Device-Independent Certification of Maximal Randomness from Pure Entangled Two-Qutrit States Using Non-Projective Measurements

Abstract

While it has recently been demonstrated how to certify the maximal amount of randomness from any pure two-qubit entangled state in a device-independent way, the problem of optimal randomness certification from entangled states of higher local dimension remains open. Here we introduce a method for device-independent certification of the maximal possible amount of $2{log}_{2}3$ random bits using pure bipartite entangled two-qutrit states and extremal nine-outcome general non-projective measurements. To this aim, we exploit a device-independent method for certification of the full Weyl–Heisenberg basis in three-dimensional Hilbert spaces together with a one-sided device-independent method for certification of two-qutrit partially entangled states.

1. Introduction

The intrinsic randomness of quantum theory manifested in the outcomes of quantum measurement is one of the most intriguing features of quantum mechanics [1]. Even more remarkable is the fact that quantum technologies allow us to generate certifiable randomness with an unprecedented level of security [2]. Protocols designed for randomness certification ensure both the generation of completely random bits and their privacy, which for instance introduces new possibilities in designing protocols for tasks such as quantum cryptography and quantum key distribution [3].

Since the pioneering works on randomness certification [4] (see also Ref. [2]), significant progress has been made both in theoretical and experimental aspects [5,6,7,8]. It was shown, for instance, in Ref. [9], that maximal violation of the Salavrakos–Augusiak–Tura–Wittek–Acín–Pironio (SATWAP) Bell inequality [10] enables self-testing the maximally entangled state of two-qudits of arbitrary local dimension, which in turn allows certifying ${log}_{2}d$ bits of randomness by using projective measurements. On the other hand, we know that non-projective measurements, also known as positive-operator valued measures (POVM), can be used to generate more randomness in a given dimension than projective ones. The intuitive reason behind this is the existence of extremal $d^2$-outcome non-projective measurements in d-dimensional Hilbert spaces, which consequently might give rise to $2{log}_{2}d$ random bits [11]. In fact, a method for certification of two bits of local randomness in dimension two by exploiting such non-projective measurements was introduced in Ref. [12].

Similar research was conducted in Ref. [13], where the authors exploited Gisin’s elegant Bell inequality [14] instead of the Clauser–Horne–Shimony–Holt (CHSH) inequalities used in Ref. [12]. Later, in Ref. [15] it was shown how to certify the maximal amount of local randomness independently of the degree of entanglement of two-qubit states.

While significant progress has been made in understanding the possibility of device-independent randomness certification from entangled states of the lowest possible dimension, higher-dimensional scenarios remain mostly unexplored; see nevertheless the recent work [16] presenting an approach in which by using symmetric informationally complete POVMs one can obtain more than ${log}_{2}d$ bits of local randomness from the maximally entangled two-qudit state of the local dimension up to $d=7$.

However, it remains an open and highly nontrivial problem whether it is possible to device-independently certify the maximal amount of $2{log}_{2}d$ bits of randomness by performing measurements on quantum systems of dimension d for any finite d. Another interesting direction to explore is whether the maximal amount of randomness can be certified independently of the degree of entanglement of states used in the protocol. In this work considering $d=3$, we provide a positive answer to the first problem and a partial solution to the second one; that is, we show how to certify $2{log}_{2}3$ bits of randomness by performing local non-projective measurements on a well-defined subset of pure bipartite entangled states in a fully device-independent way.

In our work, we use the family of Bell inequalities proposed in Ref. [17] that allows for self-testing the two-qutrit maximally entangled state as well as three mutually unbiased bases (MUBs) per party. We extend the self-testing proof of [17] to certify, up to the transposition equivalence, all of the Weyl–Heisenberg (W-H) operators acting on three-dimensional Hilbert spaces. Our approach for W-H basis certification is inspired by Ref. [15] and is based on simultaneous maximal violation of the Bell inequality from Ref. [17] by two appropriately selected sets of measurements. In this way, we can self-test a complete set of four MUBs, which allows us to construct eight W-H operators in dimension three. As a consequence of certifying the complete W-H basis, we can characterize any measurement acting on three-dimensional Hilbert space in terms of basis elements [18]. Let us note that our self-testing statements for measurements are always up to the standard equivalences [19], but also up to the transposition equivalence.

The structure of our article is the following. In the preliminaries, we first present the scenario used in our work. Next, we review the Bell inequality from [17], with slight modifications that are necessary for presenting our results. Afterwards, we also review the steering inequality introduced in Ref. [20], which, together with the Bell inequality [17] enables certification of any pure bipartite entangled state of local dimension three. In the second part, where we present our results, we provide a method for device-independent certification of the full W-H basis. Then, we present the main result of our work, which is proof for device-independent certification of a maximal amount of local randomness from pure entangled states in dimension three. Finally, we recall the construction of extremal qutrit POVM of Ref. [20] for a significant subset of partially entangled states that can be used for optimal randomness certification.

2. Preliminaries

2.1. Scenario

Since we are concerned with the device-independent certification of randomness, we consider an adversarial Bell scenario, consisting of two parties, Alice and Bob, and an adversary, Eve. Alice and Bob cannot trust their devices in this scheme because Eve, a malicious eavesdropper, could have full control of all of their resources. An example of Eve’s strategy might be to use extra dimensions of the Hilbert space hidden in the devices to learn about the results of Alice’s and Bob’s measurements. Eve may also try to entangle with the subsystems of our protagonists Alice and Bob and create correlations, which will allow her to obtain some information on the outputs of the experiment. Nevertheless, the strength of the randomness certification techniques lies in the possibility to prove that, despite any attacks, Eve cannot learn anything about the results of Alice’s and Bob’s measurements. Security of the protocol is demonstrated if they both observe strong correlations in their measurement statistics, i.e., correlations that exhibit the maximal quantum violation of a given Bell inequality.

We construct the following scenario to certify randomness from pure bipartite entangled states of local dimension three in a device-independent way. Alice and Bob perform local measurements on their quantum subsystems, labelled by A and B, which they receive from the preparation device $\mathcal{P}$ operated by Charlie and consisting of two inputs $p=1,2$. Preparation ${\mathcal{P}}_1$ corresponds to preparing a state ${\rho }_{AB}^1$ and ${\mathcal{P}}_2$ a state ${\rho }_{AB}^2$. Both preparations can be purified as $|{\mathsf{\Psi }}_{ABE}^1\rangle$ and $|{\mathsf{\Psi }}_{ABE}^2\rangle$, respectively. Charlie can freely choose the input of the preparation device.

Alice’s device has nine inputs labelled by $j=0,\cdots ,8$ and Bob’s device has four inputs labelled by $k=0,1,2,3$. The first eight measurements of Alice and all measurements of Bob result in three outputs, labelled by a for Alice and b for Bob such that $a,b=0,1,2$. The ninth measurement on Alice’s side corresponding to $j=8$ is a nine-outcome measurement. We employ this additional measurement to certify randomness from its outcomes. A schematic representation of our scenario is presented in Figure 1. It is necessary here to assume that the measurements are independent of the input of the preparation device.

Alice, Bob, and Charlie now collect statistics for each input and the corresponding outputs, which allows them to reconstruct the probability distribution $\overrightarrow{p}=\left\{p(a,b|j,k,p)\right\}$, where $p(a,b|j,k,p)$ is the probability that outcomes a and b are obtained when performing measurements j and k on the subsystems A and B given the preparation p. Using this scenario, one can first certify the full Weyl–Heisenberg basis (Section 3.1), then any entangled state of local dimension $d=3$, and, finally, the optimal amount of randomness from entangled states of local dimension $d=3$ (Section 3.2).

Let us now discuss potential strategies for Eve that need to be taken into account to ensure that the generated randomness is not accessible by her. For example, suppose Alice wants to generate randomness from the outcomes of one of her measurements. Then the aim for Eve is to guess Alice’s outputs with the highest possible probability. To do so, Eve can prepare Alice’s and Bob’s systems in any way compatible with the given statistics $\overrightarrow{p}$ by using quantum resources while remaining undetected. Therefore, we can characterize Eve’s strategy S applied for the attack using four major points:

1.

Eve, for instance, may know the input of the preparation device p and the inputs of Alice and Bob $x,y$, but she cannot change them.

2.

Eve might possess some subsystem E correlated with both parties. Consequently, the state shared among Alice and Bob is defined by ${\rho }_{AB}={\mathrm{Tr}}_E\left({\rho }_{ABE}\right)$, where ${\rho }_{ABE}\in {\mathcal{H}}_A\otimes {\mathcal{H}}_B\otimes {\mathcal{H}}_E$ denotes the state shared among Alice, Bob, and Eve such that the local Hilbert spaces can be of any arbitrary dimension.

3.

Eve might have control over Alice’s and Bob’s measurement devices, that is, POVM $F_j=\left\{F_{a|j}\right\}$ on ${\mathcal{H}}_A$ and POVM $G_k=\left\{G_{b|k}\right\}$ on ${\mathcal{H}}_B$, respectively.

4.

Eve’s device is characterized by POVM $Z=\left\{Z_a\right\}$ on ${\mathcal{H}}_E$. The probability of obtaining outcome a from a measurement performed by Eve on her share of the joint state ${\rho }_{ABE}$ is the best guess of Alice’s outcome a.

Since there is no restriction on Eve’s subsystem, we can safely assume here that ${\rho }_{ABE}$ is pure and write ${\rho }_{ABE}=|{\mathsf{\Psi }}_{ABE}\rangle \langle {\mathsf{\Psi }}_{ABE}|$. Eve’s influence remains undetected if it cannot be observed in the statistics $\overrightarrow{p}$ obtained by Alice and Bob, i.e.,

$$p\left(ab\right|jk)=\langle {\mathsf{\Psi }}_{ABE}|F_{a|j}\otimes G_{b|k}\otimes {𝟙}_E|{\mathsf{\Psi }}_{ABE}\rangle .$$

(1)

Now let us define the local guessing probability, that is, the probability that Eve’s guess agrees with Alice’s output [12]:

$$G(j,\overrightarrow{p})=\underset{S\in S_{\overrightarrow{p}}}{sup}\sum _a\langle {\mathsf{\Psi }}_{ABE}|\left(F_{a|j}\otimes {𝟙}_B\otimes Z_a\right)|{\mathsf{\Psi }}_{ABE}\rangle ,$$

(2)

where the supremum is taken over all strategies $S_{\overrightarrow{p}}$, consisting of the shared state ${\rho }_{ABE}$, Bob’s measurements $\left\{G_b^k\right\}$, and Eve’s measurements $\left\{Z_a\right\}$ that reproduce the statistics $\overrightarrow{p}$. The amount of random bits obtained from Bob’s measurements is quantified with the min-entropy of the guessing probability $H_{min}=-{log}_{2}G(j,\overrightarrow{p})$.

Now let us say more about the additional ninth measurement on Alice’s side. We can assume it to be a nine-outcome POVM $\left\{R_a\right\}$, which, applied on Alice’s part of an entangled qutrit state, gives completely random results, i.e., $\mathrm{Tr}\left[R_a{\rho }_A\right]=1/9$, $\forall a$. Apart from the above conditions, we require that POVM $\left\{R_a\right\}$ should reproduce the statistics given by Equation (1), that is, any of Eve’s attempt of learning of Alice’s outputs remains undetected. We present an example of a measurement construction meeting the above properties in the Section 3.3. Our goal is to prove that Eve’s guessing probability related to Alice’s j-th input and consistent with the statistics $\overrightarrow{p}$, does not allow Eve to learn anything about Alice’s outputs, i.e., $G(j,\overrightarrow{p})=1/9$. Such a situation will provide us with $2{log}_{2}3$ bits of private randomness. To sum up, we certify randomness based on the correlations, which minimize Eve’s guessing probability, and these correlations are obtained by measuring POVM $\left\{R_a\right\}$ on Alice’s subsystem. For that purpose, we employ an arbitrary entangled state of local dimension 3 certified with the extended Bell scenario and the W-H operators on Bob’s side certified with the use of a Bell test.

2.2. Non-Local Scenario and Bell Inequality

In Ref. [17], the authors presented a modification of the Buhrmann–Massar Bell inequality [21] to show self-testing of the maximally entangled state of two-qutrits and three mutually unbiased bases on each site. In our work, we apply this certification scenario to self-test the complete set of W-H operators in dimension three. Later this result is used for the certification of randomness from the measurement $F_8=\left\{R_a\right\}$. The main idea behind self-testing of the full W-H basis is taken from Refs. [12,15] and consists in using the Bell inequality from Ref. [17] twice. Below we introduce crucial elements needed to present self-testing results.

Throughout this work, we use the correlation picture or, equivalently, the observable picture to describe all correlations observed between Alice and Bob, i.e.,

$$\langle A_{l|j}{B}_{m|k}\rangle =\sum _{a,b=0}^2{\omega }^{al+bm}p\left(ab\right|jk),$$

(3)

where $\omega =exp(2\pi 𝕚/3)$ and $l,m=0,1,2$. The above formula is a two-dimensional Fourier transform of the conditional probabilities $p\left(ab\right|jk)$. Operators $A_{l|j},B_{m|k}$ provide us with an alternative description of the measurements $\left\{F_{a|j}\right\}$ and $\left\{G_{b|k}\right\}$ [17], and are defined by Fourier transform in the following way:

$$A_{l|j}=\sum _{a=0}^2{\omega }^{al}{F}_{a|j},B_{m|k}=\sum _{b=0}^2{\omega }^{bm}{G}_{b|k}.$$

(4)

Let us note here that we make no assumptions about Alice’s and Bob’s measurements or the shared state; in fact, we consider a fully general situation of ${\rho }_{AB}$ being mixed and Alice’s and Bob’s measurement being POVMs. In such a general situation, the above measurement operators $A_{l|j}$ satisfy $A_{l|j}^{†}{A}_{l|j}\le 𝟙$ and $A_{l|j}{A}_{l|j}^{†}\le 𝟙$ for any l and j, and $A_{0|j}=𝟙$ for any j (the same holds for $B_{m|k}$ operators).

Since in our scenario we are dealing with three-outcome measurements, it is not difficult to observe that $A_{2|j}=A_{1|j}^{†}$. Therefore, by also taking into account the fact that $A_{0|j}=𝟙$, this implies that measurement is fully determined by a single operator $A_{1|j}$, which, for simplicity, we denote as $A_j$; analogously for Bob’s measurements, we denote $B_k\equiv B_{1|k}$. In the case of the measurements $F_j$ and $G_k$ being projective, $A_{l|j}$ and $B_{m|k}$ are all unitary operators whose spectra are $1,\omega ,{\omega }^2$, and can be represented as $A_{l|j}=A_j^l$ and $B_{m|k}=B_k^m$, where the superscripts l and m are operator powers of the unitary quantum observables $A_j$ and $B_k$, such that $A_j^d=B_k^d=𝟙$. In this case the expectation values (3) can be expressed as:

$$\langle A_{l|j}{B}_{m|k}\rangle =\langle {\mathsf{\Psi }}_{ABE}|A_j^l\otimes B_k^m\otimes {𝟙}_E|{\mathsf{\Psi }}_{ABE}\rangle .$$

(5)

Let us introduce now the Bell inequality used in our scenario. We consider a slightly simplified Bell operator from [17] for $d=3$, which is sufficient for our purposes. The modification results from the omission of the identity term, and now the Bell operator is given by:

$$W_1:=\frac{\lambda }{27}\sum _{j,k=0}^2{\omega }^{jk}{A}_j\otimes B_k+h.c.,$$

(6)

where $\lambda =e^{-𝕚\pi /18}$, and h.c. stands for the hermitian conjugation. The corresponding Bell inequality is defined as:

$$\langle W_1\rangle \le {\beta }_L,$$

(7)

where ${\beta }_L$ is its classical bound, that is, the maximal value of the Bell expression $\langle W_1\rangle$ over all correlations admitting the local-realistic description, and it amounts to:

$$\begin{array}{cc}\hfill {\beta }_L& =\frac{2cos(\pi /9)}{3\sqrt{3}}.\hfill \end{array}$$

Moreover, the maximal quantum value of the above Bell inequality was found in Ref. [17] to be:

$${\beta }_Q=\frac{2}{3\sqrt{3}}.$$

(8)

It is achieved by the maximally entangled state of two qutrits:

$$|{\mathsf{\Phi }}_{AB}\rangle :=\frac{1}{\sqrt{3}}\sum _{j=0}^2{|i\rangle }_A{|i\rangle }_B$$

(9)

and the following choice of Bob’s observables:

$$B_0=Z,B_1=X,B_2=\omega X^2{Z}^2,$$

(10)

where:

$$X:=\sum _{i=0}^2|i+1\rangle \langle i|andZ:=\sum _{i=0}^2{\omega }^i|i\rangle \langle i|$$

(11)

and $|3\rangle \equiv |0\rangle$. It is worth noticing that the eigenvectors of $B_i$ form mutually unbiased bases in ${\mathbb{C}}^3$. At the same time, Alice’s optimal observables can be expressed as the following linear combinations of the above optimal observables of Bob:

$$A_j:=\frac{{\lambda }^{*}}{\sqrt{3}}\sum _k{\omega }^{-jk}{B}_k^{*},$$

(12)

where ${}^{*}$ denotes the complex conjugation in the standard basis.

The above Bell inequality can be used for device-independent characterization of Bob’s measurements. In fact, it follows from Ref. [17] that if it is maximally violated by correlations obtained from the first preparation $|{\mathsf{\Psi }}_{ABE}^1\rangle$ and the measurements $B_i$$(i=0,1,2)$, then the latter are projective. Moreover, $dim\left({\mathcal{H}}_B\right)=3·t_B$ for some positive integer $t_B$, or, equivalently, ${\mathcal{H}}_B={\left({\mathbb{C}}^3\right)}_{B^{\prime }}\otimes {\left({\mathbb{C}}^{t_B}\right)}_{B^{″}}$, and there exists a unitary operation $U_B:{\mathcal{H}}_B\to {\mathcal{H}}_B$ such that:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill U_B{B}_0{U}_B^{†}& =Z\otimes Q_1+Z\otimes Q_2,\hfill \\ \hfill U_B{B}_1{U}_B^{†}& =X\otimes Q_1+X^2\otimes Q_2,\hfill \\ \hfill U_B{B}_2{U}_B^{†}& =\omega X^2{Z}^2\otimes Q_1+X{Z}^2\otimes Q_2,\hfill \end{array}\end{array}$$

(13)

where the operators $Q_1,Q_2$ are orthogonal projectors satisfying $Q_1+Q_2={𝟙}_{B^{″}}$. These two projectors identify the orthogonal subspaces corresponding to two inequivalent sets of observables maximally violating the Bell inequality (7) that are related via transposition.

Regarding the side of Alice, we can draw a similar conclusion as for Bob’s subsystem, and we can also determine the form of the first preparation $|{\mathsf{\Psi }}_{ABE}^1\rangle$ [17]. However, we will not use their explicit forms in what follows; therefore, we do not present them here. In fact, the aim of performing the Bell test on the first preparation is to certify Bob’s measurements.

2.3. Steering Inequality

In this subsection, we recall the steering inequality introduced in Ref. [20], and we show how to use it for certification of the second preparation.

Let us again consider Alice and Bob performing measurements on some quantum state $|{\mathsf{\Psi }}_{ABE}^2\rangle$. For a moment, assume that one of the measuring devices, let us say that belonging to Bob, is trusted and performs fixed measurements; Alice’s measurement device remains untrusted. Let us then consider the steering inequality constructed in Ref. [20]:

$$\langle W_3\rangle \le {\tilde{\beta }}_L,$$

(14)

where $W_3$ is a steering operator given by:

$$\begin{array}{ccc}\hfill W_3& =& A_6\otimes B_0+\gamma A_7\otimes B_1+{\delta }_1{B}_0+A_6^{†}\otimes B_0^{†}+\gamma A_7^{†}\otimes B_1^{†}+{\delta }_1^{*}{B}_0^{†},\hfill \end{array}$$

(15)

where:

$$\gamma =3{\left(\sum _{\begin{array}{c}i,j=0\\ i\ne j\end{array}}^2\frac{{\alpha }_i}{{\alpha }_j}\right)}^{-1},{\delta }_k=-\frac{\gamma }{3}\sum _{\begin{array}{c}i,j=0\\ i\ne j\end{array}}^2\frac{{\alpha }_i}{{\alpha }_j}{\omega }^{-kj}.$$

(16)

Coefficients $\gamma$ and ${\delta }_k$ are functions of three positive numbers ${\alpha }_i$ such that ${\alpha }_1^2+{\alpha }_2^2+{\alpha }_3^2=1$. Then, ${\tilde{\beta }}_L$ is the classical bound of (14). Although we do not know its explicit form for any ${\alpha }_i$, it was proven in Ref. [20] that for any ${\alpha }_i>0$ it is strictly lower than the maximal quantum value of $\langle W_3\rangle$, ${\tilde{\beta }}_Q=3$.

Recall also that ${\alpha }_i$ are Schmidt coefficients of the following state:

$$\begin{array}{c}\hfill |\psi \left(\mathbf{\alpha }\right)\rangle =\sum _{i=0}^2{\alpha }_i|i_A\rangle |i_B\rangle ,\end{array}$$

(17)

which maximally violates the inequality (7) for observables on the trusted side fixed to be Z and X, where we denoted $\mathbf{\alpha }=({\alpha }_1,{\alpha }_2,{\alpha }_3)$.

Importantly, we can employ the above steering inequality to device-independently certify the second preparation $|{\mathsf{\Psi }}_{ABE}^2\rangle$. To this end, we use it together with Bob’s observables $B_0$ and $B_1$, which, with the aid of the Bell inequality (6) (see Section 2.2), are certified to be of the form (13). Precisely, we can determine the form of Alice’s observables $A_6$ and $A_7$ in the sense that up to some unitary $U_A:{\mathcal{H}}_A\to {\mathcal{H}}_A$ we have:

$$U_A{A}_6{U}_A^{†}=Z\otimes {𝟙}_{A^{″}},U_A{A}_7{U}_A^{†}=X\otimes {\overline{P}}_1+X^2\otimes {\overline{P}}_2,$$

(18)

such that ${\overline{P}}_1,{\overline{P}}_2$ are orthogonal projectors satisfying ${\overline{P}}_1+{\overline{P}}_2={𝟙}_{A^{″}}$. Moreover, the joint state corresponding to the second preparation $|{\mathsf{\Psi }}_{ABE}^2\rangle$ up to the unitaries acting on Alice’s and Bob’s systems can be expressed as:

$$(U_A\otimes U_B\otimes {𝟙}_E)|{\mathsf{\Psi }}_{ABE}^2\rangle ={|\psi \left(\mathbf{\alpha }\right)\rangle }_{A^{\prime }{B}^{\prime }}\otimes |{\xi }_{A^{″}{B}^{″}E}\rangle .$$

(19)

Therefore, the expression (19) constitutes a self-testing statement for any entangled state in dimension three.

3. Results

3.1. Certification of Full Weyl–Heisenberg Basis in d = 3

In this subsection we present a method for device-independent certification of a full W-H basis, which, up to some phases, consists of the operators $W_{p,q}:=X^p{Z}^q$, with $p,q=0,1,2$. We begin by observing that the eigenvectors of the particular subset of the W-H operators $W_{p,q}=X^p{Z}^q$, that is, $\{Z,X,XZ,X{Z}^2\}$ are mutually unbiased for $d=3$. Let $M_r$ denote subsequent elements of this subset, where $r=0,1,2,3$ and ${\mathsf{\Pi }}_r^{\left(b\right)}$ denote the projectors constructed from the eigenvectors of $M_r$, where $b=0,1,2$ labels the outcomes of a given observable. Operators $M_r$ can be written in terms of the spectral decomposition as:

$$M_r=\sum _{b=0}^2{\omega }^b{\mathsf{\Pi }}_r^{\left(b\right)}.$$

(20)

Let us note that multiplying the operators $M_r$ with powers of $\omega$ or taking conjugate transpose results just in relabeling $M_r$’s outcomes. Now let us observe that apart from the identity, the remaining W-H operators $\{Z^2,X^2,X^{2}Z,X^2{Z}^2\}$ can be obtained from the set $\left\{M_r\right\}$ through a suitable rearrangement of the eigenvalues:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill Z^2=M_0^{†}& =\sum _b{\omega }^{-b}{\mathsf{\Pi }}_0^{\left(b\right)},\hfill \\ \hfill X^2=M_1^{†}& =\sum _b{\omega }^{-b}{\mathsf{\Pi }}_1^{\left(b\right)},\hfill \\ \hfill X^{2}Z=\omega M_3^{†}& =\sum _b{\omega }^{-b+1}{\mathsf{\Pi }}_3^{\left(b\right)},\hfill \\ \hfill X^2{Z}^2={\omega }^2{M}_2^{†}& =\sum _b{\omega }^{-b+2}{\mathsf{\Pi }}_2^{\left(b\right)}.\hfill \end{array}\end{array}$$

(21)

The conclusion from the above consideration is that it is enough to certify only 4 particular observables out of a full W-H basis, while the remaining ones can be obtained by adequately relabelling the outcomes.

As shown in Section 2.2, the maximal violation of the Bell inequality (7) allows one to certify three such particular observables. To certify the fourth one we consider another Bell operator given by:

$$\begin{array}{cc}\hfill W_2:=\frac{\lambda }{27}[A_3\otimes \left(B_0+B_2^{†}+B_3\right)+A_4\otimes (B_0+\omega B_2^{†}& +{\omega }^2{B}_3)\hfill \\ & +A_5\left.\otimes \left(B_0+{\omega }^2{B}_2^{†}+\omega B_3\right)\right]+h.c.\hfill \end{array}$$

(22)

Notice that while Alice’s measurements in this Bell operator are all different from those used in $W_1$, on Bob’s side the two measurements $B_0$ and $B_2$ are same.

We aim to prove that observation of the maximum violation of the Bell inequality (7) by the two different sets of observables corresponding to the Bell operators $W_1$ and $W_2$ self-tests the complete W-H basis in dimension three up to the unitary and transposition equivalences. First, maximal violation of (7) by $W_1$ implies that Bob’s measurements are projective and that the corresponding observables $B_i$ with $i=0,1,2$ are of the form (13). Second, it follows from Ref. [17] that maximal violation of the same inequality by $W_2$ implies that $B_3$ is a quantum observable too and that $B_0$, $B_2^{†}$ and $B_3$ must satisfy the following relations:

$$\begin{array}{c}\hfill \begin{array}{c}\hfill B_0^{†}=-\omega \{B_2^{†},B_3\},\\ \hfill B_3^{†}=-\omega \{B_0,B_2^{†}\},\\ \hfill B_2=-\omega \{B_3,B_0\}.\end{array}\end{array}$$

(23)

These conditions can be used to reconstruct the fourth observable of Bob, $B_3$. Precisely, plugging the forms of $B_0$ and $B_2$ into the second relation in (23), one immediately finds that:

$$U_B{B}_3{U}_B^{†}={\omega }^2{X}^{2}Z\otimes Q_1+XZ\otimes Q_2.$$

(24)

Let us refer here to the fact that we cannot distinguish between optimal measurements used in the device-independent scenario and their transpositions based only on the correlations $\overrightarrow{p}$ observed in a Bell experiment. We call this ambiguity transposition inequivalence. For this reason, we are unable to perform a full tomography of the POVM on Alice’s side. In other words, it is not possible to completely reconstruct the elements of the POVM implemented on Alice’s side from the joint correlations. Consequently, we cannot certify the maximum randomness directly from the POVM elements. Nevertheless, in the following section, we present a way to overcome this difficulty. We show how to certify maximal randomness from the POVM on Alice’s side without certifying the measurement itself.

To summarize this section, we managed to certify four observables on Bob’s side by using the two Bell operators $W_1$ and $W_2$. Then, we observe that with a proper relabeling (21) we can construct the other four elements of the W-H basis. With the identity operator, we can then have the complete set of nine W-H operators in dimension three. For the convenience of further calculations, up to certain relabeling of the outcomes, let us express the certified observables $B_k$ as follows:

$$\begin{array}{c}\hfill U_B{B}_{p,q}{U}_B^{†}=X^p{Z}^q\otimes Q_1+Z^q{X}^{2p}\otimes Q_2,\end{array}$$

(25)

where $p,q=0,1,2$.

3.2. Certification of Randomness

We can finally proceed to the randomness certification. As discussed before, the last ingredient of our scheme is the nine-outcome POVM that Alice performs on her subsystem. Since the state on which $F_8$ acts is certified to be (19), without loss of generality, we can consider this measurement to be a POVM acting on a state of dimension $3·t$ where t is some positive integer. Let us denote the POVM under consideration by $\left\{{\tilde{R}}_a\right\}$, where $a=0,1,\cdots ,8$ represents the outcomes of the measurement. The correlations between the outcomes of non-ideal POVM and Bob’s observables $B_{p,q}$ (25) should equal those of the ideal setup, as expressed in Equation (1). This means that:

$$\begin{array}{c}\hfill \langle {\mathsf{\Psi }}_{ABE}^2|{\tilde{R}}_a\otimes B_{p,q}\otimes {𝟙}_E|{\mathsf{\Psi }}_{ABE}^2\rangle =\langle \psi \left(\mathbf{\alpha }\right)|R_a\otimes W_{p,q}|\psi \left(\mathbf{\alpha }\right)\rangle ,\end{array}$$

(26)

where $\left\{R_a\right\}$ represents some ideal extremal POVM. Let us recall that POVMs of a fixed number of outcomes form a convex set, and given that POVM is called extremal if it cannot be decomposed as a convex mixture of other POVMs, we will now demonstrate that the above construction provides the certification of maximal amount of local randomness from the non-ideal POVM.

Let us note here that the ideal POVM elements $R_a$ used in definition (26) can be written as:

$$R_a=\sum _{k,l=0}^{d-1}{r}_{k,l}^a{P}^{-1}{\left(X^k{Z}^l\right)}^{*}{P}^{-1},$$

(27)

which follows from the fact that $R_a$ belongs to a three-dimensional Hilbert space and $P={\sum }_{i=0}^2{\alpha }_i|i\rangle \langle i|$, such that ${\alpha }_i\ne 0$ for all i. For a remark, let us note that operators $P^{-1}{\left(X^k{Z}^l\right)}^{*}{P}^{-1}$ form a complete operator basis for measurements acting on three-dimensional Hilbert space. Using the fact that $|\psi \left(\mathbf{\alpha }\right)\rangle =\sqrt{3}P\otimes {𝟙}_B|\mathsf{\Phi }\rangle$, where:

$$|\mathsf{\Phi }\rangle =\frac{1}{\sqrt{3}}\left(|00\rangle +|11\rangle +|22\rangle \right),$$

(28)

let us now look at the right-hand side of Equation (26), which, after a simple computation, gives:

$$\langle \psi \left(\mathbf{\alpha }\right)|R_a\otimes W_{p,q}|\psi \left(\mathbf{\alpha }\right)\rangle =r_{p,q}^a.$$

(29)

Hence, from (26) we have that:

$$\langle {\mathsf{\Psi }}_{ABE}|{\tilde{R}}_a\otimes B_{p,q}\otimes {𝟙}_E|{\mathsf{\Psi }}_{ABE}\rangle =r_{p,q}^a.$$

(30)

Next we can substitute (19) into (30) and obtain:

$$\begin{array}{c}\hfill \begin{array}{c}\hfill \langle {\xi }_{A^{″}{B}^{″}E}|\langle \psi \left(\mathbf{\alpha }\right)|U_A{\tilde{R}}_a{U}_A^{†}\otimes U_B{B}_{p,q}{U}_B^{†}\otimes {𝟙}_E|\psi \left(\mathbf{\alpha }\right)\rangle |{\xi }_{A^{″}{B}^{″}E}\rangle =r_{p,q}^a,\end{array}\end{array}$$

(31)

where from now on, we will use the notation ${\overline{R}}_a=U_A{\tilde{R}}_a{U}_A^{†}$, and $U_B{B}_{p,q}{U}_B^{†}$ is given by Equation (25).

Since $\left\{{\overline{R}}_a\right\}$ acts on a subsystem of dimension $3·t$, without loss of generality, we can decompose its elements as:

$${\overline{R}}_a=\sum _{k,l=0}^2{P}^{-1}{\left(X^k{Z}^l\right)}^{*}{P}^{-1}\otimes {\overline{R}}_{k,l}^a,$$

(32)

where ${\overline{R}}_{k,l}^a$ act on ${\mathcal{H}}_{A^{″}}$. Now we can insert an expression for ${\overline{R}}_a$ (32), the state $|{\mathsf{\Psi }}_{ABE}^2\rangle$ from (19), and Bob’s measurements $B_{p,q}$ (25) into Equation (30) to find the following formulas:

$$\begin{array}{c}\hfill \langle {\xi }_{A^{″}{B}^{″}E}|{\overline{R}}_{0,q}^a\otimes {𝟙}_{B^{″}E}|{\xi }_{A^{″}{B}^{″}E}\rangle =r_{0,q}^a\end{array}$$

(33)

for $p=0$ and all q, and

$$\begin{array}{cc}\hfill \langle {\xi }_{A^{″}{B}^{″}E}|& {\overline{R}}_{p,q}^a\otimes Q_1\otimes {𝟙}_E\hfill \\ \hfill & +{\omega }^{2pq}{\overline{R}}_{2p,q}^a\otimes Q_2\otimes {𝟙}_E|{\xi }_{A^{″}{B}^{″}E}\rangle =r_{p,q}^a\hfill \end{array}$$

(34)

for $p=1,2$ and all q. Inspired by Acín et al. [12], we define the following normalized states:

$$|{\varphi }_{A^{″}}^{b,e}\rangle =\frac{1}{\sqrt{q_{b,e}}}\left(𝟙\otimes Q_b\otimes \sqrt{Z_e}\right)|{\xi }_{A^{″}{B}^{″}E}\rangle ,$$

(35)

where $b=1,2$; $Z_e$ is a POVM element corresponding to Eve’s outcome e and $\sqrt{q_{b,e}}$ is a normalization factor. Now, by using $|{\varphi }_{A^{″}}^{b,e}\rangle$, we can reformulate coefficients (33) and (34) as follows:

$$r_{p,q}^a=\sum _{b=1,2}\sum _e{q}_{b,e}{\tilde{r}}_{p,q}^{a;b,e},$$

(36)

where we have defined the coefficients:

$${\tilde{r}}_{p,q}^{a;1,e}:=\langle {\varphi }^{1,e}|{\overline{R}}_{p,q}^a\otimes {𝟙}_{B^{″}}\otimes {𝟙}_E|{\varphi }^{1,e}\rangle ,$$

(37)

and

$${\tilde{r}}_{p,q}^{a;2,e}:={\omega }^{2pq}\langle {\varphi }^{2,e}|{\overline{R}}_{2p,q}^a\otimes {𝟙}_{B^{″}}\otimes {𝟙}_E|{\varphi }^{2,e}\rangle .$$

(38)

Let us now define the following operators in terms of coefficients (37) and (38):

$${\overline{R}}_a^{1,e}=\sum _{p,q}{\tilde{r}}_{p,q}^{a;1,e}{P}^{-1}{\left(X^p{Z}^q\right)}^{*}{P}^{-1},$$

(39)

and

$${\overline{R}}_a^{2,e}=\sum _{p,q}{\tilde{r}}_{p,q}^{a;2,e}{P}^{-1}{\left(X^p{Z}^q\right)}^{*}{P}^{-1}.$$

(40)

It is easy to check that the operators ${\overline{R}}_a^{b,e}$ are valid POVMs, that is, they satisfy the following properties, ${\overline{R}}_a^{b,e}\ge 0$ and ${\sum }_a{\overline{R}}_a^{b,e}=𝟙$. To see this, using Equation (37) let us rewrite the decompositions of the operators given by Equation (39) as follows:

$${\overline{R}}_a^{1,e}={\mathrm{Tr}}_{A^{″}{B}^{″}E}\left[({\overline{R}}_a\otimes {𝟙}_{B^{″}E})({𝟙}_A\otimes |{\varphi }^{1,e}\rangle \langle {\varphi }^{1,e}|)\right].$$

(41)

From the fact that ${\overline{R}}_a\ge 0$ and ${\sum }_a{\overline{R}}_a=𝟙$ and from the above equation, it then follows that ${\overline{R}}_a^{1,e}\ge 0$ and ${\sum }_a{\overline{R}}_a^{1,e}=𝟙$. Therefore, the coefficients ${\tilde{r}}_{p,q}^{a;1,e}$ define a family of valid POVMs with the operators ${\overline{R}}^{1,e}$. Note that the operators ${\overline{R}}_a^{2,e}$ are a transposition of the operators ${\overline{R}}_a^{1,e}$. Thus, the coefficients ${\tilde{r}}_{p,q}^{a;2,e}$ also define a family of POVMs with the operators ${\overline{R}}^{2,e}$.

Using Equations (39) and (40), we have the following expression from Equation (36):

$$\begin{array}{c}\hfill R_a=\sum _{b,e}{q}_{b,e}{\overline{R}}_a^{b,e},\end{array}$$

(42)

which can be understood as a convex decomposition of the ideal POVM $\left\{R_a\right\}$ in terms of the POVMs ${\overline{R}}^{b,e}$ with the respective weights $q_{b,e}$. However, the POVM $\left\{R_a\right\}$ is extremal and cannot be expressed as a convex combination of other POVMs. Thus, we have ${\tilde{r}}_{p,q}^{a;b,e}=r_{p,q}^a$ for all $b,e$ and ${\sum }_{b,e}{q}_{b,e}=1$. Finally, rewriting the guessing probability (2) of Eve for outcomes of Alice’s POVM $\left\{{\overline{R}}_a\right\}$, we have:

$$\begin{array}{cc}\hfill G(j=8,\overrightarrow{p})& =\sum _a\langle {\mathsf{\Psi }}_{ABE}|{\overline{R}}_a\otimes 𝟙\otimes Z_a|{\mathsf{\Psi }}_{ABE}\rangle .\hfill \end{array}$$

(43)

Using Equations (19) and (32) in the above equation, we arrive at:

$$\begin{array}{cc}\hfill G(j=8,\overrightarrow{p})& =\sum _a\langle {\xi }_{A^{″}{B}^{″}E}|{\overline{R}}_{0,0}^a\otimes 𝟙\otimes Z_a|{\xi }_{A^{″}{B}^{″}E}\rangle .\hfill \end{array}$$

(44)

Now, using Equation (33), we can simplify (44) as follows:

$$\begin{array}{cc}\hfill G(j=8,\overrightarrow{p})& =\sum _{b,a}{q}_{b,a}{\tilde{r}}_{0,0}^{a;b,a}=\sum _{b,a}{q}_{b,a}{r}_{0,0}^a,\hfill \end{array}$$

(45)

where we have used the constraint on ${\tilde{r}}_{0,0}^{a;b,a}$ as argued in the previous paragraph. Now, choosing an ideal POVM $\left\{R_a\right\}$ (27) such that

$$\begin{array}{c}\hfill r_{0,0}^a=1/9\forall a,\end{array}$$

(46)

and using it for the guessing probability from Equation (45), gives $G(j=8,\overrightarrow{p})=1/9$. This implies that using the scheme mentioned above, Alice can securely generate $-{log}_{2}G=2{log}_{2}3$ bits of randomness from any partially entangled two-qutrit state provided that there exist extremal POVMs that satisfy the condition (46). As a final remark here let us note that Equation (29) for $p,q=0,0$ gives:

$$\langle \psi \left(\mathbf{\alpha }\right)|R_a\otimes {𝟙}_B|\psi \left(\mathbf{\alpha }\right)\rangle =r_{0,0}^a,$$

(47)

which is equivalent to the expression

$$\mathrm{Tr}\left[R_a{\rho }_A\right]=r_{0,0}^a,$$

(48)

where ${\rho }_A={\mathrm{Tr}}_B\left(|\psi \left(\mathbf{\alpha }\right)\rangle \langle \psi \left(\mathbf{\alpha }\right)|\right)$. In the following section we present the construction of the extremal POVM, which satisfies the condition (46).

3.3. Construction of Extremal Qutrit POVM

D’Ariano and collaborators [11] have classified all extremal POVMs with discrete output sets. According to this classification, an extremal POVM $\left\{R_a\right\}$ with $d^2$ outcomes must necessarily be rank-one, and its elements must be linearly independent. Linear independence of the POVM elements can be verified with the condition ${\sum }_a{s}_a{R}_a=\mathbb{O}$, where $\mathbb{O}$ is the zero matrix, satisfied if and only if all $s_a=0$. We also require that POVM elements acting on Alice’s subsystem give equal probabilities, i.e., $\mathrm{Tr}\left[R_a{\rho }_A\right]=1/9$ for all a and ${\rho }_A$. Finding a general class of POVMs that meets all the above conditions for any partially entangled state proved to be a demanding task. Below we present a construction provided in Ref. [20] that fulfills the above requirements for a well-defined subset of entangled two-qutrit states.

The nine POVM elements are given by:

$$R_a:={\lambda }_a|{\alpha }_a\rangle \langle {\alpha }_a|,$$

(49)

with

$$\begin{array}{c}\hfill |{\alpha }_0\rangle =|0\rangle ,|{\alpha }_8\rangle =|2\rangle ,\end{array}$$

(50)

and for $a=1,\cdots ,7$:

$$\begin{array}{c}\hfill |{\alpha }_a\rangle ={\mu }_0|0\rangle +{\mu }_{1}exp\left(\frac{2\pi 𝕚(a-1)}{7}\right)|1\rangle +{\mu }_{2}exp\left(\frac{6\pi 𝕚(a-1)}{7}\right)|2\rangle .\end{array}$$

Moreover, the coefficients ${\lambda }_a$ are given by:

$$\begin{array}{cc}\hfill {\lambda }_0& =\frac{1}{9{\alpha }_0^2},{\lambda }_2=\frac{1}{9{\alpha }_2^2},{\lambda }_a=\frac{1}{7}\left(3-{\lambda }_0-{\lambda }_2\right),\hfill \end{array}$$

(51)

for $a=1,\cdots ,7$, whereas ${\mu }_0,{\mu }_1,{\mu }_2$ are are defined as:

$$\begin{array}{c}\hfill {\mu }_0=\sqrt{\frac{1-{\lambda }_0}{7{\lambda }_1}},{\mu }_1=\sqrt{\frac{1}{7{\lambda }_1}},{\mu }_2=\sqrt{\frac{1-{\lambda }_2}{7{\lambda }_1}}.\end{array}$$

(52)

Notice that the vectors $|{\alpha }_a\rangle$ are normalized.

To construct an extremal POVM, all of the above coefficients defining it must satisfy $0<{\lambda }_i<1$ and $0<{\mu }_j<1$, for $i=0,\cdots ,8$, and $j=0,1,2$. The above inequalities must be strict, as otherwise, if one of them equals 0 or 1, the operators $R_b$ are not linearly independent and thus do not form an extremal POVM. Solving the set of inequalities that emerge from the above constraints, one obtains ${\alpha }_0>1/3$ and ${\alpha }_2>1/3$. By relabeling the indices in (50) and (51) we can generalize the constraint on ${\alpha }_0$ and ${\alpha }_2$ to the requirement that any two out of three $\alpha$’s have to be greater than $1/3$. Let us recall at this point that up to local unitaries any bipartite state of local dimension three can be expressed using Schmidt decomposition in the form of Equation (17). Therefore, the above POVMs give rise to $2{log}_{2}3$ bits of randomness if any two Schmidt coefficients of the state are greater than $1/3$.

Using the Monte Carlo method [22], we have checked that the above condition is satisfied by $92.6\%$ states out of ${10}^7$ randomly generated ones. It remains an open problem to find an extremal POVM that would generate maximal randomness from any entangled state in dimension three.

4. Discussion

In our work, we introduced a method for device-independent certification of maximal randomness from pure entangled states in dimension three using non-projective measurements. For this purpose, we exploited the extended Bell scenario introduced recently in Ref. [20], which combines device-independent certification of local measurements with one-sided device-independent certification of pure entangled states. In fact, we first showed how to certify the complete set of W-H operators in dimension three by using the self-testing scheme proposed in Ref. [17]. Then, by using the steering scenario proposed in [20], we provided certification of any entangled state in dimension three. These two components finally allowed us to achieve the main goal of the paper, that is, to certify $2{log}_{2}3$ random bits by performing generalized measurements on Alice’s subsystem of partially-entangled two-qutrit states. In fact, we verified numerically that the constructed POVM that we used in our scheme covers a significant subset of $92.6\%$ of bipartite entangled states.

Several interesting directions for further research emerge from our work. First, it would be extremely interesting to understand what is the maximal amount of global randomness that can be certified from entangled quantum states of local dimension d by performing non-projective measurements on both subsystems. Whereas the known theoretical limit says that at most $4{log}_{2}d$ bits of randomness can be created in this way, it is unclear whether this limit is achievable. In fact, it was shown recently in Ref. [15] that in the case of two-qubit systems, $3.9527$ bits of randomness is actually the maximal amount that can be generated in a device-independent way. This intriguing observation comes from the fact that an adversary can use some of the global correlations obtained with non-projective qubit measurements to infer information about the outcomes of a Bell experiment. Therefore, understanding the fundamental limit for generating global randomness from two-qudit states in the non-local scenario remains a very interesting challenge. Another interesting problem for further research is to provide constructions of $d^2$-outcome extremal POVMs that can be used to generate randomness from any, even arbitrarily small, entangled states.