Device-independent quantum key distribution with arbitrarily small nonlocality

Device-independent quantum key distribution (DIQKD) allows two users to set up shared cryptographic key without the need to trust the quantum devices used. Doing so requires nonlocal correlations between the users. However, in [Phys. Rev. Lett. 127, 050503 (2021)] it was shown that for known protocols nonlocality is not always sufficient, leading to the question of whether there is a fundamental lower bound on the minimum amount of nonlocality needed for any DIQKD implementation. Here we show that no such bound exists, giving schemes that achieve key with correlations arbitrarily close to the local set. Furthermore, some of our constructions achieve the maximum of 1 bit of key per pair of entangled qubits. We achieve this by studying a family of Bell-inequalities that constitute all self-tests of the maximally entangled state with a single linear Bell expression. Within this family there exist non-local correlations with the property that one pair of inputs yield outputs arbitrarily close to perfect key. Such correlations exist for a range of Clauser-Horne-Shimony-Holt (CHSH) values, including those arbitrarily close to the classical bound. Finally, we show the existence of quantum correlations that can generate both perfect key and perfect randomness simultaneously, whilst also displaying arbitrarily small CHSH violation; this opens up the possibility of a new class of cryptographic protocol.


I. INTRODUCTION
Establishing shared or global randomness between two isolated parties is a task achievable using quantum theory [1][2][3], but inaccessible to classical physics without additional assumptions.Quantum key distribution (QKD), for example, can be performed by making measurements on a shared entangled state, and security is derived assuming the devices behave according to a physical model [4].Meeting the practical requirements of a model can be challenging, and mismatches between the model and reality can lead to security problems (see e.g., [5]).However, quantum theory allows us to bypass the majority of such mismatch issues: entangled quantum systems can exhibit input-output behaviours that are nonlocal [6,7], giving rise to device-independent approaches to QKD [2,[8][9][10][11][12][13]. The same can be said about the related task of randomness expansion [14][15][16][17][18][19].
Given quantum correlations that exhibit some nonlocality, how much secure key can be extracted deviceindependently?To achieve the highest security, we want to find a lower bound on the amount of key conditioned on the observed nonlocality.Such lower bounds have been found in a variety of scenarios, both analytically [10,20,21] and numerically [22][23][24][25].
A related question that has achieved less attention is: for what range of nonlocality is DIQKD possible?It has recently been shown that nonlocality is not a sufficient condition for DIQKD using standard protocols [26].More precisely, [26] showed that there exist quantum correlations, arising from Werner states [27], with some nonlocality, for which an upper bound on the secret key rate vanishes.Whilst the result of [26] does not encompass all possible protocols, it raises the question of whether there exists a minimum amount of nonlocality needed for any DIQKD implementation.A conclusive proof of existence, or contradiction, for such a bound is currently missing from the literature.
In this paper, we show that no such bound exists.Contrasting the work of [26], we show one can find quantum correlations with arbitrarily small nonlocality that can be used for DIQKD with a key rate arbitrarily close to 1 bit per pair of shared entangled qubits (we refer to this as near-perfect DIQKD).This complements existing work showing the same holds for global randomness expansion (DIRE) [28,29], which we expand upon here.We also go one step further: there exist quantum correlations with arbitrarily small nonlocality that can be used for both near-perfect DIQKD and maximum DIRE.To our knowledge this is the first example of such correlations to appear in the literature, and could open up the possibility for a new class of cryptographic protocols.
Our results are obtained by self-testing [30][31][32][33][34] quantum correlations close to the local boundary.We study a versatile family of bipartite Bell expressions that first appeared in [35], and encompass those used in the literature to certify secret key [21] and randomness [29,36].These expressions are tangent hyperplanes to the boundary of the set of quantum correlators, and constitute all self-tests of the singlet with a single linear Bell expression, when considering two observers with binary inputs and outputs [35,37].Moreover, to prove self-testing we reduce the problem to qubits via Jordan's lemma [38]; a self-contained reduction can be found in the Appendices, which may be of independent interest.

II. BACKGROUND
We consider the minimal Bell scenario for DIQKD.Let two space-like separated parties, Alice and Bob, each hold a device with inputs x, y ∈ {0, 1} and outputs a, b ∈ {0, 1}.The devices are characterized by the joint distribution p(ab|xy), which must be no signalling.
A quantum strategy refers to a joint state, ρ QA QB , and sets of observables Ãx = M0|x − M1|x , By = Ñ0|y − Ñ1|y , where { Ma|x } a , { Ñb|y } b are projective measurements (which can be assumed without loss of generality according to Naimark's dilation theorem [39]) on the physical Hilbert spaces H QA or H QB held by Alice and Bob.We consider an adversarial scenario in which Eve holds a purification |Ψ⟩ QA QB E of ρ QA QB and can set the quantum behaviour of each device (i.e., which measurements each input corresponds to).Eve's aim is to establish nontrivial correlations between the classical register A holding Alice's outcomes and E, while remaining undetected.Such correlations will allow Eve to learn information about Alice's raw key when Alice measures e.g., X = x; this is described by the post-measurement classical-quantum state ρ AE|X=x = a |a⟩⟨a| A ⊗ ρ As we are restricting ourselves to binary inputs and outputs, the nonlocality of the resulting joint behaviour can be quantified in terms of its CHSH value1 , I CHSH = ⟨A 0 (B 0 + B 1 )⟩ + ⟨A 1 (B 0 − B 1 )⟩, where ⟨A x B y ⟩ are the correlators, ⟨A x B y ⟩ = ab (−1) a+b p(ab|xy), which equal Tr[( Ãx ⊗ By )ρ QA QB ] when the behaviour is quantum.The local and quantum bounds are given by 2 and 2 √ 2 respectively, and it is well known that there is a unique quantum state and sets of measurements that achieve the quantum bound, up to local isometries.It is in this sense that the CHSH inequality self-tests the corresponding state (which is maximally entangled) and measurements.
We consider DIQKD protocols based on spot-checking with two measurements per party and a single Bell in-equality (see, e.g., [4,Section 4.4] for an example using the CHSH inequality2 ).In order to compute the secret key rate the relevant quantities are the conditional von Neumann entropies H(A|X = x, E) and H(A|X = x, Y = y, B), where X = x and Y = y are the inputs used for key generation.The latter entropy, which is independent of Eve's system, captures the cost for Alice and Bob to reconcile their raw keys and can be estimated directly from the statistics.The former captures the randomness in Alice's raw key conditioned on Eve, and must be lower bounded in terms of the observed behaviour P obs , or some functions f i of P obs (for instance, f i might be a Bell expression).The asymptotic secret key rate is then bounded by the Devetak-Winter formula [40] r key ≥ max where the infimum is taken over states and measurements compatible with f i (P obs ).Analogously, the global randomness rate is defined by the quantity r global = max x,y inf H(AB|X = x, Y = y, E) ρ ABE|X=x,Y =y .The asymptotic rates can serve as a basis for rates with finite statistics using tools such as the entropy accumulation theorem [13,41,42].
To achieve a key rate arbitrarily close to 1 bit per entangled state shared, we consider the family of threeparameter Bell inequalities from [35] whose maximal quantum violation self-tests a unique state and measurements (up to local isometries).In this case we consider a single functional f = ⟨B θ,ϕ,ω ⟩ with observed value η, and denote the rate R key θ,ϕ,ω (η).Achieving the quantum bound self-tests a pure (in fact, maximally entangled) state, which therefore must be uncorrelated with Eve, allowing us to directly compute the entropy from the observed behaviour.We find H(A|X = 0, E) = 1, and H(A|X = Y = 0, B) = ϵ for any epsilon ϵ ∈ (0, 2 − (3/4) log(3)], giving a key rate 1 − ϵ that tends to 1 as ϵ → 0, while at the same time having a CHSH value arbitrarily close to classical bound.We also use R global θ,ϕ,ω (η) to denote the randomness rate based on the same functional.

III. METHODS
Our main results are derived from studying the family of self-testing Bell expressions in [35], also recently reported in [37].We provide a new self-testing proof, and all claims are proven in Appendices C and D.
Proposition 1.Let θ, ϕ, ω ∈ R. Define the family of Bell expressions, labelled ⟨B θ,ϕ,ω ⟩, Then the following hold: (i) The local bounds are given by ±η L θ,ϕ,ω , where η L θ,ϕ,ω is defined as then the quantum bounds are given by ±η Q θ,ϕ,ω , where (iv) If (4) holds then up to local isometries there is a unique strategy that achieves ⟨B θ,ϕ,ω ⟩ = η Q θ,ϕ,ω : Special cases of the above family have already found applications in DI cryptography.For example, it contains all bipartite expressions found in [29,36], which certify maximum global DI randomness.One can also recover the marginal-free subfamily of the tilted CHSH inequalities [28,43] which have found use in DIQKD [21,44] and robust self-testing of the singlet [45].Moreover, it has been shown [35,37] that the family (2) constitute an infinite family of hyperplanes tangent to the boundary of the quantum set of correlations with uniform marginals, Q corr , and constitute every self-test of the singlet with a single linear function of the correlators in this scenario.We discuss these connections in more detail in Appendices E-G.

IV. PERFECT RANDOMNESS FROM ARBITRARILY SMALL NONLOCALITY
First we consider all strategies that certify maximum global randomness in this scenario using a maximally entangled state, certified by a single Bell expression.This contains the subfamily in [29], where the randomness versus nonlocality relationship was studied using a one parameter family of Bell expressions; here we review and extend this to a two parameter sub-family of (2).

V. NEAR PERFECT KEY FROM ARBITRARILY SMALL NONLOCALITY
Next we turn our attention to DIQKD.We consider the key rate achievable using the strategies in Proposition 1, and which CHSH values are compatible.Proposition 3.For any s ∈ (2, 5/2], and any ϵ ∈ (0, 2 − (3/4) log(3)], there exists a tuple (θ, ϕ, ω) satisfying (4), along with a set of quantum correlations achieving This statement is achieved by self-testing σ X for Alice and cos(ϕ) σ X + sin(ϕ) σ Y for Bob, along with |ψ⟩.One can then take ϕ arbitrarily close to π/2; we find H(A|X = 0, E) = 1 from self-testing, and H(A|X = 0, Y = 0, B) = H bin [(1+sin(ϕ))/2] := ϵ, where H bin is the binary entropy function.Hence in the limit ϕ → π/2, ϵ tends to 0 and we achieve perfect key.Moreover, at this limit point, we can choose (θ, ω) such that the CHSH interval (2, 5/2] is achieved-see Fig. 2 for an illustration. Interestingly, the limit point violates (4): at ϕ = π/2 the Bell expression (2) becomes trivial (the local and quantum bounds coincide), and we cannot find a single Bell expression that can certify perfect key.The correlations achieved in this limit (those resulting from the construction ( 6)) are non-local and were recently studied in [37], where it was shown such points correspond to non-exposed regions of Q corr ; our result shows the implications of this for DIQKD.At least two linear functionals are then required to uniquely identify the correlations, and, indeed, using all four correlators one can verify for various values of (θ, ω), the limit point satisfies the selftesting criteria of the singlet given by Wang et al. [46], and a one-parameter subfamily containing the point with I CHSH = 5/2 was studied in [47, Section 3.4.1],including the non-exposed nature of the case with I CHSH = 5/2.We can therefore recover another statement similar to Proposition 3. We express this using r key θ,ϕ,ω , which is the quantity defined by Eq. ( 1) evaluated with functionals f i constraining all four correlators to the values generated by the strategy in Eq. ( 6).Proposition 4. For any s ∈ (2, 5/2], there exists a tuple (θ, ϕ, ω), along with a set of quantum correlations achieving r key θ,ϕ,ω = 1 and I CHSH = s.
In other words, if we constrain all four correlators rather than the Bell inequality of (2), then we achieve perfect key directly, rather than in a limit.However, the use of four correlators can have disadvantages in the case of finite statistics because for a fixed number of shared states larger error bars are present when estimating four quantities rather than one, see e.g., [41,48].

VI. NEAR PERFECT KEY AND RANDOMNESS FROM ARBITRARILY SMALL NONLOCALITY
Finally, we consider the possibility of using the same set of quantum correlations to generate perfect key from one input combination, and perfect randomness from another.

VII. DISCUSSION
We have shown that quantum theory allows perfect DI key to be shared between two users using correlations that are arbitrarily close to being local.However, we do not know that any correlation exhibiting nonlocality, can be used for DIQKD, for instance, as shown in [26], those that lie in the interior of Q corr and arise from measuring experimentally relevant states cannot generate key using standard protocols.The behaviours we use for our results are generated by the singlet, and lie on the self-testable boundary of Q corr .
Similar statements hold for DI randomness generation, and we also showed the existence of quantum correlations that can simultaneously be used either to share key or generate maximum randomness, while being arbitrarily close to the local set.This is not only an intriguing feature of quantum theory, but opens up the possibility for new protocols exploiting this feature.For example, certifying global randomness implies 1 bit of blind randomness for Alice, in which she does not need to trust Bob [49][50][51].This prompts an application to QKD postprocessing in which certified randomness from some outcomes could help replenish some of the private randomness consumed in others.We leave the study of such protocols, and other applications of this construction, to future investigation.
Although we achieve arbitrarily good key using a single Bell expression, getting perfect key is excluded.On the other hand, perfect key is possible by testing all four correlators.This raises the question of the minimum number of linear quantities required.It would be of further interest to find the robustness of the present constructions to noise.We leave these as problems for future investigation.
Finally, our work also highlights how, when given ac-cess to the full set of single Bell functionals that selftest the singlet in this scenario, one can find interesting relationships between cryptographic tasks and nonlocality.It would be interesting to find further applications.For example, it has been shown how use of the various subfamilies of Proposition 1 can boost practical DIQKD, DIRE and robust self-testing [21,29,52,53]; given access to their generalizations, further improvements may be found by optimizing over the entire family of Bell expressions (2).
Note added: During the writing up of this work we became aware of a related work [54] that also shows the possibility of key distribution with arbitrarily small nonlocality using an alternative approach.
Appendix A: Spot checking protocols for DIQKD In this section, we give a brief outline of a standard spot checking DIQKD protocol using the Bell inequalities in this work (those of Proposition 1), and compare to protocols in which Bob has an additional measurement setting.
The set up is such that Alice and Bob each have an untrusted device (these are intended to be used for quantum measurements), as well as a trusted way to process classical information, and their own trusted source of private randomness.They are connected to one another with an insecure but authenticated channel (so an adversary can read any messages sent on this channel, but cannot alter them without being detected due to the authentication).
In each round, Alice uses a private random number generator to assign that round as either a test round or generation round, where typically the probability of a test round is low.She communicates this to Bob, with each party ensuring that their untrusted device does not learn whether the round is a test or generation round.On test rounds, Alice and Bob each sample an input X = x ∈ {0, 1}, and Y = y ∈ {0, 1}, according to a uniform distribution.On generation rounds, Alice and Bob deterministically set X = 0 and Y = 0.They record their outputs A = a ∈ {0, 1}, B = b ∈ {0, 1}.
After many rounds have taken place, Alice sends Bob the settings and outcomes of her test rounds and Bob uses the joint statistics to estimate the Bell value ⟨B θ,ϕ,ω ⟩ for some choice of (θ, ϕ, ω) satisfying the conditions required for Proposition 3. If the value is too low, they abort the protocol.Otherwise the outputs from the generation rounds form the raw key.Alice and Bob proceed with error correction and privacy amplification, distilling a secret key.Note that when using one of the Bell inequalities in this work for which we get arbitrarily close to perfect key (i.e., where ϕ is arbitrarily close to π/2), the amount of information leaked during error correction and the amount of compression required in privacy amplification become negligible as the number of rounds become asymptotically large.
In the above protocol, Bob's key generation setting Y = 0 is also used in the Bell test.An alternative approach is for Bob to use an extra setting Y = 2 for key generation, when, e.g., protocols based on the CHSH inequality are used (see Section 4.4 of [4] for an example).The reason for this is that the optimal strategy for violating the CHSH inequality yields relatively poor correlation in the case X = 0, Y = 0, while Bob's extra measurement for Y = 2 can be chosen to yield perfect correlation with Alice's X = 0 measurement in the ideal case, leading to higher key rates.However, in this setting the protocol must include an additional test that checks the correlation when X = 0 and Y = 2.Because we use a Bell inequality that is tailored for key generation, the optimal measurements for Alice and Bob already include a pair that give arbitrarily good correlation, and there is no need to add a third measurement.
It might also be possible to certify perfect key with arbitrarily small nonlocality using existing constructions tailored for randomness [28,29], plus a third measurement for Bob.Instead, our protocol remains in the minimal Bell scenario.By doing so, because the CHSH inequality is the the only non-trivial facet of the local polytope up to symmetry, the CHSH value gives an immediate measure of distance from the local set, and hence can be used to measure the nonlocality.This simplifies the analysis, and gives a protocol that requires fewer steps (see below).We also remark that, whilst not discussed by the authors, one of the constructions of [28] can be used to certify ϵ-perfect key as the CHSH violation tends to zero with two inputs per party (see equations (7) and ( 13) of [28], with β = 0, α → ∞, θ = π/4 and φ = 0).These constructions can be recovered as a subfamily of ours, and we improve upon this understanding by showing ϵ-perfect key is compatible with CHSH values in the whole range (2, 5/2], rather than only in the limit as the CHSH value tends to 2, which is not robust. On a more practical note, an extra measurement for Bob implies the need to release raw key during the classical communication phase; this data is used to test alignment and estimate the amount of error correction needed.In our protocol, because the settings X = 0 and Y = 0 (those used in the generation rounds) also appear in the Bell test, no additional raw key needs releasing for an alignment test.Though a negligible improvement in the asymptotic regime, this may lead to an overall efficiency boost for the protocol in the finite setting.However, we expect noise robustness will play a significant role when testing non-facet defining Bell inequalities, and a finite key rate analysis is needed for a fair comparison, which is beyond the scope of this work.
Appendix B: Self-testing using Jordan's lemma In this section, we show how self-testing statements can be obtained in the bipartite scenario with two inputs and outputs per party using a reduction to qubit systems via Jordan's lemma.We begin by precisely defining self-testing, and give some background on sum-of-squares (SOS) decompositions.We consider only the exact self-testing statement, and leave proof of the robust statement for future work.Then, we apply Jordan's lemma to show a quantum strategy is unique if there is a unique two-qubit strategy.Towards finding this unique strategy, we provide further reductions for Bell inequalities without marginal terms.
1. Definition of self-testing and sum-of-squares decompositions Definition 1 (Self-test).Let the observables {A x } x , {B y } y and pure state |ψ⟩ Q A Q B be the target strategy, and let B be a Bell operator.The inequality ⟨B⟩ ≤ η Q self-tests the target state and measurements if for all physical quantum strategies (ρ QA QB , { Ãx } x , { By } y ) that satisfy ⟨B⟩ = η Q , there exist local isometries V A and V B and an ancillary state |ξ⟩ Junk such that defining V : and letting |Ψ⟩ E QA QB be a purification of ρ QA QB , we have Throughout the appendices, we refer to the physical state and measurements we are trying to self-test as the "reference", denoted with a tilde.The constituents of the intended strategy, detailed in Eq. (C2), are then referred to as the "target" state and measurements, for which the relevant Hilbert space is In this work, there will only be two possible values of x and of y, and each of H Q A and H Q B will be two dimensional.For a Bell operator B that defines the quantum Bell inequality ⟨B⟩ ≤ η Q , the operator B := η Q I − B, satisfies ⟨ϕ| B|ϕ⟩ ≥ 0 for all quantum states |ϕ⟩, i.e., B ⪰ 0. If there exists a set of operators {P µ } that are polynomials of A x and B y and satisfy then we have found a sum-of-squares (SOS) decomposition of the operator B: positivity of B follows directly from the fact that K † K ⪰ 0 for any operator K. SOS decompositions can be used to enforce algebraic constraints on any state and measurements that saturate the quantum Bell inequality, since ⟨B⟩ = η Q implies which can only hold if P µ |ψ⟩ = 0 for all µ.Relations of this form can then be used to prove a self-testing statement according to Definition 1.
To formulate an SOS for a given B, we can follow Ref. [43]: consider a vector R = [R 0 , . . ., R j , . ..]T whose components are polynomials of A x and B y .Here, we consider the case where each polynomial R j is linear, writing P µ = j q j µ R j for some coefficients {q j µ } j .Then where M is the Gram matrix of the set of vectors {q j }.Since M is a Gram matrix, it is positive semidefinite by construction.If a matrix M is found that satisfies (B4) then polynomials P µ can be found by the matrix square root: Since each entry of the vector µ provides the set of polynomials that satisfies Eq. (B4).
Finding a decomposition for a given Bell operator B can be done via semidefinite programming (SDP) [43] or the formal SOS techniques presented in [37].Moreover, given a target quantum strategy tailored to some DI task, one can use the method of [37] to derive polynomial constraints satisfied by the target strategy, from which a custom Bell expression can be derived.Alternatively, one can take the target distribution and study numerical bounds on the von Neumann entropy via SDP relaxations [25].A Bell expression optimal for randomness can be extracted from the dual program, in the sense that its maximum violation certifies the amount of randomness of the target.One can then look for structure in this expression, and use the techniques of [43] to get SOS decompositions.Both approaches can lead to a Bell expression and SOS decomposition from which a self-testing proof of the target strategy can be attempted, leading to expressions such as those in Proposition 1.

Sufficiency of a unique qubit strategy using Jordan's lemma
Informally, Jordan's lemma [38] states that for two observables A 0 and A 1 on a Hilbert space H, each with eigenvalues ±1, there exists a basis transformation such that both are simultaneously block diagonal with block size no greater than two.The Hilbert space decomposes into this block diagonal structure, and, by dilating where necessary, we can take each block to be a qubit system.This has already been used in the context of self-testing (see, e.g., [45,55,56]) and here we begin with a few general statements before attacking our particular case.
Jordan's lemma can be stated as follows.
Lemma 1 (Jordan's lemma).Let Ã0 and Ã1 be two binary observables on a Hilbert space H QA .Then there exists a basis in which Ã0 and Ã1 are block diagonal with block dimensions at most 2.
Applying Lemma 1 to both Alice's and Bob's observables, we can write where A i x and B j y are 2 × 2 (any 1 × 1 blocks allowed by Lemma 1 can be extended to 2 × 2).We identify H QA = H F A ⊗ H Q A where F A is a system that flags the 2 × 2 Jordan block, and Q A is a qubit system (similarly for H QB ).A state then takes a generic form where ρ (i,i ′ ),(j,j ′ ) are 4 × 4 matrices, Tr[ρ QA QB ] = ij Tr[ρ (i,i),(j,j) ] = ij p ij = 1 and ρ QA QB ⪰ 0, where ρ (i,i),(j,j) = p ij ρ ij for a two-qubit density operator ρ ij and p ij > 0. Any shifted Bell operator B (of the form Eq. (B2)) can then be written as where Bij is constructed according to B with the qubit observables {A i x } x , {B j y } y .We therefore find ⟨ B⟩ = 0 implies The above equation tells us that, if a general strategy is maximally violating, every diagonal two-qubit block must also be maximally violating.This implies a system of constraints on every two-qubit strategy, which one can try to solve.Below we show solving this qubit problem is sufficient to determine the solution to the general problem.We proceed with a useful lemma.
Lemma 2. If M ⪰ 0 and M ii = 0 for some i (i.e., one of the diagonal elements of M is zero), then M ij = M ji = 0 for all j (i.e., the i th row and column of M are zero).
Proof.If R is a principal submatrix of M (i.e., a submatrix containing the same rows of M as columns), . One of its eigenvalues is , which cannot be positive, and is zero if and only if M ij = 0.
Proof.Choose a basis {|ψ 0 ⟩, . . ., |ψ 3 ⟩} for M µµ such that |ψ 0 ⟩ = |ψ⟩.Using Lemma 2, it follows that M µν = c µν |ψ⟩⟨ψ| with c µν ∈ C for all µ, ν (and c µµ = γ µ ).Finally, we can write which is equivalent to the form (B12) taking σ = n−1 µ=0 n−1 ν=0 c µν |µ⟩⟨ν|.Note that because M ⪰ 0 and ρ ψ ⪰ 0, we must have σ ⪰ 0. Now we present the main claim of this section.Informally, this says that in the case of two inputs and two outputs per party, it suffices to solve the self-testing strategy for systems that comprise 2 qubits, in order to solve the self-testing problem in the general case.Lemma 4. Let B be a bipartite Bell operator in the two-input, two-output scenario with a quantum bound η Q .Suppose, for every two-qubit strategy (ρ q for a target strategy (|ψ⟩, {A x } x , {B y } y ).Then, for every quantum strategy (ρ QA QB , { Ãx } x , { By } y ) achieving ⟨B⟩ = η Q , there exist unitaries V A on H QA and V B on H QB , and a state |ξ⟩ Junk ∈ H Junk , such that for any purification Proof.We begin by applying Jordan's lemma, and write the observables Ãx , By in the form of Eq. (B6).Let ρ := Tr E [|Ψ⟩⟨Ψ|] be written in the generic form of Eq. (B7).Then the fact that every diagonal two-qubit block must maximally violate the Bell inequality (see Eq. (B9)), combined with the uniqueness assumption of qubit strategies made in the lemma implies the existence of unitaries We now need to argue that these unitaries only vary with the local block index of each party, i.e., To do so we use the result of the following lemmas.Lemma 5. Let E and F be two Hermitian operators with non-degenerate eigenspaces such that E = U F U † for some unitary U .Then if E = V F V † for a unitary V , then V = U D, where D is diagonal in the eigenbasis of F .
Proof.U F U † = V F V † rearranges to [V † U, F ] = 0, from which it follows that V † U is diagonal in the eigenbasis of F , i.e., we can write V = U D with D diagonal in the eigenbasis of F .Lemma 6.For i = 0 and i = 1, let E i and F i be Hermitian operators with non-degenerate eigenspaces such that E i = U F i U † for some unitary U , where no eigenstate of F 0 is orthogonal to an eigenstate of F 1 .Then if there exists a unitary V such that E i = V F i V † for i = 0 and i = 1, V and U are equal up to a phase.Proof.Using Lemma 5, for E 0 and F 0 we can conclude V = U D 0 , where D 0 is diagonal in the eigenbasis of F 0 .Similarly, we can conclude that V = U D 1 , where D 1 is diagonal in the eigenbasis of F 1 .These imply D 0 = D 1 and hence D 0 must be diagonal in the eigenbasis of both F 0 and F 1 .Thus, D 0 = i e iαi |i⟩⟨i| = i e iβi |ϕ i ⟩⟨ϕ i |, where {|i⟩} and {|ϕ i ⟩} are orthonormal eigenbases for F 0 and F 1 .We have 1 = e −iαi ⟨i|D 0 |i⟩ = j e i(βj −αi) |⟨i|ϕ j ⟩| 2 . (B17) By assumption, |⟨i|ϕ j ⟩| 2 ̸ = 0 for any i, j.Hence (B17) can only hold if e i(βj −αi) = 1 for all i, j, i.e., if D 1 = e iα I for some α ∈ R.This implies V = e iα U .
We can apply Lemma 6 to the unitaries 0 can be orthogonal to an eigenstate of B j 1 (otherwise they would commute and there would be no classical-quantum gap for that block, contradicting Eq. (B9)), so applying Lemma 6 with for j ̸ = j ′ .Noting that U → e iϕ U preserves U GU † for any operator G, we can drop these phases and define the block diagonal unitaries We emphasise that V A , V B are local unitaries, since they vary only with the local block index of each party.We have that In particular, the diagonal blocks of τ (i = i ′ and j = j ′ ) are of the form γ i,j |ψ⟩⟨ψ|.This is the form required for Lemma 3 up to a change of notation (each pair of values of (i, j) corresponds to a value of µ).Lemma 3 gives that τ = σ ⊗ |ψ⟩⟨ψ| where σ is some density operator on H F A ⊗ H F B .It follows that any purification of ρ QA QB takes the form where For the observables, we have where we applied Eq. (B16), and similarly for V B By V † B .From this it follows that which is the general self-testing statement with the junk space identified with EF A F B .

Further two-qubit reductions for Bell inequalities without marginal terms
In this subsection, we show how the qubit strategy reductions presented in [10,57] can also be applied in the self-testing scenario.Because of Lemma 4, it suffices to consider the two-qubit case.We define the following Bell basis for later use: and write Φ α = |Φ α ⟩⟨Φ α |.
In Lemma 7, we show that for every two-qubit strategy which maximally violates the Bell inequality, we can construct another strategy with reduced parameters, which also maximally violates the Bell inequality.Note, the operations used to construct this reduced strategy are not allowed under the self-testing definition.Instead, we are concerned with uniqueness; in Lemma 8 we will prove that a unique form of the reduced strategy implies a unique form of the general strategy from which it was constructed (all up to local unitaries), when the target state is maximally entangled.
Lemma 7. Let ρ be a two-qubit state, and A x and B y be qubit observables with eigenvalues ±1 for x, y ∈ {0, 1}.Let P (A x , B y ) be a linear function of {I} ∪ {A x B y } x,y with real coefficients satisfying Tr[ρP (A x , B y )] = 0. Then there exists another two-qubit state ρ ′ , and observables A ′ x , B ′ y satisfying Tr[ρ ′ P (A ′ x , B ′ y )] = 0, where for some λ ′ α ≥ 0, α λ ′ α = 1 and a ′ x , b ′ y ∈ R for all x, y.Proof.Without loss of generality, we can assume each party rotates their local basis such that We further suppose Alice rotates such that A 0 = σ Z , i.e., a 0 = 0. Note that Bob could also rotate such that B 0 = σ Z but we do not apply this and keep b 0 and b 1 unconstrained.The state remains arbitrary.Given the form of the polynomial P , we have (σ Given a state ρ and defining where we used the fact that P (A x , B y ) has real coefficients, and that each of the four operators σ X/Z ⊗ σ X/Z is real in the Bell basis, so, when taking the conjugate in the Bell basis P (A x , B y ) * = P (A x , B y ).It follows that if we define then Tr[ ρP (A x , B y )] = 0. References [10,57] showed for any state of the form ρ, there exist local unitaries U A and U B such that ρ is diagonal in the Bell basis, and with the property that U A and U B maintain the form of the observables (i.e., they still take the form (B25), just with different angles).In other words, after applying these unitaries, This proves the claim.

Part (iii)
For Part (iii), note that max{f, g} < h ⇐⇒ f < h and g < h, and furthermore that Squaring both sides and rearranging we find that this is equivalent to cos 4 (θ/2) sin 2 (ω − ϕ) sin 2 (θ + ω + ϕ) > 0 , (C16) i.e., none of the terms in the product on the left hand side of (C16) can be zero.Similarly, replacing f 1 and g 1 with f 2 and g 2 gives QA QB [( Ma|x ⊗I QB E )|Ψ⟩⟨Ψ|] is the subnormalized state held by Eve conditioned on Alice getting a when x is measured.The global post-measurement classical-classical-quantum state ρ ABE|X=x,Y =y is defined analogously, and the behaviour is recovered via the Born rule p(ab|xy) = Tr QA QB E [( Ma|x ⊗ Ñb|y ⊗I E )|Ψ⟩⟨Ψ|].

FIG. 1 .
FIG. 1. Contour plot of nonlocality, measured using the maximum of the eight CHSH-type inequalities, for the strategies in Eq. (6) with ω = π.The points inside the dashed triangles, excluding the boundary, can be used for perfect DIRE with a single linear Bell inequality: they satisfy (4) and have a value in (2, 3 √ 3/2] for one of the CHSH-type inequalities, with the maximum of ICHSH indicated with the black cross at θ = ϕ = π/3.Approaching ϕ = −π/2 or ϕ = π/2 inside the corresponding region also allows arbitrarily good DIQKD.The black contours indicate ICHSH = 2 for at least one CHSHtype inequality.

FIG. 2 .
FIG. 2. Contour plot of nonlocality, measured using the maximum of the eight CHSH-type inequalities of the strategies in Eq. (6), at the limit ϕ = π/2.All points on the graph are limit points of correlations that achieve arbitrarily perfect DIQKD with a single linear Bell inequality, including the contours with CHSH values equal to 2, which are shown as black triangles.The black dashed lines show where perfect DIRE can also be achieved, with the blue crosses denoting the maximum value of ICHSH = 1 + √ 2 at θ = π/4, ω = π and θ = 7π/4, ω = 2π.The black crosses denote the global maximum of ICHSH = 5/2 at θ = π/3, ω = 5π/6 and θ = 5π/3, ω = 13π/6.