Maximal randomness from partially entangled states

Entangled quantum systems can be used to violate Bell inequalities. According to Bell's theorem, whenever we see a Bell violation we can be sure that the measurement outcomes are not the result of an underlying deterministic process, regardless of internal details of the devices used in the test. Entanglement can thus be exploited as a resource for the generation of randomness that can be certified device independently. A central question then is how much randomness we can extract from a given entangled state using a well-chosen Bell test. In this work we show that up to two bits of randomnes -- the maximum theoretically possible -- can be extracted from any partially entangled pure state of two qubits from the joint outcome of projective two-outcome measurements. We also show that two bits of randomness can be extracted locally using a four-outcome non-projective measurement. Both results are based on a Bell test, which we introduce, designed to self-test any partially entangled pure two-qubit state and measurements spanning all three dimensions of the Bloch sphere.

Although it was not the original motivation [1], Bell's theorem [2] allows for a very strong test of quantum randomness. By preparing an entangled quantum system and exhibiting a Bell inequality violation with it, we can immediately know that the measurement outcomes were not the result of an underlying deterministic process. Notably, the identification of randomness that this gives is independent of any internal physical details of the devices used in the test. This observation is the basis of a class of quantum cryptography protocols, called device independent, that incorporate a Bell test as a self-test of the correct functioning of the implementation. The class includes device-independent versions of quantum key distribution and random number generation [3][4][5][6].
This perspective prompts an obvious question: How much randomness can we extract from a given entangled state? Previous work (see table 1) has shown that the two do not seem strongly related; we cannot necessarily get more randomness from a maximally entangled state than a weakly entangled one of the same dimension. This point was made with a proposed Bell test in [7] with which one could extract a uniformly random bit from any partially entangled pure state of two qubits from one of the measurements. An extension of the Bell test, also described in [7], showed that potentially up to two uniformly random bits could be extracted from a pair of projective measurements. The test, however, only strictly demonstrates this for the maximally entangled state |φ + = |00 + |11 / √ 2, while it is shown that the amount of randomness generated by the measurements tends to 2 random bits for a very weakly entangled state |ψ θ = cos(θ/2)|00 + sin(θ/2)|11 in the limit θ → 0 where it becomes separable. Therefore, the question of how much randomness one can extract from a generic entangled two-qubit pure state remains Table 1: Amount of randomness known to be extractable from one (local) or jointly from two (global) projective (PROJ) or non-projective (POVM) measurements from the maximally (|φ + ) and any partially (|ψ θ ) entangled two-qubit state. The results in bold are known to be optimal. This work proves optimal bounds in two new scenarios (italic). open.
The main result of this work is to solve this question and prove that the maximum of two bits of randomness can be certified device independently from any entangled two-qubit pure state. To do so, we introduce a Bell-type test that could be performed by two parties, traditionally called Alice and Bob, sharing any partially entangled pure qubit state and show that it can be used to nearly perform tomographic reconstruction of an arbitrary measurement performed on one of the subsystems. We exploit this to show that, alternatively, two uniformly random bits can be obtained by performing a suitable four-outcome measurement, defined by a Positive-Operator Valued Measure (POVM), on one side, generalising a result previously obtained in [8] for the maximally entangled state.
The Bell test.-To understand the problem, we begin by considering the form of an arbitrary partially entangled state of two qubits. Such a state can always be expressed in its Schmidt decomposition as for an angle θ that, without loss of generality, we can and hereafter will take to be in the range 0 < θ ≤ π 2 . The same state is equivalently represented by its density operator ψ θ = |ψ θ ψ θ |, which we can express as in terms of the identity and Pauli operators 1, X, Y, and Z acting on each subsystem. We can see that Alice and Bob will have to perform measurements in the X-Y plane, for example A = X and B = Y, in order to extract two uniformly random bits from this state, since this is the only way to have A = A ⊗ B = B = 0. We would, however, intuitively expect the maximum violation of a Bell inequality on ψ θ to be attained with measurements having a component in the Z direction, since the correlation terms involving Z in (2) are larger in magnitude than the analogous terms involving X and Y. As such, we anticipate that we will need a Bell experiment engineered to exploit the entire Bloch sphere.
To this end, we propose the following Bell test in which Alice and Bob perform ±1-valued measurements A x , x = 1, 2, 3 and B y , y = 1, . . . , 6, in each round. They use the statistics to estimate the values of three Bell expressions. The first two, are modified CHSH expressions of the kind introduced in [7] while the third, is an ordinary CHSH [9,10] expression. We choose β = 2 cos(θ) for the value of the parameter β in the definitions of I β and J β , depending on the angle θ that identifies the intended state |ψ θ . Alice and Bob should in particular check that these Bell expressions attain the values The Bell expectation values (7), (8), and (9) can be attained by measuring on Alice's side and performing suitable measurements on Bob's side on the partially entangled state |ψ θ [7].
Crucially for the intended application to randomness generation this is, as we will show, effectively the only way to attain these expectation values, even with a highdimensional quantum system. Self-testing the state and Pauli basis.-Suppose now that Alice and Bob perform the above Bell test with unknown measurements on an unknown state ρ. We will prove in the following that, if the expectation values I β = J β = 2 √ 2 1 + β 2 /4 and S = 2 √ 2 sin(θ) are attained, there is a choice of local bases in which the state takes the form where ψ θ is the partially entangled state (2) and σ A B is an unspecified ancillary state, and Alice's measurements have the form where A Y is a ±1-valued Hermitian operator. The sign ambiguity in A 3 is unavoidable due to the symmetry of the scenario with respect to complex conjugation [11]. Note that, for simplicity, when we give an explicit expression for the local observables, we restrict our attention to the support of the local marginals of ρ. This is not restrictive since we are not concerned with, and in any case can infer nothing about, how Alice's measurements act on any part of the Hilbert space that does not contain the state.
To begin with, we use the fact that the first constraint I β = 2 √ 2 1 + β 2 /4 already implies (11), (12), and (13), with θ related to β according to (6) above. This can be inferred from the derivation of the quantum bound on I β that was originally done in [7]. Ref. [7] is however not very explicit about this so we have included a detailed rederivation as an appendix. Note in particular that the relation between A 1 and A 2 can be expressed basis independently as The term J β is the same Bell expression as I β except with different measurements and the second condition J β = 2 √ 2 1 + β 2 /4 implies the same relation between A 1 and A 3 as the first did between A 1 and A 2 . Having already identified ρ and fixed A 1 , we can derive the most general A 3 that anticommutes with A 1 . Writing generally and for Hermitian operators A X and A Y satisfying where [ · , · ] is the commutator.
Let us now prove that satisfying the third condition S = 2 √ 2 sin(θ) forces us to set A X = 0 in (16). As with A 3 , we can decompose Bob's measurement operators as Requiring B y 2 = 1 ⊗ 1 implies among other things that and, in particular, for the X and Y components. Using the expression (2) for ψ θ in the Pauli basis we find y = 5, 6, for the correlation terms AB = Tr AB (ψ θ ⊗σ) appearing in (5) Since 1, A X , and A Y commute, we can further express them together as where {|k } is a basis of A and We can then express A X ⊗ B 5X , for example, as where the expectation values · k = Tr[ · σ k ] are evaluated on the states defined on the B subsystem. Note that they are normalised such that k Tr[σ k ] = 1. Using all this in the CHSH expectation value and applying the Cauchy-Schwarz inequality a few times yields where we used that x k 2 + y k 2 = 1 to get to the third expression and that B k ≤ B 2 k 1 k and to get to the fourth. In order to actually attain S = 2 √ 2 sin(θ), all the bounds applied in (28) have to hold with equality. This requires in particular i.e., x k = 0 and y k = ±1. We thus conclude that A X = 0 and 2 bits of global randomness.-A slight extension to the Bell experiment we have introduced allows Alice and Bob to extract two bits and certify that they are random and uncorrelated. In addition to checking that (7), (8), and (9) are met, Bob can perform a seventh measurement, B 7 , and check that its correlation with A 3 is As before, we can generally express B 7 as The constraint | A 3 B 7 | = sin(θ) thus implies B 2 7Y = 1, which allows us to deduce B 2 7Y = 1 (recall that we restrict ourselves to the support of Bob's marginal ρ BB ). Eq. (20) then implies With this information we can prove that the results of measuring A 2 and B 7 are maximally random. The probabilities of the four possible outcomes are Importantly, the fact that we can derive P (ab|27) = 1/4 from I β = J β = 2 √ 2 1 + β 2 /4, S = 2 √ 2 sin(θ), and A 3 B 7 = − sin(θ) shows that these conditions together are extremal, i.e., they cannot be attained by averaging quantum strategies that give different values of these quantities. This rules out the possibility of a more detailed underlying explanation of the correlations that might allow better predictions to be made about A 2 and B 7 .
2 bits of local randomness.-An alternative way to extract up to two random bits is for Bob to perform a POVM with four outcomes. We should first see how this works in the ideal case that Alice and Bob share the partially entangled state |ψ θ . In this case Bob has access to the marginal state and can extract the equivalent of two random bits with a suitable POVM {R id b } b∈{1,...,4} satisfying In order to rule out a better underlying explanation of the result, we will also need a POVM that is extremal, i.e., it must not be possible to express it as a convex sum of POVMs other than itself. Fortunately, it is not difficult to find POVMs that satisfy these requirements. Any rank-one POVM α b > 0, is extremal provided that the projectors φ b are linearly independent [12]. An example of such a POVM is given by for b = 1 and, for b ∈ {2, 3, 4}, and with cos(λ) = −[3 + 4 cos(θ)] −1 and, for example, angles µ 2 , µ 3 , µ 4 = 0, ±2π/3. The randomness certification we wish to show is based on the fact that we can reconstruct a POVM performed by Bob, such as {R id b }, from its correlations with Pauli measurements on Alice's side on the state |ψ θ . Writing our ideal POVM {R id b } as in the identity and Pauli basis (σ µ ) = (1, X, Y, Z), where we use implicit summation over the repeated Greek index µ, we get for coefficients η µν = σ µ ⊗ σ ν ψ θ that can be read off (2). For θ = 0, the coefficients η µν make up the components of an invertible matrix (e.g., its determinant is − sin(θ) 4 ). The conditions (43) thus uniquely identify the POVM elements R id b . Returning to the device-independent case, Bob, as part of the Bell test, can perform a four-outcome measurement B 7 = {R b } and check with Alice that the local and twobody statistics are compatible with the ideal qubit POVM {R id b }, i.e., that where A µ = (1 ⊗ 1, X ⊗ 1, Y ⊗ A Y , Z ⊗ 1) denotes the identity and Alice's measurements. It will be useful in the following to express these all together as where A ± are the positive and negative parts of A Y , such that 1 A =Â + +Â − and A Y =Â + −Â − , and σ * µ = ±σ µ is the complex conjugate (in the standard basis) of σ µ .
The condition (44) gives sufficient information about the measurement {R b } to show that it yields an outcome that is intrinsically random, as we can show by adapting a proof in [8]. To model the problem, we can suppose that Alice and Bob share a purification |Ψ = |ψ θ ⊗|χ A B E of the state identified by the Bell test with an adversary, Eve, who attempts to guess Bob's outcome. The probability that Eve is successful is where {Π e } is a four-outcome POVM performed by Eve. Inserting 1 A =Â + +Â − we can rewrite this as a ∈ {±}, where in the second line we introduced probabilities p ae and POVM elements R b|ae on the B system defined by For p ae = 0, the R b|ae s defined this way form a POVM. Expanding R b as we can identify the R b|ae s by At this point we consider what we learn from the constraint A µ ⊗ R b = r bµ . Multiplying both sides by σ µ = η µν σ ν where (η µν ) is the matrix inverse of (η µν ) and then substituting in (50) we get where we used that σ µ * = ±σ µ in the same way as σ µ and, in the last line, R * b|−e is the complex conjugate of R b|−e . Comparing the first and last lines and using that {R id b } is supposed to be extremal we can conclude for all values of e. Using this in (47), we finally find for the local guessing probability. Conclusion.
-We have at this point proved what we set out to show. Up to two bits of global or local randomness can be extracted from any partially entangled pure twoqubit state from the corresponding variant of our Bell test. The analytic approach we used allowed us to show that the probabilities (34) and (54) are exactly 1/4 in either case if the ideal correlations are attained. For deviations from the ideal conditions, for instance due to noise, the randomness can still be bounded numerically using the NPA hierarchy [13][14][15].
Of possible independent interest, our Bell test allows its participants to infer that they must share a given partially entangled qubit state and are performing measurements spanning the entire Bloch sphere on it. Previous work has already shown that we can often infer substantial information about a quantum system from a Bell test [16][17][18][19][20]. Of particular relevance, tests had been designed to identify partially entangled qubit states [21,22] or the Pauli measurements [8,23,24] but, before now, not both together in the same test.
Our work completely solves the problem of randomness certification from any entangled pure two-qubit state using projective measurements. This question however remains open for POVMs. While four random bits are potentially attainable [8], no construction has achieved this bound, nor it has been proven to be unattainable for some partially entangled states.
Note added.-While completing this work, we learned that a similar approach was developed independently in [25].
Acknowledgements.-This work was supported by the Spanish MINECO (QIBEQI FIS2016-80773-P and Severo Ochoa grant SEV-2015-0522), the Generalitat de Catalunya (CERCA Program and SGR 1381), the Fundació Privada Cellex, the AXA Chair in Quantum Information Science, the ERC CoG QITBOX and the EU project QRANGE. B. B. acknowledges support from the Secretaria d'Universitats i Recerca del Departament d'Economia i Coneixement de la Generalitat de Catalunya and the European Social Fund (FEDER). J. K. acknowledges support under POLONEZ programme which has received funding from the European Union's Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement no. 665778. R. A. acknowledges the support from the Foundation for Polish Science through the First Team project (First TEAM/2017-4/31) cofinanced by the European Union under the European Regional Development Fund.

A. TILTED CHSH SELF-TEST
In the main text we used that the expectation value of the modified CHSH expression allows us to infer substantial information about the underlying quantum state and measurements. More precisely, if the quantum bound is attained then, in a suitable choice of basis, the underlying state must be of the form where ψ β = |ψ β ψ β | is the density operator associated to the state |ψ β = cos(θ β /2)|00 + sin(θ β /2)|11 , and the measurements are and B = cos Inversely, β and µ β are related to θ β by This result was essentially proved in the course of deriving the Tsirelson bound (56) for the more general family of I β α expressions done in [7], particularly the steps around Eqs. (14)- (16). (The result is also closely related to the self-test based on I β in [22], although the formulation is slightly different.) Since [7] does not present this as a main result we review it here in more detail.
We proceed by first restricting to projective measurements on a bipartite pure qubit state before generalising to arbitrary dimension using the Jordan lemma and explicitly allowing for an underlying mixed state.

A. Qubit systems
The most general two-qubit pure state has the form for 0 ≤ θ ≤ π/2, in its Schmidt decomposition, while the most general projective measurements worth considering are with a = a = b = b = 1, since we cannot exceed the classical bound if any of the measurements are ±1. We recall that the density operator associated with the state (65) can be written in terms of the Pauli operators X, Y, and Z. We write the expectation value of I β as where and Substituting now where b ± are normalised and orthogonal and we take cos µ 2 , sin µ 2 ≥ 0, S = 2 cos µ 2 a · Tb + + 2 sin µ 2 a · Tb − ≤ 2 cos µ 2 Tb + + 2 sin µ 2 Tb − Using this in (69), In order to attain the quantum bound I β = 2 √ 2 1 + β 2 /4, all of the inequalities used to get from (69) to (74) must hold with equality. Working backwards, we extract that 2 cos(θ) = β 1 + sin(θ) 2 , a = cos(ϕ)1 x + sin(ϕ)1 y , Under the convention β > 0 and 0 ≤ θ β , µ β 2 ≤ π 2 that we are working with, these imply the relations (62) and (63) for θ β and µ β given above. The remaining undetermined parameter ϕ can be set to 0 e.g. with the phase changes |1 A → e iϕ |1 A and |1 B → e −iϕ |1 B , under which the Schmidt decomposition is invariant.

B. Basis fixing
Assuming a pure system of two qubits, the preceding derivation shows that, if the quantum bound I β = 2 √ 2 1 + β 2 /4 is attained, then there is a basis in which: i ) the state is ii ) Alice's measurements are iii ) Bob's measurements are such that In order to generalise this it is important to notice that imposing any two of these conditions implies the third.

C. Arbitrary dimension and mixed states
According to the Jordan lemma, the measurement operators A, A and B, B can be block diagonalised in their respective Hilbert spaces into blocks no larger than 2 × 2.
We express this as where A j , A j , B k , and B k are 2 × 2 dichotomic Hermitian operators and, with respect to this block diagonalisation, an arbitrary unknown state as with |Ψ s = jk √ q jk|s |ψ jk|s |j |k .
We can then express the expectation value of I β as a convex sum of contributions. In order to attain the quantum bound I β = 2 √ 2 1 + β 2 /4, for each contribution (j, k, s) either we must have I (jk|s) β = 2 √ 2 1 + β 2 /4 or p s q jk|s = 0. For those contributions for which p s q jk|s = 0 and where I (jk|s) attains the quantum bound, we are free to choose the bases such that and B k + B k = 2 cos i.e., conditions ii ) and iii ) from the previous subsection, which fixes |ψ jk|s = |ψ β . For any remaining blocks, we necessarily have ks p s q jk|s = 0 or j p s q jk|s = 0, i.e., the corresponding block j or k acts on the orthogonal complement to the support of Alice's or Bob's marginal of ρ. Removing these and collectively denoting them A ⊥ , A ⊥ , B ⊥ , and B ⊥ gives the expressions (58)-(61) above for Alice's and Bob's measurements and with |junk s = jk √ q jk|s |j |k , for the state.