Megahertz-Rate Semi-Device-Independent Quantum Random Number Generators Based on Unambiguous State Discrimination

An approach to quantum random number generation based on unambiguous quantum state discrimination is developed. We consider a prepare-and-measure protocol, where two nonorthogonal quantum states can be prepared, and a measurement device aims at unambiguously discriminating between them. Because the states are nonorthogonal, this necessarily leads to a minimal rate of inconclusive events whose occurrence must be genuinely random and which provide the randomness source that we exploit. Our protocol is semi-device-independent in the sense that the output entropy can be lower bounded based on experimental data and a few general assumptions about the setup alone. It is also practically relevant, which we demonstrate by realizing a simple optical implementation, achieving rates of $16.5\mathrm{Mbits}/\mathrm{s}$. Combining ease of implementation, a high rate, and a real-time entropy estimation, our protocol represents a promising approach intermediate between fully device-independent protocols and commercial quantum random number generators.

Figure 1

Steps of our QRNG protocol. (1) Data are generated in a prepare-and-measure setup. The prepared states are known to have a certain minimal overlap, and hence the preparation device is a “gray box,” while nothing is assumed about the measurement device, which is a “black box.” (2) From the collected data, a conditional probability distribution for outputs given inputs is estimated, and, from this, a bound on the entropy in the output data is evaluated. (3) Based on the entropy bound, a string of certified perfectly random bits is extracted from the output data.

Figure 2

Implementations with weak coherent states encoded in time bins. (a) Two-pulse scheme. For each pair of time bins, a laser emits a weak pulse in either the early or the late slot, corresponding to the states $|{\psi }_0⟩=|\alpha ⟩|0⟩$ and $|{\psi }_1⟩=|0⟩|\alpha ⟩$. Each bin is measured by a single-photon detector. If a click is registered in the early or late bin, the system outputs $b=0$ or $b=1$, respectively, while if no click is registered, an inconclusive output is produced, $b=Ø$. (b) Single-pulse scheme. The states are encoded in single pulses of weak coherent states or vacuum, $|{\psi }_0⟩=|0⟩$ and $|{\psi }_1⟩=|\alpha ⟩$. When a click is registered, the output is $b=1$, while no click is treated as inconclusive $b=Ø$.

Figure 3

Experimental implementation of the QRNG. The preparation device corresponds here to the two-pulse protocol.

Figure 4

Min-entropy per raw bit generated by the QRNG as a function of the energy per pulse $|\alpha {|}^2$. The left plot represents the protocol with time-bin encoding (two pulses), while the right plot considers the photon-number protocol (single pulse). In both plots, the red curve corresponds to the theoretical prediction obtained for a perfect single-photon detector with an efficiency of 77% (corresponding to our experimental value) but without considering dead time. The blue curve considers the effect of detector dead time and shows good agreement with experimental data (black points).

Figure 5

Bound on the entropy when taking possible power fluctuations of the source into account. The min-entropy is plotted as a function of the ratio $|{\alpha }_{\max }{|}^2/|\alpha {|}^2$, where $|{\alpha }_{\max }{|}^2$ is the maximal energy per pulse and $|\alpha {|}^2$ is the average pulse energy of the source. For both protocols, we plot the min-entropy in blue and the corresponding average energy per pulse of the source in red. Note that, even when the maximal pulse energy is assumed to be as high as 5 times larger than the mean energy, a reasonable amount of entropy can still be certified.

Figure 6

Larger set: Space of all conditional distributions $p(b|x)$. Set $S_{\delta }$: Distributions obtainable from states with overlap $\delta$. Set $S_{\mathrm{\Delta }}$: Distributions obtainable from states with overlap $\mathrm{\Delta }>\delta$. A bound obtained from the dual SDP using overlap $\delta$ defines a hyperplane (dashed line) with $S_{\delta }$ on one side. To see that the bound holds for all $\mathrm{\Delta }>\delta$, it is sufficient to realize that $S_{\mathrm{\Delta }}\subseteq S_{\delta }$.