the two truth tables through

(S50)
The results of the two truth tables of the C-NOT gate in the form of coincidence counts are shown in TABLE SI.By converting the coincidence counts into probability, as shown in FIG.S3 and TABLE SII, we can evaluate the classical fidelities of the two truth tables through H X FIG.S4: The quantum circuit for the example quoin.
the loss of transmission, we firstly prepare the state |ψ p |ψ p , and place no optical elements in the sagnac loops, and then accumulate the coincidence counts, which represents the total number of state |ψ p |ψ p recieved.Then we place the optical elements in, and accumulate the coincidence counts.By comparing the two results of coincidence counts, we found that around 2/5 photons would be lost during the transmission.Thus totally we need about 27 copies of |ψ p |ψ p states, i.e. ∼54 quoins for one f c (p)-coin with p = 0.5.Because of the experimental imperfection, the value of the constructed function can not reach 0 when p = 0.5.This provide the possibility for classical construction.We provide an efficient approach for this construction.The route for constructing f c (p) is (S58) Step s.1 can be finished by tossing the coin twice.In step s.3 and step s.5, the only thing to do is to change the tail and head defined for the coins.In step s.4, it requires to construct a 1/(1 + p)-coin, which can be constructed by the following steps: Toss the p-coin twice, if the first toss is tail, then output tail; otherwise if the second toss is tail, output head; otherwise if both tosses are head, repeat this step.The expectation for tossing p-coins is (S59) Then the only difficulty resides on step s.2, where it quires to construct a 2p-coin, which is classical infeasible.We analyze the experimental data, and found that since p ∈ [0, 1], then 2p(1 − p) ∈ [0, 0.5].let q = 2p(1 − p), then we need to construct a l(q) = Cq-coin, where q ∈ [0, 0.5], and C is a parameter should be 2 if the experiment is ideal.Practically the parameter C can be obtained by fitting the experimental results, and this function can be classically feasible as long as C ≤ 2. According to the experimental results, we infer the corresponding results obtained for Cq-coin as shown in Tab.SIII.Since it appears the duplicated value of q, we take the average value of Cq, and by fitting the data we have C ∼ 1.868 and it satisfies 2Cp(1 − p) < 1 − 0.066 for 2p(1 − p) ≤ 0.5.Now we accumulate the coin-consumption in each step.

FIG. 1 :
FIG. 1: The framework analysis of the QBF.(a) the classical Bernoulli factory (CBF), which can construct functions in set C; (b)

FIG. 2 :
FIG. 2: The experimental proposal.(a) The set of basic operations corresponding to field M. The h 1 and h 2 are parameters of the input Bernoulli states, which can be constant numbers or functions of p, and have been assigned values in the realization.Note that the states are not normalized for simplicity.(b) Circuits for the inverse operation; (c) Circuits for the multiply operation.It requires two qubits and a C-NOT gate on them; (d) Circuits for the add operation.The control-M 0 X gate is obtained through equation (8).(e) The experimental principle.The main part of the experimental setup is a configurable two-qubit gate implemented with two displaced Sagnac interferometers.The whole process is activated by a pair of entanglement photons produced through type-I SPDC process.A, B and C are configurable parts, representing different combinations of optical elements for different operations.

FidelityFIG. 4 :
FIG. 4: Experimental results of generating fc(p)-coins.The black solid rhombuses are the fidelities of the states corresponding to different

2 n − 2 i=0
h i (p)|i + |2 n − 1 , and another single-qubit state |L(p) = l(p)|0 + |1 where h i (p) ∈ S, (i = 0, 1, 2, ..., 2 n − 2) and l(p) ∈ S. Without loss of generality, we show that the relative amplitude of |0 in |K(p) can be manipulated without changing other relative amplitudes.The other relative amplitudes can be manipulated in the similar way.The set that h 0 (p) belongs to is closed under addition and multiply, and containing multiplicative inverse for each element.Thus the set S is a field which contains element p 1−p and complex field.In other words, S = M.The details are shown as below.-Inverse: because h 0 (p) ∈ S, we can implement a single-qubit state |h 0 (p) = c 0 (p)(h 0 (p)|0 + |1 ) according to the theorem of ref. [S1].We then switch the amplitudes of |0 |0 ⊗n and |1 |2 n − 1 of |h 0 (p) |K(p) , and then measure the first qubit.If we get |0 , the rest qubits will collapse to

Step 3 :
classical operations on the coins Step 1: quantum operations on n-qubit states Step 2: constructing coins from n-qubit states Set 1. QBF for p-quoin f (p)-coin Step 3: classical operations on the coins Step 1: quantum operations on 1-qubit states Step 2: constructing coins from 1

FIG. S1 :
FIG. S1:The capability of QBFs in different types are the same.

FIG. S2 :
FIG. S2: Circuits for Add Operation By Implementing Unitary B

F 4 F
f (i)|i) denotes the probability to obtain the theoretical output f (i) when the input i is given.We choose {|HH , |HV , |V H , |V V } and {|DD , |DA , |AD , |AA } as the bases for the fidelity evaluation, thus the classical fidelities can be calculated through HV = Pr(HH|HH) + Pr(HV |HV ) + Pr(V H|V V ) + Pr(V V |V H) DA = Pr(DD|DD) + Pr(DA|AA) + Pr(AD|AD) + Pr(AA|DA) 4 .

TABLE SI :
Truth tables of C-NOT gate.In both the tables, the first row represents the input basis and the first column represents the output basis.The coincidence counts are accumulated in 50 seconds.

TABLE SIII :
Corresponding data for the linear function l(q) = Cq to construct.