Towards device-independent information processing on general quantum networks

The violation of certain Bell inequalities allows for device-independent information processing secure against non-signalling eavesdroppers. However, this only holds for the Bell network, in which two or more agents perform local measurements on a single shared source of entanglement. To overcome the practical constraint that entangled systems can only be transmitted over relatively short distances, large-scale multi-source networks have been employed. Do there exist analogues of Bell inequalities for such networks, whose violation is a resource for device-independence? In this paper, the violation of recently derived polynomial Bell inequalities will be shown to allow for device-independence on multi-source networks, secure against non-signalling eavesdroppers.

The violation of Bell inequalities has been shown to have immense practical importance for quantum information processing [1][2][3]. Indeed, violation of certain Bell inequalities is a resource for unconditionally secure key distribution [1][2][3][4][5][6][7] and randomness amplification [8][9][10], and for achieving certain computational advantages [11][12][13][14] [61]. Moreover, these protocols are deviceindependent, meaning they depend only on the observed output statistics of devices used to implement them. In the case of key distribution, for certain protocols the violation of a Bell inequality can be used to lower bound the secure key rate [3]. Furthermore, monogamy relations have been derived between the violation of certain Bell inequalities and the amount information an eavesdropper can obtain about the generated key; the higher the violation, the lower the information [15][16][17].
However, these results only hold for the Bell network depicted in Fig. 1(a), in which two agents perform local measurements on a single shared source of entangled systems. The utility of these networks is limited by practical constraints: entangled systems can only be transmitted over relatively short distances, and only a small number of agents can share an entangled state distributed by a single source [18][19][20]. To overcome this, large-scale multisource quantum networks, such as that schematically illustrated in Fig. 2, have been employed [18,19,[21][22][23][24][25][26][27][28][29]. Yet having multiple intermediate nodes in the network opens the door for novel eavesdropping attacks not seen in the Bell network. Do there exist analogues of Bell inequalities for such multi-source networks whose violation is a resource for device-independence and which can prevent novel eavesdropper attacks?
Recently, polynomial Bell inequalities have been derived [30][31][32][33][34][35][36][37][38] on the correlations classically achievable in multi-source networks. Violation of these polynomial inequalities witnesses non-classical behaviour in such networks. Can such violations be connected to advantages in information processing on large quantum networks, as was the case in the Bell network? The main obstacle to * Electronic address: ciaran.lee@ucl.ac.uk establishing such a connection is that the set of classical correlations of a given general network forms a nonconvex semi-algebraic set [33], thus methods establishing standard Bell inequality violation as an informationtheoretic resource are no longer applicable [62].
Such bounds on the correlations generated in multisource networks were originally studied in the field of Causal Inference [39,40]. Recently, the tools and formalism pioneered in this field have begun to see applications in quantum information [41][42][43][44][45][46]. Indeed, this formalism subsumes and generalises standard cryptographic constraints such as no-signalling and the assumption that agents each have a secure laboratory, as is discussed in more detail in Appendix A. In this formalism, agents and sources are represented by nodes in directed acyclic graphs (DAGs), with the arrows denoting the causal relationship between nodes. For example, the DAG in Fig 1(a) corresponds to the causal structure of the Bell network. As in standard device-independence, this work assumes that both measurement devices used by agents, and the sources they measure, are supplied by an untrusted adversary, or eavesdropper [63].
In the Bell network, violation of a Bell inequality rules out quantum [4] and post-quantum [3,5] eavesdroppers. In these attacks, the systems measured by the agents could be correlated with a system held by the eavesdropper, as depicted in Fig. 1(b). These need not be quantum systems, as long as the DAG of Fig. 1(b) holds. Measuring this system using a device with input Z and outcome E, an eavesdropper could gain information about agents' outcomes. That is, it may be that P (E|A, B, Z) = P (E|Z). By violating the chained Bell inequality however [15,17], agents can limit the information such an eavesdropper can gain about their outcomes.
However, for the general networks considered here, there are new avenues for eavesdropping attacks. The eavesdropper supplying of the sources can hold systems correlated with more than a single source, as in Fig. 2(c). Additionally, the eavesdropper could even introduce correlations [64] between sources, as in Fig. 2(d). The main findings of the current work are: quantum systems that can each be correlated with a single source, the violation of certain polynomial inequalities bounds this eavesdropper's information about agents' outcomes.
2. By introducing correlations between sources assumed by the agents to be independent, an eavesdropper can simulate quantum correlations consistent with the original DAG, hence gaining complete knowledge of agents' outcomes. However, increasing the measurement settings can combat this.

A new intermediate device-independence scenario:
trusting a subset of sources are not correlated with a single system held by an eavesdropper. Given this assumption, the attack of item 2 can be prevented.
It should be emphasized here that, as in the work of Ref. [5], security will be established against nonsignalling eavesdroppers by bounding their predictive power to learn outcome of agents' devices. In the case of the Fig. 1(b), letting D (P, Q) := 1 2 x |P (x) − Q(x)| denote the total variational distance, this corresponds to bounding D(P (E|A, X, Z), P (E|Z)). Another way of bounding this is through the device-independent guessing probability (see e.g. [47]). That is, through establishing a bound on P (E = A). Informally, the difference between these two approaches is that, in the former, one is bounding the amount of information an eavesdropper can infer about agents' outcomes from the result of their chosen measurement, and, in the latter, one is bounding the probability that the eavesdropper correctly guesses agents' outcomes.
Each of the above three points will now be illustrated with concrete examples involving repeater and star networks. The derivations of all results in the remainder of the paper are presented in the Appendix.
Repeater networks. Consider a repeater network in which n sources are each shared between two out of n + 1 agents, who each perform local measurements with their devices. The crucial information about agents' inputs and outputs is captured by the DAG of Fig. 2(a). The devices held by agents A 1 and A n+1 have two inputs, denoted x 1 and x n+1 , with x 1 , x n+1 ∈ {0, 1}, and two possible outputs A 1 = a 1 and A n+1 = a n+1 , again with a 1 , a n+1 ∈ {0, 1}. All remaining agents have devices with a single input and four possible outputs, denoted Fig. 2(a) are classical random variables, then an inequality bounding the classically achievable correlations is: where where the above sum ranges over a 1 , a n+1 , . . . , a 0 n a 1 n . Inequality (1) was derived in [34,35,38], and is the analogue of a Bell inequality for this particular DAG. Note that is non-linear in the joint conditional probability distribution-hence the name polynomial Bell inequality. Now, if all sources are claimed by the eavesdropper to emit singlet states |ψ − , devices held by agents A 1 and A n+1 to be carrying out measurements (σ z + σ x ) / √ 2 for and all remaining devices to be carrying out Bell state measurements (BSMs), the generated correlations are [38]: Plugging this into Eq. (2) yields I = J = 1/2 [38], which results in R = √ 2 > 1, a violation of Eq. (1). Suppose, as depicted in Fig. 2(b), the eavesdropper holds n independent systems each correlated with one of the n sources. Furthermore, we allow the systems held by the eavesdropper to be post-quantum (that is, nonsignalling), as long as the form of the DAG from Fig 2(b) is enforced. Each system can be measured by a device with input z i and output E i . As the purpose of repeater networks is to allow agents 1 and n + 1 to communicate, can such an eavesdropper learn the outputs of agents A 1 and A n+1 ? x |P (x) − Q(x)| denote the total variational distance, this bound on the information corresponds to While the above bound is quite weak [65], it formally relates polynomial inequality violation to the amount of information an eavesdropper can possess about agents' outcomes. See Appendix B for a proof. It will be shown in the star network section that increasing the number of measurement settings increases the amount of violation, hence the more measurement settings one has, the more stringent the bound on the eavesdropper's information.  By introducing such correlations, an eavesdropper can learn agents' outcomes without alerting them [66]. Moreover, the sources only need to be classical. Such a model is provided in Appendix C and shown to correspond exactly to the quantum correlations Eq. (3). As the eavesdropper manufactured the devices and holds a copy of each source, they can infer each agent's output.
There are two ways to combat this: i) having agents perform measurements that maximally violate the Clauser-Horne-Shimony-Holt (CHSH) inequality ensures their outputs are uncorrelated from an eavesdropper; ii) take as a security assumption that the eavesdropper does not hold a system correlated with both first and last sources, as depicted in Fig. 2(d). Even by holding a system correlated with all sources excluding the last one (or the first one), an eavesdropper cannot simulate the correlations of Eq. (3). Indeed, a variant of Eq. (4), in which the left hand side is replaced by , with E and E 1 as depicted in Fig. 2(c), easily follows from the proof of Eq. (4) in Appendix B.
Given the above, one might wonder why violating the CHSH inequality is not always advocated over violating inequality (1). If the sources are replaced with 'noisy' , the above two cases provide an interesting trade-off between source visibility v i and security. Indeed, post-selecting intermediate BSMs results in another noisy Bell state shared between agents A 1 and A n+1 , but with lower visibility  [34,38]. Hence, noisy sources that do not ensure security in the Bell network can in principle establish some security in repeater networks. Star networks. Consider the star network depicted in Fig. 3(a), first studied in [34,35,37], consisting of n independent sources, each shared between a central agent, B, and one of n external agents, A i . The devices held by each agent have k possible inputs, denoted y for the central agent and x i for the external agents, and two potential outputs, denoted b and a i .
See Appendix D for a proof. All sources are claimed to be in the singlet state |ψ − . The supplied devices are claimed to function by projecting onto the basis {cos rπ where r is an integer equal to x i for the ith external agent and y for central agent, outputting 0 for the first basis element and 1 for the second. Here, the central agent performs a separable measurement consisting of simultaneously performing the same basis measurement on each of their joint systems, outputting the parity of individual outcomes. This implies that the operator corresponding to the the central agent's measurement factorises [67] as B y = B 1 y ⊗ · · · ⊗ B n y resulting in A x1 · · · A xn B y = A 1 x B 1 y · · · A n x B n y . Inequality (5) is upper bounded by k cos π 2k [48]. This upper bound is achieved by the above measurements [49] [68].
In what follows the simplifying assumption that the central agents measurement device implements a separable measurement will be made. Note that, using the same approach as Section III A 3 of [37], it can been shown that all possible violations of Eq. (5) can be achieved using separable measurements on the center node. Hence our assumption of separable measurements is not unjustified.
Suppose, as depicted in Fig. 3(b), the eavesdropper holds n independent (possibly post-quantum) systems, each correlated with a single source. By using devices with inputs z i and outputs E i to measure these systems, can an eavesdropper learn the outputs of agents A i ?
In the repeater network section, an eavesdropper was able to learn agents' outcomes by introducing a bit α which correlated the first and last sources, depicted in Fig. 2(d). Could a similar eavesdropping attack work here? In fact, the same level of security as Eq. (8) can be established against an eavesdropper who correlates m ≤ n sources by sharing a random variable with q < k values-each taken with probability p l -among the m sources, as illustrated in Fig. 3(c). This is formalised by demanding that an eavesdropper's information about agents' outcomes takes the following form: Result 5. Given Eq. (7), the following bound can be derived: D P (EE n−m · · · E n |A 1 , x 1 , . . . , z, z n−m . . . , z n ), P (E|z) · · · P (E n |z n ) ≤ n + m(q − 1) (k − S) .
This goes as 1/k for large k, see Appendix F. If an eavesdropper introduces correlations between sources, their information of agents' outcomes can be bounded as long as the measurement settings are sufficiently large.
Conclusion. Monogamy relations using the degree of violation of a Bell inequality to bound an eavesdropper's information are central to standard deviceindependent information processing [8,15,16,50]. Thus, the results presented in this work pave the way for device-independent information processing on multisource quantum networks. Indeed, Eq. (3) states that once intermediate outcomes are announced, agents A 1 and A n+1 share a bit. Moreover, an eavesdropper's information about this bit is bounded by the degree of violation of polynomial Bell inequality (1). Hence deviceindependent key distribution is possible in repeater networks. Moreover, security can be established using entangled sources with lower visibilities than that required for key distribution in the Bell network. Future work will focus on establishing a full security proof for deviceindependent key distribution on repeater networks.
However, for multi-source quantum networks, there are new avenues for eavesdropping attacks; by correlating sources an eavesdropper can simulate quantum correlations consistent with the original DAG. Fortunately, it was demonstrated that increasing the number of measurement settings, or ensuring the eavesdropper does not hold a system correlated with a specified subset of sources, can prevent this attack. As large-scale quantum networks-a primer for a quantum internet-are becoming possible with current technology, developing novel information processing protocols on such networks is critical. Moreover, as component networks making up future large quantum networks are likely to consist of diverse technologies, having protocols that are independent of specific technological implementations is critical.
Beyond generalised monogamy relations, can violation of polynomial Bell inequalities be related to advantages in other information processing tasks? Ref.'s [11][12][13] have related non-local correlations in the Bell network to quantum advantages over classical computers. This was established in the measurement-based paradigmwhere adaptive measurements are performed on a single source. Relating computational advantages to violation of polynomial inequalities would be quite practical: it is more feasible to create an entangled state consisting of multiple sources of few-body entangled systems than of a single source of many-body entangled systems.

Appendix A: Brief background on DAGs
The structure of each DAG encodes conditional independence relations [69] among the nodes. For instance, the no-signalling conditions in the Bell network, P (A|X, Y ) = P (A|X), and P (B|X, Y ) = P (B|Y ), can be seen to directly follow [41] from the structure of the DAG depicted in Fig. 1(a). Indeed, the specification of the DAG subsumes and generalises the standard no-signalling relations [44,54,55]. Indeed, in the case of the general network from Fig. 2(a), the structure of the DAG ensures P ( . This is due to the fact that non-neighbouring agents can only be correlated through knowledge of neighbouring agents outcomes. Moreover, the assumption that each agent has a secure laboratory is enforced by the lack of an arrow from an eavesdropper to each agent's outcome. In short, every constraint governing how the inputs and outputs of agents and eavesdroppers are related is specified by the DAG.  where I k is the chained Bell inequality [49] on k measurement settings, defined as: Consider the left hand side of inequality (4), it will now be shown to decompose as D P (E 1 · · · E n |A 1 , A n+1 x 1 , x n+1 , z 1 , . . . , z n ), P (E 1 |z 1 ) · · · P (E n |z n ) ≤ D (P (E 1 |A 1 , x 1 , z 1 ), P (E 1 |z 1 )) + D (P (E n |A n , x n , z n ), P (E n |z n )) , (B4) where again, the systems held by the eavesdropper could be post-quantum (that is, non-signalling). Indeed, the structure of the DAG from Fig. 2(b) implies the following conditional independence relations: Combining with the definition of D(·, ·) yields Eq. (B4). The DAG of Fig. 2(b) ensures the no-signalling relations of Eq. (B1) hold between A i , E i , x i , z i . The conjunction of this with Eq.'s (B2) and (B4) implies D P (E 1 · · ·E n |A 1 , A n+1 x 1 , x n+1 , z 1 , . . . , z n ), The chained Bell inequality will now be connected to inequality (1). First let us look at the specific case of the measurements introduced in the repeater network section. After considering this example, the general case will be proved.
To this end, consider the following mapping: P (a 1 , a 0 2 a 1 2 , . . . , a n+1 |x 1 , x n+1 ) −→ P (a 1 , a 2 , . . . , a n , a n+1 |x 1 , x 2 , . . . , x n , x n+1 ) = δ a2,a x 2 · · · δ an,a xn P (a 1 , a 0 2 a 1 2 , . . . where the sum ranges over {a 0 i a 1 i } i . One can interpret the above mapping as follows: agents i = 2 to i = n use their devices to simulate a two choice x i ∈ {0, 1}, binary outcome measurement by outputting the bit a xi i from the pair output by their device a 0 i a 1 i . It is clear that as each agent makes their choice locally, no correlations have been introduced between agents. Hence, both I, J from Eq. (2) and N from Eq. (1) are invariant under mapping (B7). For a more in-depth discussion on this point, see section III B from [38].
Applying the above mapping to Eq. (3) from the main text yields Any repeater network in which agents 2 to n have binary inputs and outputs that generates the above correlations has the same value for N as the one considered in the main text. Indeed, Eq. (B8) can be generated by agents 2 to n performing the separable measurements A y i = A y i,0 ⊗ A y i,1 ∈ {σ z ⊗ σ z , σ x ⊗ σ x }, for i = 2, . . . , n [38]. Here, an agent measures both of their received systems in the same basis and outputs the parity of the individual measurement outcomes. Given these separable measurements for intermediate nodes, one has A x1 . Moreover, it follows that A xi i,1 A xi+1 i+1,0 = 1. Combining all this, it follows that (B9) As agents A 1 and A n+1 and A 2,0 and A n,1 respectively choose from the same set of measurements, one has where A 0 B 0 := A 0 1 A 0 2,0 = A 0 n+1 A 0 n,1 formalises the statement that A 1 , A n+1 and A 2,0 , A n,1 choose from the same set of measurements, respectively.
The above is the k = 2 instance of the CHSH inequality Using AB = 2P (A = B) − 1, it follows that Combing this with Eq. (B6), Eq. (4) follows.
For the general case, consider the following. As in the above example, agents i = 2 to i = n use their devices to simulate a two choice x i ∈ {0, 1}, binary outcome measurement by outputting the bit a xi i from the pair output by their device a 0 i a 1 i . This does not change the value of the polynomial Bell inequality. Moreover, as this amounts to a classical post-processing of intermediate agents outcomes, it also does not affect any potential correlations between an eavesdropper and the first and last agent in the network.
It was shown in Theorem 1 of Ref. [57] that coarsegraining a two-qubit measurement with four outcomes in the manner discussed above results in a separable measurement. This is in fact always true, even for a twoqudit measurement. Indeed, as the dimension is not given a priori, without loss of generality one can always take this measurement to consist of four rank-1 projectors by appending ancillary systems. Coarse graining these as above results in operators which satisfy the conditions of Lemma 1 of [58], which states that these can be reduced to a direct sum of 2-qubit operators, as is done in Eq. (9) of [59] for instance. The problem has now been reduced to the case of 2-qubit measurements which were covered by [57], as discussed above. Given Following the reasoning of Eq. (B9), one can show the following holds (see Eq. (13) of Ref. [60] for more details): is the CHSH inequality between agents i and j. Hence, using the fact that the arithmetic mean is larger than the geometric mean, one has Using Eq. (B12), one obtains Inputting into Eq. (B6), provides the desired result.
Appendix D: Proof of Result 4 The proof will follow the strategy of [37, Proof of Theorem 1] and [34, Proof of Eq. (20)]. Consider a classical model for Fig. 3(a), where all the λ i are random variables. Writing where λ is shorthand for λ 1 · · · λ n , one has for i = 0, . . . , k − 1, where q j (λ j ) is the distribution over the λ i 's. Taking the absolute value yields as B i λ ≤ 1.
It was shown in Ref. [37] that, for c k i ∈ R + and m, n ∈ N, the following holds: Hence, one has S ≤ n j=1 q j (λ j ) (k − 1) n dλ j finishing the derivation of Eq. (5).
As stated in the main text, it is assumed that the central agents device is implementing separable measurements, hence one has B y = B 1 y ⊗ · · · ⊗ B n y . Given this separable measurements, one can show that the following holds (again, see Eq. (13) of Ref. [60] for more details) Following the same analysis as the end of Appendix B, the conjunction of Eq. (E2) with Eq. (B2) yields Eq. (6). The upper bound of Eq. (E2) can in fact be reached using the measurements introduced in the main paper. As all external agents choose from the same set of measurements, one has C A i B i k = C A j B j k , ∀i, j. This implies the maximal quantum value of Inequality (5) is the maximal quantum value of C AB k , which has been shown by [48] to be k cos π 2k .