Quantum randomness certication with untrusted measurements and few probe states Kieran Neil Wilkinson1Casper Ahl Breum1Tobias Gehring1and Jonatan Bohr Brask1 1Center for Macroscopic Quantum States bigQ Department of Physics
2025-04-29
0
0
3.78MB
18 页
10玖币
侵权投诉
Quantum randomness certification with untrusted measurements and few probe states
Kieran Neil Wilkinson,1, ∗Casper Ahl Breum,1Tobias Gehring,1and Jonatan Bohr Brask1
1Center for Macroscopic Quantum States (bigQ), Department of Physics,
Technical University of Denmark, 2800 Kongens Lyngby, Denmark
We present a scheme for quantum random-number generation from an untrusted measurement
device and a trusted source and demonstrate it experimentally. No assumptions about noise or
imperfections in the measurement are required, and the scheme is simple to implement with existing
technology. The measurement device is probed with a few trusted states and the output entropy can
be lower bounded conditioned on the observed outcome distribution. The protocol can be applied
to measurements with any finite number of outcomes and in particular can be realised by homodyne
measurements of the vacuum using a detector probed by coherent states, as we experimentally
demonstrate by intensity modulation of a telecom-wavelength pilot laser followed by homodyne
detection and discretisation by analog-to-digital conversion. We show that randomness can be
certified in the presence of both Gaussian additive noise and non-Gaussian imperfections.
Random numbers are central to a range of applica-
tions in science and technology, including numerical sim-
ulation, statistical sampling, gaming, and secure infor-
mation processing [1]. In particular, for cryptographic
applications, security relies on the inability of any ad-
versary to predict the random numbers used to generate
cryptographic keys. To establish security, it is thus cru-
cial to provide rigorous bounds on the predictability of
the randomness used.
Within classical physics, such randomness certifica-
tion necessarily relies on assumptions on the knowledge
and computational resources available to potential eaves-
droppers. The inherent randomness in measurements on
quantum systems, on the other hand, allows certifica-
tion to be based directly on measurable properties of the
devices used, under the reasonable assumption that ad-
versaries are also constrained by quantum physics [2–4].
Provided a characterisation of a quantum state and mea-
surement – e.g. the output path of a single photon im-
pinging on a beam splitter [5] – the predictability relative
to any adversary can be bounded. Exploiting quantum
nonlocality [6, 7], the need for accurate characterisation
of the devices can even be eliminated, provided the mea-
surement data violates a Bell inequality [8, 9]. This has
been demonstrated experimentally [9–14] and provides a
very strong level of security, known as device indepen-
dence, since the devices may be largely untrusted.
However, device-independent schemes are also much
more challenging to realise than simple device-dependent
ones. It, therefore, makes sense to explore the trade-off
between security and ease of implementation, identify-
ing schemes that are fast and simple to realise at the
price of introducing some limited amount of trust in the
devices. Such protocols are broadly termed semi-device-
independent, and many different setups with partially
characterised state preparation or measurements have
been considered, see e.g. [15–30]. One simple approach
∗Current address: Quantinuum, 17 Beaumont St, Oxford OX1
2NA
i
p(k|0)
...
Hmin
p(k|n1)
ADC
LO
Binning
p
(k
|
!
1
)
k
bound entropy
for !0
probe states
FIG. 1. Top: General protocol. An untrusted detector is
probed with a set of trusted states and the distributions of
outcomes are recorded. The min-entropy of the data corre-
sponding to one of the states be lower bounded given the
observations, and finally randomness extraction is applied.
Bottom: implementation based on homodyning the vacuum.
The generation and additional probe states are the vacuum
and a set of coherent states with varying amplitude and fixed
phase. The measurement is homodyne detection. The signal
is discretised into d= 2∆bins by an ADC.
to quantum randomness generation, which can reach very
high rates, is to extract randomness from optical quadra-
ture measurements of the vacuum state [31–34]. This
also allows for fast, source-device-independent schemes
[23, 25], and security in settings with correlations across
measurement rounds [35].
In this work, we first develop a method for random-
ness certification from a trusted source in prepare-and-
measure setups, where the measurement is partially char-
acterised using a small set of known input states. We
arXiv:2210.13608v1 [quant-ph] 24 Oct 2022
2
then apply our framework to homodyning of the vacuum
in an optical setup and demonstrate this scheme in an
experiment.
The method is illustrated in the upper panel of Fig. 1.
A measurement device – initially an uncharacterised
black box – is probed using a (small) set of known quan-
tum states {ρ0, . . . , ρn−1}, and the distributions p(k|ρi)
of outcomes are recorded. The entropy produced by
measurements on a fixed state ρ0can be bounded via
semidefinite programming using the observed data as
constraints, without further assumptions about the be-
haviour or noise affecting the measurement device. This
approach is general and applies to any prepare-and-
measure scenario in which some input states may be
trusted.
In the case of homodyne measurements of the vac-
uum, the fixed input is the vacuum state, and we take
the remaining states to be coherent states with varying
amplitude. The (untrusted) measurement is detection
of a fixed quadrature, discretised by analogue-to-digital
conversion to a finite number of outcomes. We show
that significant min-entropy can be produced using just
a few probe states, in the presence of both Gaussian and
non-Gaussian noise. We note that the scheme operates
far from the regime of detector tomography and already
with the vacuum and a single coherent state, randomness
can be extracted. Experimentally, we demonstrate our
scheme in a simple optical setup with up to four probe
states. In the following, we first describe the protocol
and then our experimental implementation.
In general, the randomness relative to an adversary
(Eve) can be quantified by how well Eve is able to predict
the outcomes in generation rounds, i.e. by the guessing
probability pgthat she correctly predicts the output k
when the input is ρ0. By the left-over hash lemma, the
asymptotic number of extractable random bits per round
is then given by the min-entropy Hmin =−log2pg. We
now show how pgmay be upper bounded (and hence
Hmin lower bounded) by a semidefinite program (SDP).
The measurement device implements some unknown,
noisy measurement. While the user observes only the
average behaviour, we assume Eve has perfect knowl-
edge of these measurements, which we associate with
ad-outcome positive-operator-valued measure (POVM)
ˆ
Πλ
k. Here, λlabels the measurement strategies, which
occur with distribution qλ. For a particular POVM, the
probability that Eve guesses correctly is determined by
the most likely outcome pg= max
kTrhρ0ˆ
Πλ
ki. An upper
bound on pgis then found by optimising over POVMs
ˆ
Πλ
kand probability distributions qλ, given the average
observed behaviour
pg≤min
{qλ,ˆ
Πλ
k}
qλmax
kTr hρ0ˆ
Πλ
ki
s.t.X
λ
qλTrhρiˆ
Πλ
ki=p(k|ρi)∀i, k.
(1)
This optimisation is not yet an SDP as it is nonlin-
ear in ˆ
Πλ
kand qλand contains the maximisation over
k. The latter issue can be resolved by observing that,
while the number of strategies available to Eve is a pri-
ori unlimited, following the logic of Ref. [36], all strate-
gies for which the most likely kin (1) is the same can
be grouped together. Thus we need only consider ddif-
ferent POVMs, and we can let λlabel the optimal k,
i.e. max
kTrhρ0ˆ
Πλ
ki= Trhρ0ˆ
Πλ
λi. The problem can now
be linearised by introducing new variables ˆ
Mλ
k=qλˆ
Πλ
k.
We obtain
pg= max
{ˆ
Mλ
k}
d
X
λ=1
Tr hρ0ˆ
Mλ
λi
s.t.ˆ
Mλ
k≥0∀k, λ
d
X
k=1
ˆ
Mλ
k=1
DTr "X
k
ˆ
Mλ
k#I∀λ
d
X
λ=1
Trhρiˆ
Mλ
ki=p(k|ρi)∀i, k
(2)
which is an SDP. Here, Dis the dimension of the POVM
elements, and the first two constraints ensure that the
ˆ
Mλ
kform a valid POVM and the qλa valid probability
distribution. Note while ideally we do not want to con-
strain the dimension, when implementing the SDP, D
must be finite. Dshould thus be chosen sufficiently large
to not affect the optimum. Also note that in practice, it
is often more useful to work with the dual SDP, in which
the observed data enters in the objective function and
not in the constraints. We derive the dual in App. A.
Next, we apply our scheme to the particular case of ho-
modyning the vacuum and probing with coherent states.
We will model both additive Gaussian noise in the mea-
surement and non-Gaussian noise from the analogue-to-
digital converter (ADC), in order to compute how much
randomness one may expect to extract from such a pro-
tocol. We stress, however, that in bounding the entropy,
no assumptions are made about the particular form of
the noise or the measurement.
The setup is illustrated in the lower panel of Fig. 1.
The trusted input states are ρ0=|0ih0|and ρi=|αiihαi|,
with αireal, i.e. along the X-quadrature. We take
the untrusted measurement to be of the X-quadrature,
binned by a ∆-bit ADC to give d= 2∆outcomes. In the
absence of imperfections, the measurement before bin-
ning is a projection |xihx|onto quadrature eigenstates.
To include noise, we consider a Gaussian distribution of
variance σ2
nand mean xthat converts the projector |xihx|
into a POVM element
ˆ
Σx=Z∞
−∞ |yihy|exp −(y−x)2/2σ2
n
√2πσn
dy. (3)
The noise strength is thus determined by σnand can be
stated in terms of the signal-to-noise ratio (SNR) σ2
v/σ2
n,
where σ2
vis the vacuum variance. The noise is additive
3
as the observed variance for a Gaussian input state with
variance σ2
vbecomes σ2
v+σ2
n. We also account for a
detection efficiency η(which transforms αi→√ηαiin
the calculation of the outcome distributions).
The ADC bins continuous outcomes into d= 2∆inter-
vals Ik, where klabels the corresponding outputs. For
an ideal ADC, the POVM elements thus become
ˆ
Σk=ZIk
ˆ
Σxdx, (4)
with ˆ
Σxgiven by (3). Commonly, the Ikare d−2 adjacent
bins of equal width that span a range Ron both sides of
a central point in the X-quadrature. The remaining two
end bins cover the values below and above this range.
Mathematically, we have
Ik=
(−∞,−R] if k= 0
[ak−δ/2, ak+δ/2) if k= 1, . . . , d −2
(R, ∞) if k=d−1
(5)
where ak=−R+(2k−1)δ/2 and δ= 2R/(d−2) is the bin
width. Apriori, for randomness generation from the vac-
uum, a uniform distribution over kis desired and the bin
widths should then vary with k, since the corresponding
X-quadrature distribution is a Gaussian. However, this
is not always optimal here where additional probe states
are also considered. Moreover, it is difficult to implement
with standard ADCs, and thus less relevant experimen-
tally. For completeness, in Apps. B and C we do consider
varying bin widths as well as a setting where the average
detector POVM is completely known (i.e. the limit where
the set of probe states is tomographically complete).
Modern ADCs achieve high speeds by interleaving sev-
eral individual ADC units in time. This can lead to a
non-Gaussian noise effect where the weights of adjacent
even and odd bins become imbalanced. We model the
corresponding POVM as
ˆ
Σγ
k=(ˆ
Σk+γˆ
Σk+1 (keven)
(1 −γ)ˆ
Σk(kodd) (6)
which can be understood as follows. For each odd bin,
a fraction γof events corresponding to this outcome are
shifted to the neighbouring even bin above. Given this
model of the imperfect measurement device, we can com-
pute the outcome distributions p(k|ρi) needed in the SDP
(2). We have
pγ(k|α) = (p(k|α) + γp(k+ 1|α) (keven)
(1 −γ)p(k|α) (kodd) (7)
where, as shown in App. B,
p(k|α) = Trh|αihα|ˆ
Σki(8)
=1
2erf [υ(bk)] −1
2erf [υ(ak)] ,(9)
0.0
0.1
0.2
0.3
0.4
(a)
∆=1
∆=2
∆=3
∆=4
0.1
0.2
0.3
0.4
Hmin [bits]
(b)
2 probes
3 probes
4 probes
5 probes
−10 −5 0 5 10 15 20 25
SNR [dB]
0.1
0.2
0.3
0.4
(c)
γ= 0.25
γ= 1.0
FIG. 2. Results from modeling the protocol. The min-entropy
is shown vs. the signal-to-noise ratio of the Gaussian noise,
for varying parameter settings. (a) varying ∆ = 1,2,3,4
(bottom to top) with fixed γ= 0.25, η= 0.9, 5 probe states
with amplitudes equally spaced between 0 and a maximum
value ¯αwhich, as well as R, is optimized at each SNR. (b)
Fixed γ= 0.25, η= 0.9, ∆ = 4 with optimal Rand ¯α, and
varying number of probe states 2,3,4,5 (bottom to top). (c)
Fixed η= 0.9, ∆ = 4, 5 probe states, optimal Rand ¯α, and
varying γ= 0.25,1 (top to bottom).
where akand bkare the lower and upper boundaries of
Ik, respectively, and υ(x)=(x−√2α)/(√2σt) where σt
is the standard deviation of the total noise (vacuum and
excess Gaussian noise).
The results for randomness certification are shown in
Fig. 2. We see that while the randomness degrades with
very strong additive noise (low SNR), for reasonable noise
at the 10% level, the protocol performs well and the en-
tropy starts to saturate. From Fig. 2(a), we see that, as
may be expected, more randomness can be certified with
a larger number of outputs but saturates with increas-
ing ∆. For the parameter settings considered here, the
additional gain above ∆ = 4 (16 outputs) is minor [37].
From Fig. 2(b), we see that a similar behaviour applies
to the number of trusted states. Notably, already with
two states (i.e. the vacuum and a single coherent state),
randomness can be certified with Hmin ≈0.35 in a low-
noise scenario. In the ideal case with ∆ = 4, probe state
amplitudes {0, α}we obtain Hmin = 0.499 with optimal
values R= 1.80 and α=−1.68 ×10−4. Finally, from
Fig. 2(c) we see that the protocol is very robust against
the non-Gaussian ADC noise. Even for γ= 1, where ev-
4
Raw
16-bit homodyne time traces
Downmixed
A = 0.0
Time: t|200MS for 0.1s →200,000,000 samples
A = 0.2 A = 0.4 A = 0.6
234
# of probe states
r=1.10
2 3 4
# of probe states
0.0
0.2
0.4
0.6
0.8
Hmin [bits]
r=1.02
R=0.5
R=0.75
R=1.0
R=1.25
EOM
6MHz
Vpp
pilot
1550nm
(a) LO
1550nm
Probe states
generation
λ/2
PBS
Feedback
LO phase lock
PBS
ADC
BPF
Homodyne detection
DSP chain
SDP
(c)
(b)
FIG. 3. (a) Experimental setup. Probe states, created as sideband states by amplitude modulating a pilot beam with an
EOM, are measured by balanced homodyne detection. The photocurrent is bandpass filtered (BPF) around the modulation
frequency before being converted to bit values by an ADC. The resulting time traces are then processed by a 2-block digital
signal processing (DSP) chain. (b) Time traces collected for a single data set overlain with equally-scaled histograms of the bit
value distributions. For the raw time traces, the vertical axis spans the entire ADC range: [−215,215], while for the downmixed
time traces we zoom to the middle half. (c) Experimental min-entropy for various DSP settings. We perform downsampling
with bit depth ∆ = 6 and various ADC ranges R. The faded histograms show the min-entropy in the ideal case of infinite
data, while the overlaid solid histograms show the entropy after accounting for finite-size effects. To handle uncertainty in
the estimation of the probe state amplitudes, we consider two values of the scaling parameter requivalent to assuming the
amplitudes are 2% (left) and (10%) (right) larger than the estimated values (see App. F 4).
ery second bin is effectively removed, the entropy barely
degrades in the optimal regime.
Next, we experimentally demonstrate the performance
of the protocol using the setup outlined in Fig. 3(a) (for a
more detailed figure and explanation see App. F). Probe
states are generated as sideband states by intensity mod-
ulating a pilot beam at fmod = 6 MHz with an electro-
optic modulator (EOM). The peak-to-peak voltage Vpp
used to drive the EOM is well below the corresponding
half-wave voltage of the EOM, thus the amplitudes αof
the sideband states are directly proportional to Vpp. In
a single data set we collect five time traces: a shot-noise
trace (corresponding to vacuum), where the pilot beam
is blocked, and four traces with A= 0.0, 0.2, 0.4, 0.6,
where A indicates the scaling of Vpp. The pilot beam
is then directly measured by a polarization-based homo-
dyne detector and the resulting photo-current is band-
pass filtered (BPF) around fmod before being recorded by
a 16-bit ADC. The homodyne detector also has a lower-
bandwidth DC output, which is used to generate an error
signal to lock the phase between the LO and pilot beam,
such that the X-quadrature is measured. The bit value
distributions V(t), as recorded by the ADC of five such
traces, are shown in the top row of Fig. 3(b). In or-
der to optimise the certifiable randomness, the LO power
and ADC range was tuned such that the shot noise trace
spans the entire ADC range. The traces were recorded
with an estimated total detection efficiency of at least
90%, with inefficiency stemming from propagation loss
between the EOM and homodyne detector, imperfect vis-
ibility between pilot and LO and the quantum efficiency
of the homodyne detector diodes.
After the ADC, the data set goes through a digital
signal processing (DSP) chain consisting of two blocks.
In the first block, the X-quadrature distributions of the
sideband probe states are extracted from the raw time
traces and their corresponding amplitudes estimated.
This is done in four steps: digital downmixing, shot noise
normalization, amplitude estimation and downsampling,
which are all described in detail in App. F 1. The result
of the first of these steps Vdm(t) is shown in the bottom
row of Fig. 3(b). In the second block, the observed distri-
butions and estimated amplitudes are used to compute a
bound on the entropy of the measured data from the vac-
uum input via SDP, as described above. Specifically, the
trusted states in the SDP constraints are coherent states
based on the estimated amplitudes and the observed dis-
tribution is given by the normalized histograms from the
experiment. The result of this is shown in Fig. 3(c). In
order to avoid estimation errors compromising the secu-
摘要：
展开>>
收起<<
Quantumrandomnesscerti cationwithuntrustedmeasurementsandfewprobestatesKieranNeilWilkinson,1,CasperAhlBreum,1TobiasGehring,1andJonatanBohrBrask11CenterforMacroscopicQuantumStates(bigQ),DepartmentofPhysics,TechnicalUniversityofDenmark,2800KongensLyngby,DenmarkWepresentaschemeforquantumrandom-numberg...
声明：本站为文档C2C交易模式，即用户上传的文档直接被用户下载，本站只是中间服务平台，本站所有文档下载所得的收益归上传人(含作者)所有。玖贝云文库仅提供信息存储空间，仅对用户上传内容的表现方式做保护处理，对上载内容本身不做任何修改或编辑。若文档所含内容侵犯了您的版权或隐私，请立即通知玖贝云文库，我们立即给予删除！
分类：图书资源
价格：10玖币
属性：18 页
大小：3.78MB
格式：PDF
时间：2025-04-29
作者详情
相关内容
-
行政事业单位内部控制报告-关于印发编外聘用人员管理制度和编外聘用人员年度考核制度
分类：办公文档
时间：2025-03-03
标签：无
格式：DOC
价格：5.9 玖币
-
行政事业单位内部控制报告-风险评估管理制度
分类：办公文档
时间：2025-03-03
标签：无
格式：DOCX
价格：5.9 玖币
-
行政事业单位内部控制报告-采购管理内部控制制度
分类：办公文档
时间：2025-03-03
标签：无
格式：DOCX
价格：5.9 玖币
-
行政事业单位内部控制报告-部署单位内部控制专题培训和风险评估工作会议纪要
分类：办公文档
时间：2025-03-03
标签：无
格式：DOC
价格：5.9 玖币
-
行政事业单位内部控制报告-关键岗位轮岗及专项审计制度
分类：办公文档
时间：2025-03-03
标签：关键
格式：DOCX
价格：5.9 玖币
渝公网安备50010702506394
