Strong experimental guarantees in ultrafast quantum random number generation

We describe a methodology and standard of proof for experimental claims of quantum random-number generation (QRNG), analogous to well-established methods from precision measurement. For appropriately constructed physical implementations, lower bounds on the quantum contribution to the average min-entropy can be derived from measurements on the QRNG output. Given these bounds, randomness extractors allow generation of nearly perfect “$\epsilon$-random” bit streams. An analysis of experimental uncertainties then gives experimentally derived confidence levels on the $\epsilon$ randomness of these sequences. We demonstrate the methodology by application to phase-diffusion QRNG, driven by spontaneous emission as a trusted randomness source. All other factors, including classical phase noise, amplitude fluctuations, digitization errors, and correlations due to finite detection bandwidth, are treated with paranoid caution, i.e., assuming the worst possible behaviors consistent with observations. A data-constrained numerical optimization of the distribution of untrusted parameters is used to lower bound the average min-entropy. Under this paranoid analysis, the QRNG remains efficient, generating at least 2.3 quantum random bits per symbol with 8-bit digitization and at least 0.83 quantum random bits per symbol with binary digitization at a confidence level of 0.999 93. The result demonstrates ultrafast QRNG with strong experimental guarantees.

Figure 1

(Top) Schematic of phase-diffusion QRNG. A single-mode diode laser is strongly current modulated to produce a train of phase-randomized output pulses with field strengths $E\left(t\right)$. Interference of subsequent pulses is performed with a Mach-Zehnder interferometer, consisting of single-mode $2\times 2$ couplers (cpl) and a relative delay equal to the pulse-repetition period $\tau$. A photodiode (PD) converts the output pulse powers into electrical current, which is amplified (amp) and converted to digital values with a digitizer (dig). Either arm of the MZI can be broken to measure the pulse amplitude in the other arm. (Middle) Time domain recording of a short digitized sequence of $p^{\left(\mathrm{i}\right)}$, the interferometer output with interference (top, blue), and $p^{\left(\mathrm{s}\right)}$ (middle, red) and $p^{\left(\mathrm{l}\right)}$ (bottom, beige), the outputs of the interferometer with only the short or long path open, respectively. Data have been shifted to have equal baselines. (Bottom) Histograms (scaled for equal height) for $p^{\left(\mathrm{i}\right)}$ (wide, blue), $p^{\left(\mathrm{s}\right)}$ (left narrow, red), and $p^{\left(\mathrm{l}\right)}$ (right narrow, beige). The wide $p^{\left(\mathrm{i}\right)}$ distribution arises from interference and resembles the arcsine distribution that describes $cos\varphi$ when $\varphi$ is uniformly distributed.

Figure 2

Measured digitization error frequencies and error limits. Color indicates relative frequency from zero (black) to maximum (white). It is interesting to note the presence of both a large-scale nonlinearity in the conversion (the general trend) and small-scale regularities (e.g., the period-two patterns clearly visible between 50 and 60). Green traces above and below indicate the largest and smallest errors observed, respectively. Approximately $2^{14}$ samples per digitization value were used to obtain the frequencies, so the confidence that a new event will fall within the limits is $\approx 1\text{–}{2}^{-14}$.

Figure 3

Normalized correlation and recovered impulse response. The main graph shows autocorrelation ${\mathrm{ac}}_{\Delta }$ computed on a string of ${10}^8$ symbols. Open blue (solid red) circles indicate positive (negative) correlation. The horizontal line shows sampling uncertainty. The inset shows the reconstructed impulse response function $G_j$, as described in the text.

Figure 4

Illustration of the distribution function $F_{{\sigma }_q}\left(p^{\left(\mathrm{i}\right)}\right|\mathbf{x})$ that characterizes $p^{\left(\mathrm{i}\right)}$ given by Eq. (5) for fixed $p^{\left(\mathrm{s}\right)},p^{\left(\mathrm{l}\right)},{\varphi }^{\left(\mathrm{c}\right)}$, and normally distributed ${\varphi }^{\left(\mathrm{q}\right)}$. (Left) Visualization of the calculation. Gaussian $P\left({\varphi }^{\left(\mathrm{q}\right)}\right)$ (radial coordinate) centered at ${\varphi }^{\left(\mathrm{c}\right)}$ (polar coordinate), has probability mass (green area) given by the error function between limits given by the arccosine of the scaled and shifted $p^{\left(\mathrm{i}\right)}$ (horizontal coordinate). (Right) Illustration of $F_{{\sigma }_q}\left(p^{\left(\mathrm{i}\right)}\right|\mathbf{x})$ for $p^{\left(\mathrm{s}\right)}=p^{\left(\mathrm{l}\right)}=51,\mathcal{V}=0.7,{\sigma }_q=\pi /8$, and ${\varphi }^{\left(\mathrm{c}\right)}=0,\pi /8,...,\pi$, from left to right.

Figure 5

Optimized piecewise-constant distribution $P\left(\mathbf{x}\right)$ for 8-bit digitization and ${\sigma }_q=3\pi /2$. Axes indicate $p^{\left(\mathrm{s}\right)},p^{\left(\mathrm{l}\right)}$, and $\mathcal{V}$; density indicates $s_i$. ${\varphi }^{\left(\mathrm{c}\right)}$ is not included as an independent dimension because it is chosen according to other criteria (see text). The ranges of $p^{\left(\mathrm{s}\right)}$ and $p^{\left(\mathrm{l}\right)}$ are chosen to cover the whole range of these variables allowed by the measured distributions shown in Fig. 1, in light of digitization errors from Fig. 2. The graphic on the left uses worst-case errors (green curves in Fig. 2); the one on the right uses error limits narrower by a factor $0.275$. Within these ranges, the space is divided into a uniform $8\times 8\times 32$ rectangular grid $\left\{{\xi }_i\right\}$, and corresponding weights $\left\{s_i\right\}$ are calculated by numerical minimization of the min-entropy lower bound as in Sec. 11. The probability is concentrated in regions of high visibility, necessary to agree with the wide measured distribution, and regions of low visibility, which give low min-entropy. The distributions of $p^{\left(\mathrm{i}\right)},p^{\left(\mathrm{s}\right)}$, and $p^{\left(\mathrm{l}\right)}$ that follow from these $P\left(\mathbf{x}\right)$ are shown in Fig. 6.

Figure 6

Comparison of measured frequencies against their most conservative interpretation, the prediction from the optimized $P\left(\mathbf{x}\right)$. (Top) Prediction from $P\left(\mathbf{x}\right)$ of Fig. 5 (left), assuming worst-case tolerances. (Bottom) Prediction from $P\left(\mathbf{x}\right)$ of Fig. 5 (right), assuming tolerances 0.275 of worst case. The main graph shows a histogram of observed $p^{\left(\mathrm{i}\right)}$ (jagged blue), and vertically offset $p^{\left(\mathrm{s}\right)},p^{\left(\mathrm{l}\right)}$ (inset, left blue and right red), the same as in Fig. 1. Superposed smooth green curves show the predicted distribution $P\left(p^{\left(\mathrm{i}\right)}\right)$ computed from $P\left(\mathbf{x}\right)$ chosen to minimize ${\overline{H}}_{\infty }^{(\mathrm{wc},\left\{{\chi }_i\right\})}$. The inset shows, inverted, the predicted distributions for $p^{\left(\mathrm{s}\right)}$ and $p^{\left(\mathrm{l}\right)}$. The predicted distributions are consistent with the observed data in light of the tolerances provided by digitization and hangover errors (see Secs. 5 and 6). Note the central bump, from to low-visibility parts of the distribution, that lowers the min-entropy.

Figure 7

Min-entropy bound as a function of ${\sigma }_q$ for rectangular-lattice coverings of different resolution. Digitization is 8 bits. With $n(1\times 1\times 4)$ divisions, where $n=6,...,12$, giving the shown curves, from bottom to top. The inset shows the same curves on a finer scale. Increasing $n$ gives an increasing lower bound for ${\overline{H}}_{\infty }$: The inevitable error due to finite covering resolution works to reduce ${\overline{H}}_{\infty }$, making the estimate conservative. With $n=8$ we find $1\%$ accuracy relative to $n=12$, the highest resolution we could optimize using the matlab function linprog and 8 GB of RAM.

Figure 8

Lower bound on min-entropy versus ${\sigma }_q$ for different digitization resolution, from 1 bit to 8 bit (bottom to top). Other conditions are: covering resolution $(p^{\left(\mathrm{s}\right)},p^{\left(\mathrm{l}\right)},\mathcal{V})=8\times 8\times 32$, “worst-case” assumptions for digitization and hangover errors.

Figure 9

Lower bound on min-entropy versus error tolerance at ${\sigma }_q=3\pi /2$ and covering resolution $(p^{\left(\mathrm{s}\right)},p^{\left(\mathrm{l}\right)},\mathcal{V})=8\times 8\times 32$. Hollow orange circles show 8-bit digitization (on left scale), filled green circles show binary digitization (on right scale). Error limits for a given $d$ are computed using the data shown in Fig. 2, plus the hangover errors ${\zeta }_{\pm }$ for $p^{\left(\mathrm{i}\right)}$ digitization, and are interpolated between the mean and the worst-case limits by the error tolerance shown here on the horizontal axis. For error tolerance below $0.275$ and with this covering, no $P\left(\mathbf{x}\right)$ is consistent with the distributions shown in Fig. 1.