Source-linked AI summary
MHz-rate semi-device-independent quantum random number generators based on unambiguous state discrimination
Jonatan Bohr Brask, Anthony Martin, William Esposito, Raphael Houlmann, Joseph Bowles, Hugo Zbinden, Nicolas Brunner
TL;DR
Non-orthogonal states cannot be distinguished with certainty, but their unambiguous discrimination produces inconclusive events that can supply randomness. The paper uses those events in a semi-device-independent prepare-and-measure protocol, demonstrating an optical implementation with a final random-bit rate of 16.5 MHz.
Problem
How can a prepare-and-measure protocol use non-orthogonal states to generate randomness while bounding an observer’s ability to guess its output?
Source: §I · p. 2Method
The protocol uses unambiguous discrimination of non-orthogonal states and bounds guessing probability from observed data and a state-overlap lower bound, without assumptions about the measurement device.
Source: §I · pp. 2–3Results
16.5 MHz of final random bits were generated in the single-pulse implementation.
Source: §III · p. 5Takeaways & Limitations
A simple optical setup achieved a rate comparable to commercial QRNGs, with the protocol requiring a bound on state overlap but no measurement-device assumption.
Source: §IV · p. 6The source pulse energy must be characterized well enough to bound state overlap in every round, which can be delicate when power fluctuates.
Source: §III · p. 6
Abstract
from arXiv · showhide
An approach to quantum random number generation based on unambiguous quantum state discrimination (USD) is developed. We consider a prepare-and-measure protocol, where two non-orthogonal quantum states can be prepared, and a measurement device aims at unambiguously discriminating between them. Because the states are non-orthogonal, this necessarily leads to a minimal rate of inconclusive events whose occurrence must be genuinely random and which provide the randomness source that we exploit. Our protocol is semi-device-independent in the sense that the output entropy can be lower bounded based on experimental data and few general assumptions about the setup alone. It is also practically relevant, which we demonstrate by realising a simple optical implementation achieving rates of 16.5 Mbits/s. Combining ease of implementation, high rate, and real-time entropy estimation, our protocol represents a promising approach intermediate between fully device-independent protocols and commercial QRNGs.
I. PROTOCOL
The protocol extracts randomness from inconclusive outcomes of unambiguous discrimination between non-orthogonal states, while bounding an observer’s guessing probability using the observed data and a lower bound on state overlap. It requires an independent input and a bound on the prepared states’ overlap, but makes no assumptions about the measurement device.
I. PROTOCOL
- Non-orthogonal states impose a minimum inconclusive-event rate, and whether a given round is inconclusive cannot be predicted in advance, making these events genuinely random.The output bit c records whether the measurement was inconclusive; conclusive labels help estimate entropy but are not directly used for extraction.Source: §I · p. 2
- In the ideal case, perfect USD gives pg = δ; when δ = 1/2, the protocol certifies a perfectly random bit.The ideal statistics are p(0|0) = p(1|1) = 1−δ, zero error probabilities, and p(ø|0) = p(ø|1) = δ.Source: §I · p. 2
- The protocol bounds the probability of guessing whether a round was inconclusive from the observed p(b|x) and overlap bound, then uses that bound to estimate min-entropy for extraction.The bound considers measurement strategies consistent with the data, including strategies that may vary from run to run.Source: §I · pp. 2–3
- Fixed coefficients make each updated guessing-probability bound a simple linear function of the data, avoiding a new SDP and supporting finite-size effects.For perfect USD with overlap δ, the bound numerically certifies pg ⩽ δ.Source: §I · p. 3
- The input must be independent of the devices, and the prepared states must have fidelity at least δ from every observer’s perspective; the measurement device is unrestricted.The fidelity condition need not require identical states in every round; it bounds their relative distinguishability.Source: §I · p. 3
II. IMPLEMENTATIONS
The paper describes time-bin and photon-number implementations using weak coherent states, with simple single-photon detection to identify conclusive outcomes. The time-bin scheme can realize optimal USD ideally, while the single-pulse scheme identifies only one state unambiguously.
II. IMPLEMENTATIONS
- In the time-bin scheme, weak pulses occupy the early or late slot, and a detector click identifies the corresponding state; no click is inconclusive.Without losses or noise, p(b = ø) = exp(−|α|2), the minimum inconclusive rate, with no errors.Source: §II · pp. 3–4, Figure 2 · p. 4
- Detector inefficiency typically increases inconclusive outcomes and dark counts increase errors, although the protocol can still extract randomness.In practice, the measurement does not exactly achieve optimal USD.Source: §II · p. 4
- The single-pulse scheme encodes vacuum and a weak coherent pulse, so a click identifies only the pulse state and no click is inconclusive.This is a partial USD measurement; the output b = 0 never occurs and c = b.Source: §II · p. 4, Figure 2 · p. 4
- Biasing the input toward x = 1 can increase output entropy, with the protocol’s input probabilities chosen to suit the implementation.The text notes that this bias is advantageous, as in quantum key distribution protocols.Source: §II · p. 4
- Beyond time-bin and photon-number encoding, polarization states offer another practical option, with optimal USD realized by a partial polarizer.Frequency and spatial-mode encodings are also identified as possibilities.Source: §II · p. 4
III. EXPERIMENTS
The experiments implement the USD protocol with time-bin and photon-number encoding. The photon-number implementation generates 16.5 MHz of final random bits, while the entropy analysis accounts for detector dead time and possible source-power fluctuations.
Implementations
- Both implementations use essentially the same optical setup with minor modifications; the time-bin setup uses a 50 MHz FPGA and 40 ps pulses at 655 nm.The FPGA delays one of the two encoded pulses by 10 ns for one input value.Source: §III · p. 4
Entropy estimation
- Finite-run probabilities are bounded using Chernoff–Hoeffding with ε = 10⁻⁹, and extraction adapts the final rate to keep min-entropy per output bit constant.The protocol estimates conditional probabilities from experimental counts before applying randomness extraction.Source: §III · p. 5
Results
- 0.22 maximum entropy per raw bit at |α|² = 0.3 yields 11 MHz of final random bits for time-bin encoding.The typical error rate is around 4 × 10⁻⁴.Source: §III · p. 5, Figure 4 · p. 5
Entropy estimation
- A 34 ns effective detector dead-time is modeled as a correction to detection probabilities when estimating the time-bin implementation’s entropy.The pulse energy is the only adjustable parameter used to optimize min-entropy per raw bit.Source: §III · p. 5
Results
- 16.5 MHz of final random bits is obtained with photon-number encoding at |α|² = 0.60, with 0.33 entropy per bit.Figure 4 compares min-entropy against pulse energy for both implementations.Source: §III · p. 5, Figure 4 · p. 5
Source-power fluctuations
- Reasonable entropy remains certifiable even when maximum pulse energy is five times the mean, accounting for possible source-power fluctuations.Figure 5 plots min-entropy against the ratio of maximum to average pulse energy.Source: §III · p. 6, Figure 5 · p. 6
Assumptions
- The protocol assumes input independence and a per-round lower bound on state overlap; unaccounted power fluctuations can violate that bound.At higher pulse energies, the overlap decreases, so fluctuations must be accounted for when bounding it in each round.Source: §III · p. 6
IV. CONCLUSION
The conclusion presents USD-based randomness generation as semi-device-independent, requiring a bound on prepared-state overlap but no measurement-device assumption. Its optical implementation reaches 16.5 MHz, comparable to commercial QRNGs, while supporting real-time entropy monitoring.
Conclusion
- The optical implementation achieves 16.5 MHz, comparable to commercial QRNGs, while allowing real-time monitoring of output entropy.The protocol is described as combining high rates, ease of implementation, and strong security.Source: §IV · p. 6
Security assumptions
- The main physical assumption is a bound on prepared-state overlap; no assumption about the measurement device is needed.The protocol uses a prepare-and-measure configuration based on USD.Source: §IV · p. 6
Related work
- The authors note that the single-pulse setup was independently discussed in Ref. under different technical and security assumptions.Source: §IV · p. 6
Appendix A: Bounding pg by semidefinite programing
The appendix bounds the guessing probability with semidefinite programming, discussing both primal and dual programs. It begins with fixed state overlap and extends the treatment to larger overlaps.
Appendix A
- The appendix uses semidefinite programming to bound the guessing probability and discusses both primal and dual formulations.Source: Appendix A · p. 8
- The derivation first assumes the prepared states have fixed overlap |⟨ψ0|ψ1⟩| = δ.Source: Appendix A · p. 8
- The appendix shows that the analysis also covers overlap |⟨ψ0|ψ1⟩| = ∆ > δ.Source: Appendix A · p. 8
1. Primal
The primal formulation maximizes guessing probability over measurement strategies consistent with observed data. It reduces the strategy set to four cases and yields a bound computable by semidefinite programming.
Primal
- For fixed overlap and observed p(b|x), the primal maximizes guessing probability over measurement strategies that reproduce the data, assuming balanced inputs.The formulation uses qλ for strategy probabilities and ρx for the prepared-state density matrices.Source: §1 · pp. 8–9
- Unitary invariance reduces the states to a two-dimensional representation, so the maximum depends only on δ and observed p(b|x).The states can be represented as |ψ0⟩ = |0⟩ and |ψ1⟩ = δ|0⟩ + √(1 − δ)|1⟩.Source: §1 · p. 8
- Four measurement strategies suffice after grouping cases by which term maximizes for each input.Source: §1 · p. 8
- Absorbing strategy weights into the POVM elements yields a guessing-probability bound computable by semidefinite programming.The constraints make the maximization an SDP that provides optimal bounds for the given overlap and data.Source: §1 · pp. 8–9
2. Dual
The dual SDP addresses the primal method’s update-speed, overlap-uncertainty, and finite-size concerns by yielding a bound evaluable as a linear function of observed data. That bound remains valid whenever the actual state overlap is at least the assumed lower bound.
2. Dual
- A feasible dual solution gives a fast linear bound on guessing probability from updated data, with finite-size effects incorporated straightforwardly.Fixed coefficients avoid rerunning the full SDP whenever the observed distribution changes.Source: §2 · pp. 9–10
- Lagrange multipliers form a supremum that upper-bounds the primal guessing probability, and minimizing it yields the dual bound.The derivation introduces multipliers for the primal constraints and restricts them to make the supremum finite.Source: §2 · p. 9
- The bound obtained at overlap δ also holds for every ∆ ≥ δ because distributions achievable at overlap ∆ are contained in the set achievable at δ.The construction uses an ancilla to reduce the state overlap while preserving measurement statistics.Source: Figure 6 · p. 10, §2 · p. 10