Asymptotically Optimal Adversarial Strategies for the Probability Estimation Framework

Abstract

The probability estimation framework involves direct estimation of the probability of occurrences of outcomes conditioned on measurement settings and side information. It is a powerful tool for certifying randomness in quantum nonlocality experiments. In this paper, we present a self-contained proof of the asymptotic optimality of the method. Our approach refines earlier results to allow a better characterisation of optimal adversarial attacks on the protocol. We apply these results to the (2,2,2) Bell scenario, obtaining an analytic characterisation of the optimal adversarial attacks bound by no-signalling principles, while also demonstrating the asymptotic robustness of the PEF method to deviations from expected experimental behaviour. We also study extensions of the analysis to quantum-limited adversaries in the (2,2,2) Bell scenario and no-signalling adversaries in higher $(n,m,k)$ Bell scenarios.

1. Introduction

Randomness has proven to be a valuable resource for a multitude of tasks, be it computation or communication. In cryptography, access to reliable random bits is essential, since the security of various cryptographic primitives is known to be compromised if the incorporated randomness is of poor quality [1,2,3]. In the study of random network modelling, being able to sample random graphs uniformly and (reliably) at random is crucial [4]. And, for some problems, randomised algorithms are known to vastly outperform their deterministic counterparts [5].

A distinction between two notions of randomness, those of process and product, is discussed in [6] (chapter 8). Although both notions are tightly connected, randomness of a process refers to its unpredictability, while that of a product refers to a lack of pattern in it. An unpredictable process will, with high probability, produce a sequence (a string of bits, say) that is patternless; on the other hand, a seemingly irregular string of bits might not be unpredictable and instead be a probabilistic mixture of pre-recorded information. While product randomness suffices for tasks like Monte Carlo simulations, sampling and those involving randomised algorithms, cryptographic applications involving an adversary necessitate process randomness.

Process randomness, while being non-existent in the strictest interpretation of any classical theory, is permissible in quantum mechanics; an important example of this is quantum nonlocality as manifested in a Bell experiment. Quintessentially, the setup of a Bell experiment constitutes an entangled quantum system shared between two spatially separated stations $\mathsf{A}$ and $\mathsf{B}$ receiving inputs $\mathsf{x}$ and $\mathsf{y}$, and recording outcomes $\mathsf{a}$ and $\mathsf{b}$, respectively. If after n successive trials the observed correlations between the outcomes conditioned on the settings violate a Bell inequality then it can be ruled out that the outcomes were pre-assigned by some probabilistic mixture of deterministic processes. Also, the outcomes are (unpredictably) random, not only to the respective users of the devices at the two stations but also to an adversary, even to one having a complete understanding of the Bell experiment. This relationship between nonlocality in quantum mechanics and its random nature is at the foundation of various device-independent random number generation protocols.

Device independence is considered a gold standard in cryptographic tasks such as quantum random number generation and quantum key distribution, in which the respective users are not required to know or trust the inner machinery of their devices, thus treating them as mere black boxes to which they can provide inputs and record outcomes. The only assumption that the experimental setup must satisfy is that the measurement choices of the devices must be uncorrelated with their inner workings. This is the measurement independence assumption, which is ultimately untestable but is tacitly assumed, arguably, in almost all scientific experiments. The no-signalling condition that the outcome recorded at each station is not influenced by the choice of measurement at the other station holds throughout the experiment because of the space-like separation between the stations and the impossibility of superluminal signalling in accordance with the special theory of relativity. Furthermore, the adversary trying to simulate the observed statistics may be considered computationally unbounded, a standard that falls under the paradigm of information-theoretic security. Over the years, technological advancement has facilitated loophole-free Bell nonlocality experiments, which have not only provided experimental validation to rule out a classical description of nature [7,8,9,10], but have also found practical applications in device-independent quantum randomness generation and device-independent quantum key distribution [11,12,13].

The probability estimation framework is a broadly applicable framework for performing device-independent quantum randomness generation (DIQRNG) upon a finite sequence of loophole-free Bell experiment data and involves direct estimation of the amount of certifiable randomness by obtaining high-confidence bounds on the conditional probability of the observed measurement outcomes conditioned on the measurement settings in the presence of classical side information [14,15,16]. Advantageous primarily for its demonstrated applicability to Bell tests with small Bell violations and high efficiency for a finite number of trials, it can also accommodate changing experimental conditions and allows early stoppage upon meeting certain criteria. Also, it can be extended to randomness generation with quantum devices beyond the device-independent scenario.

The probability estimation framework for DIQRNG is provably secure against adversaries who do not possess entanglement with the sources. Security against more general adversaries, with quantum entanglement with the sources, is possible with the quantum estimation framework [17], for which the constructions of the probability estimation framework can often be translated to the quantum estimation framework (as was carried out in [18]), so that progress with the former framework can often be used for the more general latter framework.

The asymptotic optimality of the probability estimation framework was discussed in [15]. The specific result of asymptotic optimality is as follows: given a sufficiently large number of trials sampling from a fixed behaviour (i.e., a set of quantum statistics), the amount of certified randomness per trial is arbitrarily close to a certain upper limit. Then [15] argues, appealing to convex geometry and the asymptotic equipartition property (AEP), that an adversary can always implement a probabilistic mixture of conditional probability distributions, independent and identically distributed across successive experimental trials, that generates observed statistics consistent with the fixed behaviour while not needing to generate more than that same upper limit of randomness per trial that is certified by the probability estimation framework. This is important in the sense that the framework certifies all the randomness conceded by the adversary in that particular attack, while also showing that there is no advantage to be gained for the adversary by resorting to (more sophisticated) memory attacks.

In this paper, we provide a full derivation of the asymptotic optimality of the probability estimation framework, filling in some steps omitted by [15], along the way obtaining a better characterisation of the adversary’s optimal probabilistic mixture for generating the observed statistics. Making precise the arguments from convex geometry, we explicitly describe the optimal attack that an adversary can employ with the minimum required number of different conditional distributions in convex mixture to simulate the observed statistics. Our improvement, with a more self-contained approach, upon the result in [15] is to reduce by one the cardinality of the adversary’s (finite-cardinality) set from which the auxiliary random variable takes values. This random variable serves as her side-information and records which conditional distribution occurs in which trial. Specifically, we prove that the number of possible conditional distributions in her optimal probabilistic mixture attack need not be more than one plus the dimension of the set of admissible distributions of a trial (Theorem 4). (We assume the set of admissible probability distributions of a given trial to be closed and convex, where we can take the convex closure when this assumption is not met; then the dimension $\dim \left(C\right)$ of a non-empty convex subset C of X is the dimension of the smallest affine subset containing C.) An earlier result (Theorem 43 in [15] under the same assumptions) proved only that the cardinality of the value space of the adversary’s side-information need not be more than two plus the dimension of the set of admissible distributions of a trial. Besides contributing to a methodological improvement, we have thus improved the result itself: a better understanding of the optimal attack in the asymptotic regime will establish a benchmark that will enable the implementer of the protocol to defend against these attack modes.

The central results on asymptotic optimality of the method of probability estimation comprise establishing an upper bound on the randomness per trial more than which the adversary need not concede (Theorems 3 and 4) and which is certified by the method of probability estimation (Theorems 5 and 6). Our derivation in Theorem 3 elucidates how only the classical form of the asymptotic equipartition property is needed for the probability estimation framework, allowing a simplified treatment. In addition to strengthening the result in Theorem 4, we have presented proofs for Theorems 5 and 6 (which have appeared previously in [15]), including more details and specifications where we deemed fit. For instance, in the proof for Theorem 6, enlisting the extreme value theorem we avoid an explicit analytic construction as presented in [15] (see Theorem 41 therein). We also consider the question of robustness of the probability estimation framework, not considered in [14,15]; we derive a sufficient condition (Theorem 7) for a probability estimation factor (optimised at a particular distribution) to certify randomness at a positive rate at a statistically different distribution.

We apply our results to the (2,2,2) Bell scenario (the scenario of two parties, two measurement settings and two outcomes), obtaining an analytic characterisation of the optimal attack of an adversary (restricted only by the no-signalling condition) holding classical side information. We show that the optimal adversarial attack involves a decomposition of the observed statistics in terms of a single extremal no-signalling (super-quantum) correlation and eight local deterministic correlations. The proof of optimality relies upon the fact that equal mixtures of two extremal no-signalling nonlocal super-quantum correlations are expressible as an equal mixture of four local deterministic correlations. We show that this result does not generalise to higher scenarios such as the (3,2,2), (2,3,2) and (2,2,3) Bell scenarios, thereby indicating that the possibility of an optimal attack involving only a single extremal strategy is only ensured in the minimal (2,2,2) Bell scenario. Furthermore, we considered the possibility of an adversary holding classical side information (and, hence, restricted to probabilistic attack strategies) but trying to simulate the observed statistics using quantum-achievable probability distributions, while conceding as little randomness as possible. Assuming uniform settings distribution, numerical studies restricted to a two-dimensional slice of the set of quantum-achievable distributions provided some initial evidence that the optimal quantum-achievable attack strategy involves only one extremal quantum correlation, but we were not able to settle this and have phrased it as a conjecture.

The rest of the article is organised as follows: In Section 2, we review the probability estimation framework where Theorem 1 formalises the central idea and Theorem 2 establishes a lower bound on the smooth conditional min-entropy of the sequence of outcomes conditioned on the settings and side-information. We also present a simplified proof of Lemma 1, an important result that allows the algorithm to execute the PEF method, compared to the proofs in [14,15]. In Section 3, we present our complete proof of asymptotic optimality, study the implications for finding an optimal adversarial attack strategy and derive a robustness result. In Section 4, we apply our results to the (2,2,2) Bell scenario obtaining an analytic characterisation of the optimal attack strategy for an adversary restricted only by the no-signalling condition. The optimal attack comprises a decomposition of the observed statistics in terms of a single Popescu–Rohrlich (PR) correlation and (up to) eight local deterministic correlations. We show that, for a higher number of parties, settings and/or outcomes, a crucial result from the (2,2,2) Bell scenario concerning equal mixtures of extremal nonlocal no-signalling correlations does not hold, and infer that the optimal attack may require more than one nonlocal distribution in general. Returning to the (2,2,2) scenario, we discuss a conjecture that the optimal strategy to mimic the observed statistics by means of a probabilistic mixture of quantum-achievable correlations constitutes only a single extremal quantum correlation and (up to) eight local deterministic correlations.

2. The Probability Estimation Framework

The probability estimation method relies on the probability estimation factor (PEF), which is a function that assigns a score to the results of a single trial of a quantum experiment, with higher scores corresponding to more randomness. The paradigmatic application is to a Bell nonlocality experiment comprising multiple spatially separated parties providing inputs (measurement settings) to measuring devices and recording outputs (observed outcomes); an experimental trial’s results then consist of both the choice of inputs and the recorded outputs for that trial. Figure 1 below shows a schematic two-party representation of such an experimental setting. After many repeated trials the product of the PEFs from all the trials is used to estimate the probability of outcomes conditioned on the settings.

For the examples considered in Section 4, we will consider the canonical scenario of two measuring parties Alice and Bob each selecting respective binary measurement settings X and Y and recording respective binary outcomes A and B, which we refer to as the (2,2,2) Bell scenario. For now, we treat things in a general manner as is carried out in [14,15], modelling the trial settings for all parties and outcomes for all parties with single random variables Z and C, respectively, taking values from respective finite-cardinality sets $\mathcal{Z}$ and $\mathcal{C}$. When applied to the (2,2,2) Bell scenario, C comprises the ordered pair $(A,B)$ and Z comprises the ordered pair $(X,Y)$.

The results of a sequence of n time-ordered trials are represented by the sequences $\mathbf{C}={\left\{C_i\right\}}_{i=1}^n,\mathbf{Z}={\left\{Z_i\right\}}_{i=1}^n$; and, so, $(\mathbf{C},\mathbf{Z})$ realises values $(\mathbf{c},\mathbf{z})\in {\mathcal{C}}^n\times {\mathcal{Z}}^n$, where ${\mathcal{C}}^n,{\mathcal{Z}}^n$ are the n-fold Cartesian products of $\mathcal{C},\mathcal{Z}$. A PEF is then a real-valued function of C and Z satisfying certain conditions, while the product of PEFs from all trials will be a function of $\mathbf{C}$ and $\mathbf{Z}$. High values of the PEF product will correlate with low values of $\mathbb{P}\left(\mathbf{C}\right|\mathbf{Z})$, the conditional probability of the outcomes given the settings.

To define PEFs, we introduce the notion of a trial model: a set $\Pi$ encompassing all joint probability distributions of settings and outcomes which are compatible with basic assumptions about the experiment. One important trial model that we consider is ${\Pi }_{\mathrm{Q}}$, consisting of joint distributions of $(C,Z)$ for which the conditional distribution of C conditioned on Z can be realised by a measurement on a quantum system. Here, we introduce the convention, used throughout, of using lower case Greek letters with random variables as arguments to denote distributions, i.e., $\mu (C,Z)$ and $\mu \left(C\right|Z)$ denote the joint distribution of $(C,Z)$ and the conditional distribution of C given Z, respectively. Another important trial model is ${\Pi }_{\mathrm{NS}}$ (NS stands for “no-signalling"), consisting of distributions for which probabilities of measurement outcomes at one location are independent of measurement settings at the other distant locations. (This is more clearly understood in considering the Alice–Bob example, where one of the no-signalling conditions is that ${\sum }_b\mu (A=a,B=b|X=x,Y=y)={\sum }_b\mu (A=a,B=b|X=x,Y=y^{\prime })$ for all $a,b,x$ and $y\ne y^{\prime }$.) A third important trial model is the set ${\Pi }_{\mathrm{L}}$ of distributions for which the conditional distribution of outcomes conditioned on settings are local, which means they can be expressed as convex mixtures of local deterministic behaviours. In the bipartite setting, the conditional distribution ${\mu }_{\mathrm{LD},\lambda }(A,B|X,Y)$, also referred to as a behaviour, is local deterministic if ${\mu }_{\mathrm{LD},\lambda }(A=a,B=b|X=x,Y=y)=\left[[a=f(x,\lambda )]\right]\left[[b=g(y,\lambda )]\right]$ (where the notation $\left[\right[\cdots \left]\right]$ represents the function that evaluates to 1 if the condition within holds, 0 otherwise). In words, the outcomes are functions of the local settings and the local hidden variable $\lambda$ which can be understood to be a list of outcomes for all possible settings. A formal definition involving more parties and an arbitrary (albeit same) number of outcomes and settings for each party can be found in (48). The sets ${\Pi }_{\mathrm{L}},{\Pi }_{\mathrm{Q}}\mathrm{and}{\Pi }_{\mathrm{NS}}$ satisfy the following strict inclusions:

$${\Pi }_{\mathrm{L}}⊊{\Pi }_{\mathrm{Q}}⊊{\Pi }_{\mathrm{NS}}.$$

Certain distributions in ${\Pi }_{\mathrm{Q}}$ and ${\Pi }_{\mathrm{NS}}$ violate a Bell inequality and are known to contain randomness; they are contained in ${\Pi }_{\mathrm{Q}}\setminus {\Pi }_{\mathrm{L}}$ and ${\Pi }_{\mathrm{NS}}\setminus {\Pi }_{\mathrm{L}}$, respectively. It is precisely the inability to decompose such distributions into deterministic ones, as in ${\Pi }_{\mathrm{L}}$, that implies the presence of randomness. The objective of the PEF approach is to quantify the randomness contained in such distributions. As trial models specify the joint distribution $\mu (C,Z)$, and for the above examples of trial models we gave only the conditional distributions $\mu \left(C\right|Z)$, one must also specify the marginal distribution of the settings $\mu \left(Z\right)$. For the discussions of ${\Pi }_{\mathrm{Q}}$ and ${\Pi }_{\mathrm{NS}}$ in subsequent sections, any fixed distribution satisfying $\mu (Z=z)>0$ for all $z\in \mathcal{Z}$ is permitted. An example of a fixed settings distribution is the equiprobable distribution $Unif\left(Z\right)$ defined as $Unif\left(z\right)=1/\left|\mathcal{Z}\right|$ for all $z\in \mathcal{Z}$.

As a discrete probability distribution is effectively an ordered list of numbers in $[0,1]$ (the probabilities), trial models are always subsets of ${\mathbb{R}}^N$, where N is fixed by the cardinality of $\mathcal{C}$ and $\mathcal{Z}$. This enables us to use a geometric approach to study these sets, which prove to be invaluable for some arguments.

We can now define PEFs. We use the notation ${\mathbb{E}}_{\mu }[\dots ]$ and ${\mathbb{P}}_{\mu }(\dots )$ to denote expectation and probability, respectively, with respect to a distribution $\mu$; and for the sake of notational concision we omit commas in distributions or functions of more than one random variable, for instance, $\mu \left(CZ\right)$ and $f\left(CZ\right)$ must be understood to mean $\mu (C,Z)$ and $f(C,Z)$.

Definition 1 (Probability Estimation Factor).

A probability estimation factor (PEF) with power $\beta >0$ for the model of distributions Π is a function $F:\mathcal{C}\times \mathcal{Z}\to {\mathbb{R}}^{+}$ of the random variables $(C,Z)$ such that for all $\sigma \left(CZ\right)\in \Pi$, ${\mathbb{E}}_{\sigma }[F\left(CZ\right)\sigma \left(C{\left|Z\right)}^{\beta }\right]⩽1$ holds.

In the expression above, $\sigma \left(C\right|Z)$ denotes a random variable that is a function of the random variables C and Z: $\sigma \left(C\right|Z)$ is the random variable that assumes the standard conditional probability (according to $\sigma$) of C taking the value c conditioned on Z taking the value z; it is assigned the value zero if the probability $\sigma (Z=z)$ is zero. The parameter $\beta$ can be any positive real value. We then note that the constant PEF $F\left(cz\right)=1$ for all $(c,z)\in \mathcal{C}\times \mathcal{Z}$ is a valid PEF for any choice of $\beta >0$. We will notice in the subsequent sections, however, that the parameter does have an effect on the method employed for choosing useful PEFs for the purpose of randomness certification; and in practice we choose the value of $\beta$ that corresponds to the maximum randomness certification.

Prior to defining a PEF we introduced the notion of a trial model. For the application of probability estimation to the outcomes of an experiment, which is a sequence of n time-ordered trials, we introduce the notion of an experiment model: it is a set $\Theta$ constraining the joint distribution of $\mathbf{C}$,$\mathbf{Z}$ and E, constructed as a chain of individual trial models $\Pi$; it consists of joint distributions $\mu \left(\mathbf{CZ}\right|E=e)$ conditioned on the event $\{E=e\}$, where E is the random variable denoting the adversary’s side information and realising values e from the finite set $\mathcal{E}$. It satisfies the following two assumptions:

$$\begin{array}{c}\hfill \mu (C_{i+1}{Z}_{i+1}|{\mathbf{C}}_{⩽i}={\mathbf{c}}_{⩽i},{\mathbf{Z}}_{⩽i}={\mathbf{z}}_{⩽i},E=e)\in \Pi ,\forall {\mathbf{c}}_{⩽i}\in {\mathcal{C}}^i,{\mathbf{z}}_{⩽i}\in {\mathcal{Z}}^i,e\in \mathcal{E},\\ \hfill \mu (Z_{i+1},{\mathbf{C}}_{⩽i}{\mathbf{Z}}_{⩽i}|E=e)=\mu \left(Z_{i+1}|E=e)\mu \right({\mathbf{C}}_{⩽i}{\mathbf{Z}}_{⩽i}|E=e),\forall e\in \mathcal{E}.\end{array}$$

(1)

In (1), ${\mathbf{C}}_{⩽i},{\mathbf{Z}}_{⩽i}$ denote the outcomes and measurement settings for the first $i\in \left[n\right]$ trials, where $\left[n\right] := \{1,2,\dots ,n\}$, with ${\mathbf{c}}_{⩽i},{\mathbf{z}}_{⩽i}$ denoting their respective realisations. The random variables $C_{i+1},Z_{i+1}$ are the outcomes and settings for the $(i+1)$’th trial. The first condition in (1) formalises the assumption that the (joint) probability of the $(i+1)$’th outcome and setting, conditioned on the outcomes and settings for the first i trials and each realised value $E=e$ of the adversary’s side information, belongs to the $(i+1)$’th trial model, i.e., it is compatible with the conditions dictated by the trial model. The second condition states that for each $E=e$ the setting for the next trial is independent of the outcomes and settings of the past and present trials. Our second condition is a stronger assumption than the corresponding assumption given in [14], which is as follows: the joint distribution $\mu$ of $\mathbf{CZ}E$ is such that $Z_{i+1}$ is independent of ${\mathbf{C}}_{⩽i}$ conditionally on both ${\mathbf{Z}}_{⩽i}$ and E. It is a straightforward exercise to check that our stronger assumption implies the one stated in [14]. While the weaker assumption is sufficient for the following result, we find the stronger assumption operationally clearer as an assumption that the future settings are independent of “everything in the past" for each realisation of e.

For the rest of the paper we adopt the abbreviated notation of ${\mu }_y\left(X\right)$ for $\mu \left(X\right|Y=y)$. The following theorem, appearing as Theorem 9 in Appendix C in [14], formalises the central idea behind the framework of probability estimation. We include a proof for this theorem in Appendix A.1.1 for completeness.

Theorem 1.

Suppose $\mu :{\mathcal{C}}^n\times {\mathcal{Z}}^n\times \mathcal{E}\to [0,1]$ is a distribution of $\mathbf{CZ}E$ such that ${\mu }_e\left(\mathbf{CZ}\right)\in \Theta$ for each $e\in \mathcal{E}$. Then, for fixed $\beta ,ϵ>0$

$${\mathbb{P}}_{{\mu }_e}\left({\mu }_e(\mathbf{C}\left|\mathbf{Z}\right)⩾{\left(ϵ\prod _{i=1}^n{F}_i\left(C_i{Z}_i\right)\right)}^{-1/\beta }\right)⩽ϵ$$

(2)

holds for each $e\in \mathcal{E}$, where $F_i\left(C_i{Z}_i\right)$ is the probability estimation factor for the i’th trial.

Proof. 

See Appendix A.1.1. □

The distinguishing feature of the framework of probability estimation is the direct estimation of ${\mu }_e(\mathbf{C}\left|\mathbf{Z}\right)$ for each $e\in \mathcal{E}$ by constructing PEFs $F_i\left(C_i{Z}_i\right)$ and accumulating them trial-wise in a multiplicative fashion. For a fixed error bound $ϵ>0$ and the power parameter $\beta >0$, the term ${\left(ϵ{\prod }_{i=1}^n{F}_i\left(C_i{Z}_i\right)\right)}^{-1/\beta }$ serves as an estimate for ${\mu }_e(\mathbf{C}\left|\mathbf{Z}\right)$. It is important to note that PEFs are functions of only the measurement outcomes and settings and not of the side information held by the adversary to which we do not have access. For a large value of n—the number of trials—the trial-wise product ${\prod }_{i=1}^n{F}_i\left(C_i{Z}_i\right)$ will be large if the experiment is well-calibrated and run properly. For the purpose of randomness generation the inequality (2) in Theorem 1 can then be understood, intuitively, as follows: Since the trial-wise product ${\prod }_{i=1}^n{F}_i\left(C_i{Z}_i\right)$ of the PEFs is large and so, for fixed $ϵ,\beta >0$, the quantity ${\left(ϵ{\prod }_{i=1}^n{F}_i\left(C_i{Z}_i\right)\right)}^{-1/\beta }$ is small, for each $e\in \mathcal{E}$ there is a very small probability (denoted by the outer probability ${\mathbb{P}}_{{\mu }_e}(·)$) that the conditional probability of the sequence of outcomes $\mathbf{C}$ conditioned on the sequence of settings $\mathbf{Z}$ (denoted by ${\mu }_e(\mathbf{C}\left|\mathbf{Z}\right)$) is more than a small value. This translates to the measurement outcomes $\mathbf{C}$ being unpredictably random for a given $\mathbf{ze}$. Since this string of experimental outcomes is unpredictable even given the adversary’s side information, it can be used as a source of certifiable randomness. We stress that in the method of probability estimation the estimates on the conditional probability of measurement outcomes given the settings choices and side-information depend solely on the experimental data.

Conventional methods of randomness extraction, however, involve obtaining a lower bound on the smooth conditional min-entropy which quantifies the amount of raw randomness from a source. The lower bound then goes as one of the parameters in extractor functions to extract near-uniform random bits. It is therefore useful to translate the bound in (2) into a statement about the smooth conditional min-entropy with respect to an adversary.

We motivate and introduce conditional min-entropy as follows. An adversary’s goal is to predict C. Conditioned on a particular realisation of the settings sequence $\mathbf{z}\in {\mathcal{Z}}^n$ and side information $e\in \mathcal{E}$, one can measure the “predictability” of the sequence of outcomes $\mathbf{C}$ with the following maximum probability:

$$\underset{\mathbf{c}\in {\mathcal{C}}^n}{max}\mu (\mathbf{c}\left|\mathbf{z}e\right).$$

It quantifies the best guess of the adversary. The $\mathbf{z}e$-conditional min-entropy of $\mathbf{C}$, corresponding to that particular realisation $\mathbf{z}e\in {\mathcal{Z}}^n\times \mathcal{E}$, is the following negative logarithm:

$${\mathbb{H}}_{\infty ,\mu }(\mathbf{C}\left|\mathbf{z}e\right) := -{log}_2\left(\underset{\mathbf{c}\in {\mathcal{C}}^n}{max}\mu (\mathbf{c}\left|\mathbf{z}e\right)\right).$$

The subscript $\mu$ in the notation ${\mathbb{H}}_{\infty ,\mu }(\cdots )$ refers to the distribution $\mu \left(\mathbf{CZ}E\right)$. The average $\mathbf{Z}E$-conditional min-entropy is then defined as follows:

$${\mathbb{H}}_{\infty ,\mu }^{\mathsf{avg}}(\mathbf{C}\left|\mathbf{Z}E\right) := -{log}_2\left[\sum _{\mathbf{z}e\in {\mathcal{Z}}^n\times \mathcal{E}}\left(\underset{\mathbf{c}\in {\mathcal{C}}^n}{max}\mu (\mathbf{c}\left|\mathbf{z}e\right)\right)\mu \left(\mathbf{z}e\right)\right].$$

But, information-theoretic security of cryptographic protocols take into account a more realistic measure of average $\mathbf{Z}E$-conditional min-entropy which involves a smoothing parameter $ϵ$, a type of error bound, and is known as the $ϵ$-smooth average $\mathbf{Z}E$-conditional min-entropy. This quantity is useful for our scenario in which the probability distribution is not known exactly and its characteristics can only be inferred from observed data, which introduces the possibility of error. It is defined as follows.

Definition 2 (Smooth Average Conditional Min-Entropy).

For a distribution $\mu :{\mathcal{C}}^n\times {\mathcal{Z}}^n\times \mathcal{E}\to [0,1]$ of $\mathbf{C},\mathbf{Z},E$ the set ${\mathcal{B}}^{ϵ}\left(\mu \right)$ of distributions of $\mathbf{C},\mathbf{Z},E$ is defined as

$${\mathcal{B}}^{ϵ}\left(\mu \right) := \{\sigma :{\mathcal{C}}^n\times {\mathcal{Z}}^n\times \mathcal{E}\to [0,1]\mid d_{\mathrm{TV}}(\sigma ,\mu )⩽ϵ\},$$

(3)

where $ϵ\in (0,1)$ and $d_{\mathrm{TV}}(\sigma ,\mu )$ is the total variation distance between σ and μ defined as

$$d_{\mathrm{TV}} := (\sigma ,\mu )\frac{1}{2}\sum _{\mathbf{cz}e\in {\mathcal{C}}^n\times {\mathcal{Z}}^n\times \mathcal{E}}\left|\mu \left(\mathbf{cz}e\right)-\sigma \left(\mathbf{cz}e\right)\right|.$$

(4)

The ϵ-smooth average $\mathbf{Z}E$-conditional min-entropy is then defined as follows.

$${\mathbb{H}}_{\infty ,\mu }^{\mathsf{avg},ϵ}(\mathbf{C}\left|\mathbf{Z}E\right) := \underset{\sigma \in {\mathcal{B}}^{ϵ}\left(\mu \right)}{max}\left[-{log}_2\left[\sum _{\mathbf{z}e\in {\mathcal{Z}}^n\times \mathcal{E}}\left(\underset{\mathbf{c}\in {\mathcal{C}}^n}{max}\sigma (\mathbf{c}\left|\mathbf{z}e\right)\right)\sigma \left(\mathbf{z}e\right)\right]\right].$$

(5)

The lower bound obtained on this quantity goes as one of the inputs to extractor functions in randomness extraction, whose purpose is to convert random functions with uneven distributions into shorter, close to uniformly distributed bit strings. We note that alternative definitions of $ϵ$-smooth conditional min-entropy can be used, for instance, the $ϵ$-smooth worst-case conditional min-entropy of [19]. A known result from the literature, proven in Proposition A1 in Appendix E, justifies our usage of the $ϵ$-smooth average conditional min-entropy without having to be concerned with the stricter $ϵ$-smooth worst-case conditional min-entropy (defined in (A30)): specifically, the two quantities converge to one another in the asymptotic limit.

The result obtained from Theorem 1 can be translated into a result on smooth average conditional min-entropy formalised in Theorem 2 below. This theorem appears as Theorem 1 in [14]. We include a proof for this theorem in Appendix A.1.2 for completeness. In the notation of $ϵ$-smooth average $\mathbf{Z}E$-conditional min-entropy in (7), the semicolon followed by $\mathsf{S}$ denotes that this information-quantity is assessed with respect to the distribution $\mu$ after conditioning on the occurrence of the event $\mathsf{S}$ defined in the statement of Theorem 2. It pertains to an abort criterion. The protocol succeeds only if the product of the trial-wise PEFs exceeds some threshold value, otherwise it is aborted. So we want to establish the lower bound for smooth conditional min-entropy conditioned on the event that the protocol succeeds, because it is precisely this scenario in which we extract randomness. Since a completely predictable local distribution can always have a chance of passing the protocol, however minuscule (in the order of ${(3/4)}^n$, where the number of trials n often goes up to millions)—and $\mu \left(\mathbf{c}\right|\mathbf{z})$ will equal 1 in this case—it is necessary to assume a small but positive lower bound on the probability of not aborting to derive a useful min-entropy bound. This can be thought of as another type of error parameter. The assumed lower bound for the probability of success of the protocol is $\kappa$.

Theorem 2.

Let μ be a distribution $\mu :{\mathcal{C}}^n\times {\mathcal{Z}}^n\times \mathcal{E}\to [0,1]$ of $\mathbf{C},\mathbf{Z},E$ such that, for each $e\in \mathcal{E}$, the following holds for every $ϵ\in (0,1)$:

$${\mathbb{P}}_{{\mu }_e}\left({\mu }_e(\mathbf{C}\left|\mathbf{Z}\right)⩽{\left(ϵ\prod _{i=1}^n{F}_i\right)}^{-1/\beta }\right)⩾1-ϵ,$$

(6)

where $F_i$ is a PEF with power β for the i’th trial. For a fixed choice of $ϵ\in (0,1)$ and $p⩾{\left|\mathcal{C}\right|}^{-n}$, define the event $\mathsf{S} := \left\{{\left(ϵ{\prod }_{i=1}^n{F}_i\right)}^{-1/\beta }⩽p\right\}$. Then, if κ satisfies $0<\kappa ⩽{\mathbb{P}}_{\mu }\left(\mathsf{S}\right)$, the following holds:

$${\mathbb{H}}_{\infty ,\mu }^{\mathsf{avg},ϵ/\kappa }(\mathbf{C}|\mathbf{Z}E;\mathsf{S})⩾{log}_2\left(\kappa \right)-{log}_2\left(p\right)$$

(7)

Proof. 

See Appendix A.1.2. □

Under the same conditions of Theorem 2, the main result (7) admits a minor reformulation as follows. This is the formulation that aligns with the statement of Theorem 1 in [14].

Corollary 1.

Let $\mu :{\mathcal{C}}^n\times {\mathcal{Z}}^n\times \mathcal{E}\to [0,1]$ be a distribution of $\mathbf{CZ}E$ and F be a PEF with power β such that (6) holds for each $e\in \mathcal{E}$. For a fixed choice of $ϵ\in (0,1)$, $p⩾{\left|\mathcal{C}\right|}^{-n}$ and positive $\kappa ⩽{\mathbb{P}}_{\mu }\left(\mathsf{S}\right)$ where $\mathsf{S}=\left\{{\left(ϵ{\prod }_{i=1}^n{F}_i\right)}^{-1/\beta }⩽p\right\}$, we have

$${\mathbb{H}}_{\infty ,\mu }^{\mathsf{avg},ϵ}(\mathbf{C}|\mathbf{Z}E;\mathsf{S})⩾\left(1+\frac{1}{\beta }\right){log}_2\left(\kappa \right)-{log}_2\left(p\right).$$

(8)

Proof. 

Use Theorem 2 with ${ϵ}^{\prime }=\kappa ϵ$, $p^{\prime }=p/{\kappa }^{1/\beta }$ and ${\kappa }^{\prime }=\kappa$, noting that, since $0<\kappa ⩽1$ and $\beta >0$ hold, we have ${ϵ}^{\prime }\in (0,1)$ and $p^{\prime }⩾{\left|\mathcal{C}\right|}^{-n}$ as required for invoking the theorem. Then, notice the corresponding event ${\mathsf{S}}^{\prime }=\left\{{\left({ϵ}^{\prime }{\prod }_{i=1}^n{F}_i\right)}^{-1/\beta }⩽p^{\prime }\right\}$ aligns with the event $\mathsf{S}$. □

The above results hold when we consider distributions $\mu :{\mathcal{C}}^n\times {\mathcal{Z}}^n\times {\mathcal{E}}^n\to [0,1]$ of $\mathbf{CZE}$, i.e., where the side information is structured as a sequence of random variables. The proof remains the same with the exception that we condition on an arbitrary sequence of realisation $\mathbf{e}\in {\mathcal{E}}^n$ of $\mathbf{E}$. We consider this scenario in Section 3 where we define an IID attack from the adversary.

Theorem 1 does not indicate how to find PEFs. One way to find useful PEFs is to first notice that the success criterion of the protocol is the event $\mathsf{S}$ that the inequality ${\left(ϵ{\prod }_{i=1}^n{F}_i\right)}^{-1/\beta }⩽p$ holds, which can be equivalently expressed as

$$\sum _{i=1}^n{log}_2\left(F_i\right)/\beta +{log}_2\left(ϵ\right)/\beta ⩾-{log}_2\left(p\right),$$

(9)

where $ϵ,\beta \mathrm{and}p$ are pre-determined quantities to be chosen in advance of running the protocol. Then, considering an anticipated trial distribution $\rho \left(CZ\right)$ based on observed results and calibrations from previous trials, in the limit of sufficiently large n the difference between the term on the left hand side of (9) (which consists of the trial-wise sum of (base-2) logarithm of PEFs) and $n{\mathbb{E}}_{\rho }[{log}_2\left(F\left(CZ\right)\right)/\beta ]$ will be either greater or less than zero with roughly equal probability. This follows from the Central Limit Theorem if the distribution remains roughly stable from trial to trial. Since it is desirable to have the largest value of $-{log}_2\left(p\right)$ possible, one can then perform the following constrained maximisation using any convex programming software owing to the concavity of the objective function and the linearity of the constraints.

$$\begin{array}{cc}\hfill \mathrm{Maximise}:& {\mathbb{E}}_{\rho }[(n{log}_2\left(F\left(CZ\right)\right)+{log}_2\left(ϵ\right))/\beta ]\hfill \\ \hfill \mathrm{Subject}\mathrm{to}:& {\mathbb{E}}_{\nu }[F\left(CZ\right)\nu \left(C{\left|Z\right)}^{\beta }\right]⩽1,\mathrm{for}\mathrm{all}\nu \left(CZ\right)\in \Pi ,\hfill \\ \hfill & F\left(cz\right)⩾0,\mathrm{for}\mathrm{all}(c,z)\in \mathcal{C}\times \mathcal{Z}\hfill \end{array}$$

(10)

Since $n,ϵ\mathrm{and}\beta$ are fixed, it is sufficient to maximise ${\mathbb{E}}_{\rho }\left[{log}_2\left(F\left(CZ\right)\right)\right]$ subject to the same constraints. In practice, one can consider a range of values of $\beta$ and perform the constrained maximisation with the objective ${\mathbb{E}}_{\rho }\left[{log}_2\left(F\left(CZ\right)\right)\right]$, then plug in the maximum value in the expression ${\mathbb{E}}_{\rho }[(n{log}_2\left(F\left(CZ\right)\right)+{log}_2\left(ϵ\right))/\beta ]$ and obtain a plot with respect to the considered range of $\beta$ values (see, for example, Figure 2 in [16]; a similar pattern is observed in Figure 2 in Section 2).

The following lemma (from [14], see Lemma 15)—for which we provide a more direct proof—enables us to restrict the satisfiability constraints of the optimisation routine in (10) to the extremal distributions of the model $\Pi$ under the condition that the model is convex and closed. So, the first line of constraints in (10) can be replaced with ${\mathbb{E}}_{\nu }[F\left(CZ\right)\nu \left(C{\left|Z\right)}^{\beta }\right]⩽1,\forall \nu \left(CZ\right)\in {\Pi }_{\mathrm{extr}}$, where ${\Pi }_{\mathrm{extr}}$ is the set of extremal distributions of $\Pi$. If the model $\Pi$ is not convex and closed, we take its convex closure. In words, the lemma states that, if $F\left(CZ\right)$ is a PEF with power $\beta >0$ for the distributions ${\sigma }_1\left(CZ\right)\mathrm{and}{\sigma }_2\left(CZ\right)$, then it is a PEF with the same power for all distributions that can be expressed as a convex combination of ${\sigma }_1$ and ${\sigma }_2$.

Lemma 1.

For distributions ${\sigma }_i\left(CZ\right)\in \Pi$ satisfying ${\mathbb{E}}_{{\sigma }_i}[F\left(CZ\right){\sigma }_i\left(C{\left|Z\right)}^{\beta }\right]⩽1$, for $i=1,2$, if $\sigma \left(CZ\right)\in \Pi$ is expressible as $\sigma \left(CZ\right)=\lambda {\sigma }_1\left(CZ\right)+(1-\lambda ){\sigma }_2\left(CZ\right)$ for $\lambda \in [0,1]$, then it satisfies ${\mathbb{E}}_{\sigma }[F\left(CZ\right)\sigma \left(C{\left|Z\right)}^{\beta }\right]⩽1$.

Proof. 

For z such that ${\sigma }_1\left(z\right),{\sigma }_2\left(z\right)>0$, we have $\sigma \left(z\right)>0$ as well and, from $\sigma \left(CZ\right)=\lambda {\sigma }_1\left(CZ\right)+(1-\lambda ){\sigma }_2\left(CZ\right)$, straightforward algebra shows that $\sigma (c\left|z\right)=\delta {\sigma }_1(c\left|z\right)+(1-\delta ){\sigma }_2(c\left|z\right)$ for any $(c,z)\in \mathcal{C}\times \mathcal{Z}$, where $\delta =\lambda {\sigma }_1\left(z\right)/\sigma \left(z\right)\in [0,1]$. Since, for $\alpha >1$, $x^{\alpha }$ is convex for $x⩾0$, we can write

$$\begin{array}{cc}\hfill \sigma (c{\left|z\right)}^{1+\beta }& {⩽\delta \sigma (c\left|z\right)}^{1+\beta }+(1-\delta ){\sigma }_2{(c\left|z\right)}^{1+\beta }\hfill \\ \hfill \Rightarrow \sigma (c{\left|z\right)}^{1+\beta }\sigma \left(z\right)& ⩽\lambda {\sigma }_1(c{\left|z\right)}^{1+\beta }{\sigma }_1\left(z\right)+(1-\lambda ){\sigma }_2(c{\left|z\right)}^{1+\beta }{\sigma }_2\left(z\right).\hfill \end{array}$$

(11)

Turning to cases where ${\sigma }_1\left(z\right)$ and/or ${\sigma }_2\left(z\right)$ may equal zero, we can also demonstrate (11) under the convention of taking ${\sigma }_i(c\left|z\right)$ to be zero when ${\sigma }_i\left(z\right)=0$. Then, the inequality holds as an equality when ${\sigma }_1\left(z\right)={\sigma }_2\left(z\right)=0$ (which implies $\sigma \left(z\right)=0$ as well); for $0={\sigma }_2\left(z\right)<{\sigma }_1\left(z\right)$ one can verify (11) after noting $\sigma \left(cz\right)=\lambda {\sigma }_1\left(cz\right)$ and $\sigma \left(z\right)=\lambda {\sigma }_1\left(z\right)$, and the $0={\sigma }_1\left(z\right)<{\sigma }_2\left(z\right)$ case follows symmetrically. Now, multiplying both sides of (11) by $F\left(cz\right)$ and summing over $(c,z)\in \mathcal{C}\times \mathcal{Z}$ gives

$$\begin{array}{cc}\hfill \sum _{c,z}{F\left(cz\right)\sigma (c\left|z\right)}^{1+\beta }\sigma \left(z\right)& ⩽\lambda \sum _{c,z}F\left(cz\right){\sigma }_1(c{\left|z\right)}^{1+\beta }{\sigma }_1\left(z\right)+(1-\lambda )\sum _{c,z}F\left(cz\right){\sigma }_2(c{\left|z\right)}^{1+\beta }{\sigma }_2\left(z\right)\hfill \\ \hfill \Rightarrow {\mathbb{E}}_{\sigma }[F\left(CZ\right)\sigma \left(C{\left|Z\right)}^{\beta }\right]& ⩽\lambda {\mathbb{E}}_{{\sigma }_1}[F\left(CZ\right){\sigma }_1\left(C{\left|Z\right)}^{\beta }\right]+(1-\lambda ){\mathbb{E}}_{{\sigma }_2}[F\left(CZ\right){\sigma }_2\left(C{\left|Z\right)}^{\beta }\right]\hfill \\ \hfill & ⩽\lambda +(1-\lambda )=1.\hfill \end{array}$$

□

We remark that the result of Lemma 1 can also be obtained through specialisation of known quantum results to classical distributions; however, this requires a more technical argument with additional machinery. To elaborate, the proof for Lemma 1 involves showing the joint convexity of $\sigma (C{\left|Z\right)}^{1+\beta }\sigma \left(Z\right)$ which can be seen as a special case of the joint convexity of sandwiched Rényi powers. To be more specific, it arises as a special case of the joint convexity of $e^{\beta D_{1+\beta }\left(\sigma \right|\left|\omega \right)}$ for $\beta >0$ when the distribution $\omega \left(CZ\right)$ is taken to be $\omega \left(cz\right)=\sigma \left(z\right)/\left|\mathcal{C}\right|,\forall (c,z)\in \mathcal{C}\times \mathcal{Z}$. Notice that $D_{1+\beta }\left(\sigma \right|\left|\omega \right)$ is the (classical) Rényi divergence of order $(1+\beta )\in (1,\infty )$ of $\sigma \left(CZ\right)$ with respect to $\omega \left(CZ\right)$. The functional $e^{D_{1+\beta }\left(\sigma \right|\left|\omega \right)}$ can also be seen as a specialisation (to classical states) of the same functional, defined in terms of (quantum) density states $\sigma$ and $\omega$, whose joint convexity was proven in proposition 3 of [20] with an extended technical argument.

3. Asymptotic Performance

The results of the previous section give us a method for certifying randomness. In this section, we assess the asymptotic performance of the method. Our figure of merit is the amount of randomness certified per trial, as measured by the average conditional min-entropy divided by the number of trials n. We will see in this section that the PEF method is asymptotically optimal, in the following sense: given a fixed observed distribution, the PEF method can asymptotically certify an amount of per-trial conditional min-entropy that is equal to the actual per-trial conditional min-entropy generated by an adversary replicating the observed distribution with as little randomness as possible.

To elaborate on this, consider that the adversary’s goal is to minimise the following quantity:

$$\frac{1}{n}{\mathbb{H}}_{\infty ,\mu }^{\mathsf{avg}}\left(\mathbf{C}\right|\mathbf{Z}E).$$

We assume that the adversary has complete knowledge of the distribution $\mu$, and can have access to not just the realised value of E but also the realised value of $\mathbf{Z}$ in guessing $\mathbf{C}$. This access to $\mathbf{Z}$ aligns with the paradigm, as discussed in [11], of “using public (settings) randomness to generate private (outcome) randomness”. The adversary is constrained, however, in that the statistics when marginalised over E must appear to be consistent with an expected observed trial distribution $\rho \left(CZ\right)$ for the protocol to not abort. Technically, all that is necessary for the protocol to pass is that the observed product of the PEFs must exceed some threshold value chosen by the experimenter—which could be possible with high probability with many different distributions $\mu$—but, as the experimenter’s threshold value will likely be chosen based on a full behaviour that they expect to observe, we study attacks that match the expected observed trial distribution exactly. We will find attacks meeting this criterion that are asymptotically optimal for minimising the conditional min-entropy.

Given an expected observed distribution, how can the adversary generate observed statistics consistent with it while yielding as little randomness as possible? She can employ a strategy of preparing multiple different states to be measured that will yield different distributions, each one consistent with the trial model $\Pi$, whose convex mixture is equal to the observed distribution. If she has an auxiliary random variable E realising values from the finite-cardinality set $\mathcal{E}$ and recording which state was prepared on which trial, she can predict better the outcome conditioned on her side information $E=e$, in conjunction with the settings Z. Indeed, some of her e-conditional distributions could be deterministic—specifically, the product of a fixed settings distribution and a deterministic behaviour (conditional distribution of the outcomes conditioned on settings), in which case she does not yield any randomness to Alice and Bob on a trial where E takes that value. But, if the overall observed statistics are nonlocal, then she is forced to prepare at least some states that contain randomness even conditioned on e; this, in essence, is because the information that she possesses with E is a local hidden variable.

3.1. I.I.D. Attacks

Given a convex decomposition of the observed distribution, the adversary’s simplest form of an attack is to select e from some finite-cardinality set $\mathcal{E}$ in an i.i.d manner on each trial according to the distribution that recovers the observed distribution $\rho \left(CZ\right)$. A more general attack would allow her to use memory of earlier trials but we will see later that, asymptotically, this does not yield meaningful improvement.

Operationally, we do not like to think of the adversary accessing the devices in between trials to provide a choice of $e_i$ for each trial. Instead, one can imagine her randomly sampling from the distribution of $\mathbf{E}$ for all trials, coming up with a choice $\mathbf{e}$ that encodes all the choices of $e_i$ for each trial and then supplying this choice to the measured system, in advance, to determine its behaviour in each trial. She keeps a record of $\mathbf{e}$ to help her predict C later. Through this sampling process there is a small chance that she will sample an atypical “bad” $\mathbf{e}$ that results in statistics deviating from the observed distribution but the probability that her $\mathbf{e}$ is typical is asymptotically high. Our figure of merit for the adversary now is:

$$\frac{1}{n}{\mathbb{H}}_{\infty ,\mu }^{\mathsf{avg}}\left(\mathbf{C}\right|\mathbf{Z}\mathbf{E}),$$

which she wants to minimise with a distribution that, marginalised over $\mathbf{E}$, is consistent with i.i.d sampling from an expected observed distribution $\rho$. We formally define the set ${\Sigma }_{\mathrm{E}}^{\rho }$ of distributions $\omega :\mathcal{C}\times \mathcal{Z}\times \mathcal{E}\to [0,1]$ of $C,Z,E$ mimicking $\rho$ through such a convex decomposition as follows, where e is shorthand for the event $\{E=e\}$:

$${\Sigma }_{\mathrm{E}}^{\rho } := \left\{\omega (CZE):\omega (CZ\left|e\right)\in \Pi \forall e\in \mathcal{E},\sum _{e\in \mathcal{E}}\omega \left(CZ\right|e)\omega \left(e\right)=\rho \left(CZ\right)\right\}.$$

(12)

Then, an IID attack can be defined as follows.

Definition 3 (IID Attack).

Given a distribution $\omega \left(CZE\right)\in {\Sigma }_{\mathrm{E}}^{\rho }$, we define an IID attack (with ω) to be the distribution ϕ consisting of n independent and identical realisations of random variables $C_i,Z_i,E_i$ distributed according to ω; i.e., the joint distribution of the sequence of random variables $\mathbf{C},\mathbf{Z},\mathbf{E}$ is $\varphi :{\mathcal{C}}^n\times {\mathcal{Z}}^n\times {\mathcal{E}}^n\to [0,1]$ such that $\varphi \left(\mathbf{CZE}\right)={\prod }_{i=1}^n\omega \left(C_i{Z}_i{E}_i\right)$.

As mentioned earlier, the adversary randomly samples from the distribution of $\mathbf{E}$ which represents their knowledge of all trials; $\mathbf{e}\equiv (e_1,e_2,\dots ,e_n)\in {\mathcal{E}}^n$ encodes the individual choices $e_i$ for trial $i\in \{1,2,\dots ,n\}$. The IID attack satisfies the two assumptions of the experiment model discussed earlier (see (1) and the short discussion that follows immediately). Namely, the (joint) probability of the $(i+1)$’th trial outcome and input setting, conditioned on each realisation of the outcomes and settings for the first i trials and each realisation $\mathbf{e}\in {\mathcal{E}}^n$ of the side information, satisfies the conditions of the trial model; and, conditioned on each $\mathbf{e}\in {\mathcal{E}}^n$, the settings for the $(i+1)$’th trial are (unconditionally) independent of the outcomes and settings of the past and present trials (i.e., the first i trials). This is formally stated and proved in Lemma 2 below.

Lemma 2.

The IID attack as defined in Definition 3 satisfies the following conditions.

$$\begin{array}{cc}\hfill \varphi (C_{i+1}{Z}_{i+1}\left|{\mathbf{c}}_{⩽i}{\mathbf{z}}_{⩽i}\mathbf{e}\right)& \in \Pi ,\forall {\mathbf{c}}_{⩽i}\in {\mathcal{C}}^i,{\mathbf{z}}_{⩽i}\in {\mathcal{Z}}^i,\mathbf{e}\in {\mathcal{E}}^n\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill \varphi (Z_{i+1}{\mathbf{C}}_{⩽i}{\mathbf{Z}}_{⩽i}\left|\mathbf{e}\right)& =\varphi (Z_{i+1}\left|\mathbf{e}\right)\varphi ({\mathbf{C}}_{⩽i}{\mathbf{Z}}_{⩽i}\left|\mathbf{e}\right),\forall \mathbf{e}\in {\mathcal{E}}^n\hfill \end{array}$$

(14)

Proof. 

Consider the distribution $\varphi \left(\mathbf{CZ}\right|\mathbf{e})$ conditioned on a realisation $\mathbf{E}=\mathbf{e}$, where $\varphi \left(\mathbf{CZE}\right)={\prod }_{i=1}^n\omega \left(C_i{Z}_i{E}_i\right)$. Notice that $\varphi (\mathbf{CZ}\left|\mathbf{e}\right)={\prod }_{i=1}^n\omega (C_i{Z}_i\left|e_i\right)$. Marginalising over the random variables $C_{i+2},C_{i+3},\dots ,C_n,Z_{i+2},Z_{i+3},\dots ,Z_n$ we obtain:

$$\varphi (C_{i+1}{Z}_{i+1}{\mathbf{C}}_{⩽i}{\mathbf{Z}}_{⩽i}\left|\mathbf{e}\right)=\prod _{j=1}^{i+1}\omega (C_j{Z}_j\left|e_j\right)$$

(15)

Corresponding to a particular realisation ${\mathbf{c}}_{⩽i}\in {\mathcal{C}}^i,{\mathbf{z}}_{⩽i}\in {\mathcal{Z}}^i$, we then have $\varphi (C_{i+1}{Z}_{i+1}{\mathbf{c}}_{⩽i}{\mathbf{z}}_{⩽i}\left|\mathbf{e}\right)=$$\omega (C_{i+1}{Z}_{i+1}\left|e_{i+1}\right){\prod }_{j=1}^i\omega (c_j{z}_j\left|e_j\right)$; and, since $\varphi ({\mathbf{c}}_{⩽i}{\mathbf{z}}_{⩽i}\left|\mathbf{e}\right)={\prod }_{j=1}^i\omega (c_j{z}_j\left|e_j\right)$, we have

$$\frac{\varphi (C_{i+1}{Z}_{i+1}{\mathbf{c}}_{⩽i}{\mathbf{z}}_{⩽i}\left|\mathbf{e}\right)}{\varphi ({\mathbf{c}}_{⩽i}{\mathbf{z}}_{⩽i}\left|\mathbf{e}\right)}=\varphi (C_{i+1}{Z}_{i+1}\left|{\mathbf{c}}_{⩽i}{\mathbf{z}}_{⩽i}\mathbf{e}\right)=\omega (C_{i+1}{Z}_{i+1}\left|e_{i+1}\right).$$

(16)

$\omega (C_{i+1}{Z}_{i+1}\left|e_{i+1}\right)$ belongs to the set $\Pi$ for all values of $e_{i+1}\in \mathcal{E}$ (by construction of the set ${\Sigma }_E$, see (12)). Since (16) is true for all realisations ${\mathbf{c}}_{⩽i}\in {\mathcal{C}}^i,{\mathbf{z}}_{⩽i}\in {\mathcal{Z}}^i,\mathbf{e}\in {\mathcal{E}}^n$ we conclude (13) holds. Next, marginalising (15) over $C_{i+1}$ we have:

$$\varphi (Z_{i+1}{\mathbf{C}}_{⩽i}{\mathbf{Z}}_{⩽i}\left|\mathbf{e}\right)=\omega (Z_{i+1}\left|e_{i+1}\right)\prod _{j=1}^i\omega (C_j{Z}_j\left|e_j\right)=\varphi \left(Z_{i+1}\left|\mathbf{e}\right)\varphi \right({\mathbf{C}}_{⩽i}{\mathbf{Z}}_{⩽i}\left|\mathbf{e}\right)$$

(17)

In (17), $\omega (Z_{i+1}\left|e_{i+1}\right)=\varphi (Z_{i+1}\left|\mathbf{e}\right)$ can be observed by marginalising (15) over the random variables $C_1,\dots ,C_i,C_{i+1},Z_1,\dots ,Z_i$ and $\varphi ({\mathbf{C}}_{⩽i}{\mathbf{Z}}_{⩽i}\left|\mathbf{e}\right)={\prod }_{j=1}^i\omega (C_j{Z}_j\left|e_j\right)$ (from marginalising (15) over $C_{i+1},Z_{i+1}$); (17) is true for all $\mathbf{e}\in {\mathcal{E}}^n$; hence, we conclude (14). □

Next, the adversary would like to implement an attack that “generates as little randomness as possible”. One measure of the randomness is the conditional Shannon entropy of the outcomes C conditioned on the inputs Z and the side information E.

Definition 4 (Conditional Shannon Entropy).

For a distribution $\mu :\mathcal{C}\times \mathcal{Z}\times \mathcal{E}\to [0,1]$ of $C,Z,E$ the conditional Shannon entropy of the outcomes C conditioned on the settings Z and the side information E is defined as

$${\mathbb{H}}_{\mu }(C\left|ZE\right)=-\sum _{cze}{log}_2\mu (c\left|ze\right)\mu \left(cze\right)={\mathbb{E}}_{\mu }[-{log}_2\mu \left(C\left|ZE\right)\right].$$

(18)

The Greek letter $\mu$ in the subscript of ${\mathbb{H}}_{\mu }(·|·)$ refers to the distribution $\mu \left(CZE\right)$ with respect to which the conditional Shannon entropy is defined.

Theorem 3 below shows that $H_{\omega }\left(C\right|ZE)$ is an asymptotic upper bound on the per-trial conditional min-entropy that the adversary generates with an IID attack employing a trial distribution $\omega$ that is consistent with the observed distribution $\rho$. This result was discussed but not demonstrated explicitly in [15]. The proof of Theorem 3 involves one of the fundamental technical tools from information theory, the (classical) asymptotic equipartition property (AEP), or equivalently the notion of typical sequences which has the weak law of large numbers at its core.

Suppose $\mu$, the distribution of all trials, is obtained as n i.i.d. copies of a single-trial distribution $\omega$. Then, for ${ϵ}_{\mathrm{a}}\in (0,1)$, $\delta ⩾0$ there exists $N({ϵ}_{\mathrm{a}},\delta )$ such that $n⩾N({ϵ}_{\mathrm{a}},\delta )$ ensures ${\mathbb{E}}_{\mu \left(\mathbf{ZE}\right)}[{\mathbb{P}}_{\mu \left(\mathbf{C}\right|\mathbf{ZE})}\left(\mu (\mathbf{C}\left|\mathbf{ZE}\right)⩾\gamma )\right]⩾1-{ϵ}_{\mathrm{a}}$, where $\gamma =2^{-n{H}_{\omega }(C\left|ZE\right)-n\delta }$ and $H_{\omega }(C\left|ZE\right)$ is the conditional Shannon entropy. We refer to this as the AEP condition; it holds by a conditional form of the classical AEP (see, for instance, Section 14.6 in [21]). The set $B^{{ϵ}_{\mathrm{s}}}\left(\mu \right)$ of distributions of $\mathbf{C},\mathbf{Z},\mathbf{E}$ that are within a $\mathrm{TV}$ distance of ${ϵ}_{\mathrm{s}}$ from $\mu$ and the sets ${\mathcal{A}}_{\mathbf{ze}}$ are as defined below:

$$\begin{array}{cc}\hfill {\mathcal{B}}^{{ϵ}_{\mathrm{s}}}\left(\mu \right) :=& \{\sigma :{\mathcal{C}}^n\times {\mathcal{Z}}^n\times {\mathcal{E}}^n\to [0,1]\mid d_{\mathrm{TV}}(\mu ,\sigma )⩽{ϵ}_{\mathrm{s}}\},\hfill \end{array}$$

(19)

$$\begin{array}{cc}\hfill {\mathcal{A}}_{\mathbf{ze}} :=& \{\mathbf{c}\in {\mathcal{C}}^n\mid \mu (\mathbf{c}\left|\mathbf{ze}\right)⩾\gamma \},\hfill \end{array}$$

(20)

where ${\mathcal{A}}_{\mathbf{ze}}$ is defined for any $\mathbf{ze}$ for which $\mu \left(\mathbf{ze}\right)>0$. Note that the case ${ϵ}_{\mathrm{s}}=0$ reduces to a bound on the standard (non-smooth) average conditional min-entropy. We now state the result as follows.

Theorem 3.

Let μ be an IID attack with ω. For ${ϵ}_{\mathrm{s}}⩾0$, ${ϵ}_{\mathrm{a}},\delta >0$ and ${ϵ}_{\mathrm{a}}+2{ϵ}_{\mathrm{s}}<1$, there exists $N({ϵ}_{\mathrm{a}},{ϵ}_{\mathrm{s}},\delta )$ such that for $n⩾N({ϵ}_{\mathrm{a}},{ϵ}_{\mathrm{s}},\delta )$

$$\frac{1}{n}{\mathbb{H}}_{\infty ,\mu }^{\mathsf{avg},{ϵ}_{\mathrm{s}}}(\mathbf{C}\left|\mathbf{ZE}\right)⩽{\mathbb{H}}_{\mu }(C\left|ZE\right)+\frac{1}{n}{log}_2\frac{1}{1-{ϵ}_{\mathrm{a}}-2{ϵ}_{\mathrm{s}}}+\delta .$$

(21)

Proof. 

Throughout, we follow the convention that $\sigma \left(\mathbf{c}\right|\mathbf{ze})=0$ for all $\mathbf{c}\in {\mathcal{C}}^n$ for any $\mathbf{ze}\in {\mathcal{Z}}^n\times {\mathcal{E}}^n$ with $\sigma \left(\mathbf{ze}\right)=0$. We begin with the inequality $d_{\mathrm{TV}}(\sigma ,\mu )⩽{ϵ}_{\mathrm{s}}$ that any $\sigma \in {\mathcal{B}}^{{ϵ}_{\mathrm{s}}}\left(\mu \right)$ must satisfy and proceed as follows:

$$\begin{array}{cc}\hfill 2{ϵ}_{\mathrm{s}}& ⩾{\mu -\sigma }_1=\sum _{\mathbf{cze}\in {\mathcal{C}}^n\times {\mathcal{Z}}^n\times {\mathcal{E}}^n}\left|\mu \left(\mathbf{cze}\right)-\sigma \left(\mathbf{cze}\right)\right|\hfill \\ \hfill & ⩾\sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\sum _{\mathbf{c}\in {\mathcal{A}}_{\mathbf{ze}}}\left|\mu \left(\mathbf{cze}\right)-\sigma \left(\mathbf{cze}\right)\right|\hfill \end{array}$$

(22)

$$\begin{array}{cc}\hfill & \hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}⩾|\sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\sum _{\mathbf{c}\in {\mathcal{A}}_{\mathbf{ze}}}\left(\mu \left(\mathbf{cze}\right)-\sigma \left(\mathbf{cze}\right)\right)|\hfill \\ \hfill & \hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}=|{\mathbb{E}}_{\mu \left(\mathbf{ZE}\right)}[{\mathbb{P}}_{\mu \left(\mathbf{C}\right|\mathbf{ZE})}\left(\mu (\mathbf{C}\left|\mathbf{ZE}\right)⩾\gamma )\right]-\sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\sum _{\mathbf{c}\in {\mathcal{A}}_{\mathbf{ze}}}\sigma \left(\mathbf{cze}\right)|\hfill \\ \hfill & \hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}⩾{\mathbb{E}}_{\mu \left(\mathbf{ZE}\right)}[{\mathbb{P}}_{\mu \left(\mathbf{C}\right|\mathbf{ZE})}\left(\mu (\mathbf{C}\left|\mathbf{ZE}\right)⩾\gamma )\right]-\sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\sum _{\mathbf{c}\in {\mathcal{A}}_{\mathbf{ze}}}\sigma \left(\mathbf{cze}\right).\hfill \end{array}$$

(23)

The inequality in (22) follows as a result of the sum containing fewer terms; the inequality in (23) follows from the triangle inequality. Now from the AEP condition mentioned above we have the following:

$$\sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\sum _{\mathbf{c}\in {\mathcal{A}}_{\mathbf{ze}}}\sigma \left(\mathbf{cze}\right)⩾{\mathbb{E}}_{\mu \left(\mathbf{ZE}\right)}[{\mathbb{P}}_{\mu \left(\mathbf{C}\right|\mathbf{ZE})}\left(\mu (\mathbf{C}\left|\mathbf{ZE}\right)⩾\gamma )\right]-2{ϵ}_{\mathrm{s}}⩾1-{ϵ}_{\mathrm{a}}-2{ϵ}_{\mathrm{s}}.$$

(24)

For any $\sigma \in {\mathcal{B}}^{{ϵ}_{\mathrm{s}}}\left(\mu \right)$, we define $M_{\mathbf{ze}}^{\sigma }$ for any $\mathbf{ze}\in {\mathcal{Z}}^n\times {\mathcal{E}}^n$ as $M_{\mathbf{ze}}^{\sigma } := {max}_{\mathbf{c}\in {\mathcal{C}}^n}\sigma (\mathbf{c}\left|\mathbf{ze}\right)$. The average conditional maximum probability is then expressed as ${\overline{M}}_{\sigma } := {\sum }_{\mathbf{ze}}{M}_{\mathbf{ze}}^{\sigma }\sigma \left(\mathbf{ze}\right)$. Because $1⩽{\sum }_{c\in {\mathcal{A}}_{\mathbf{ze}}}\mu \left(\mathbf{c}\right|\mathbf{ze})⩽\gamma \left|{\mathcal{A}}_{\mathbf{ze}}\right|$, we have $|{\mathcal{A}}_{\mathbf{ze}}|⩽1/\gamma$ for each $\mathbf{ze}$ and we can write:

$$\begin{array}{cc}\hfill \sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\sum _{\mathbf{c}\in {\mathcal{A}}_{\mathbf{ze}}}\sigma \left(\mathbf{cze}\right)& =\sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\sum _{\mathbf{c}\in {\mathcal{A}}_{\mathbf{ze}}}\sigma (\mathbf{c}\left|\mathbf{ze}\right)\sigma \left(\mathbf{ze}\right)⩽\sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\sum _{\mathbf{c}\in {\mathcal{A}}_{\mathbf{ze}}}{M}_{\mathbf{ze}}^{\sigma }\sigma \left(\mathbf{ze}\right)\hfill \\ \hfill & =\sum _{\mathbf{ze}:\mu \left(\mathbf{ze}\right)>0}\left|{\mathcal{A}}_{\mathbf{ze}}\right|M_{\mathbf{ze}}^{\sigma }\sigma \left(\mathbf{ze}\right)⩽\frac{1}{\gamma }\sum _{\mathbf{ze}}{M}_{\mathbf{ze}}^{\sigma }\sigma \left(\mathbf{ze}\right)=\frac{{\overline{M}}_{\sigma }}{\gamma }.\hfill \end{array}$$

(25)

Using (24) and (25) we obtain ${\overline{M}}_{\sigma }⩾\gamma (1-{ϵ}_{\mathrm{a}}-2{ϵ}_{\mathrm{s}})$ from which (21) follows using the definition of smooth average conditional min-entropy. □

Having shown that the per-trial min-entropy generated by an IID attack is asymptotically bounded by the conditional Shannon entropy, we give the following definition of an optimal attack.

Definition 5 (Optimal IID Attack).

The distribution $\mu \left(\mathbf{CZE}\right)$ of the sequence of random variables $\mathbf{C},\mathbf{Z},\mathbf{E}$ is an optimal IID attack if μ is obtained through an IID attack based on a single-trial distribution ω whose conditional Shannon entropy achieves the infimum defined below:

$$h_{min}\left(\rho \right) := \underset{\omega \left(CZE\right)\in {\Sigma }_{\mathrm{E}}^{\rho }}{inf}{\mathbb{H}}_{\omega }(C\left|ZE\right)$$

(26)

Additional motivation for naming the attack of Definition 5 optimal is provided by later results in this section, which show that the adversary must generate at least $h_{min}\left(\rho \right)$ of per-trial conditional min-entropy asymptotically with any attack that replicates the observed distribution $\rho$.

In the theorem that follows, we formalise the claim that the infimum in (26) is achieved. This theorem corresponds to Theorem 43 in [15]; in comparison, the comprehensive proof provided here explicitly works out more of the steps. Crucially, this explicit approach also allowed us to provide an improvement upon the result of Theorem 43 in [15], decreasing the required value of $\left|\mathcal{E}\right|$ by one, thereby better characterising the adversary’s optimal attack. Results in Section 4.2 will illustrate that no further improvement, i.e., a decrease in $\left|\mathcal{E}\right|$, is possible.

Theorem 4.

Suppose Π is closed and equal to the convex hull of its extreme points. Then, there is a distribution $\mu \left(CZE\right)\in {\Sigma }_{\mathrm{E}}^{\rho }$ with $\left|\mathcal{E}\right|=1+dim\Pi$ such that ${\mathbb{H}}_{\mu }(C\left|ZE\right)=h_{min}\left(\rho \right)$.

Proof. 

See Appendix B.1.1. □

Theorem 4, in conjunction with the bound in Theorem 3, sets a benchmark for how well the adversary can perform with an IID attack that replicates the observed distribution $\rho \left(CZ\right)$. Specifically, the adversary’s goal is to minimise the amount of per trial conditional min-entropy and this shows there exists a strategy to replicate the observed statistics while conceding no more min-entropy per trial than $h_{min}\left(\rho \right)$, asymptotically.

3.2. Optimal PEFs

We now show that PEFs can asymptotically certify a min-entropy of $h_{min}\left(\rho \right)$ per trial from an observed distribution $\rho$. This is notable since it shows that an IID attack can be asymptotically optimal: since the PEF method certifies the presence of $h_{min}\left(\rho \right)$ min-entropy per trial against any attack, this means no attack can generate observed statistics consistent with $\rho$ while conceding a smaller amount of randomness. This furthermore demonstrates that there is nothing to be gained (asymptotically) by the adversary employing a more sophisticated memory-based attack, since the PEF method allows for the possibility of memory attacks. Conversely, the below results show that the PEF method is asymptotically optimal: no (correct) method can certify more min-entropy per trial from $\rho$ than the amount that is present in an explicit attack.

To formalise and prove these claims, we use the following technical tool, called an “entropy estimator” as in [15].

Definition 6 (Entropy Estimator).

An entropy estimator of the model Π is a function $K\left(CZ\right)$ of the random variables $C,Z$ such that ${\mathbb{E}}_{\sigma }\left[K\left(CZ\right)\right]⩽{\mathbb{E}}_{\sigma }[-{log}_2\left(\sigma \left(C\left|Z\right)\right)\right]$ holds for all $\sigma \left(CZ\right)\in \Pi$.

Given an entropy estimator $K\left(CZ\right)$, we say that its entropy estimate at a distribution $\sigma \left(CZ\right)$ is ${\mathbb{E}}_{\sigma }\left[K\left(CZ\right)\right]$. We will see below that an entropy estimator can be used to construct PEFs certifying per-trial min-entropy arbitrarily close to its entropy estimate, underlying the significance of the following result:

Theorem 5.

Suppose Π satisfies the conditions of Theorem 4 and ρ is in the interior of Π. Then, there exists an entropy estimator whose entropy estimate at ρ is equal to $h_{min}\left(\rho \right)$.

Proof. 

See Appendix B.1.2. □

The assumption that $\rho$ is in the interior of $\Pi$ will generally hold if $\rho$ is estimated from real data, as the boundary of $\Pi$ is a measure zero set. If the assumption is removed, a weaker version of the theorem can still be obtained, which is discussed in the proof in Appendix B.1.

The entropy estimator $K\left(CZ\right)$ whose existence is guaranteed by the above theorem can be used to show the existence of a family of PEFs that can become arbitrarily close to certifying $h_{min}\left(\rho \right)$ amount of per-trial min-entropy. However, for a precise formulation of this claim we need a way to measure the asymptotic rate of min-entropy using PEFs. Recall from (8) that we can lower-bound the per-trial min-entropy certified by a PEF as:

$$\frac{1}{n}{\mathbb{H}}_{\infty ,\mu }^{\mathsf{avg},ϵ}(\mathbf{C}|\mathbf{ZE};\mathsf{S})⩾\frac{1}{n}\left(1+\frac{1}{\beta }\right){log}_2\left(\kappa \right)-\frac{1}{n}{log}_2\left(p\right).$$

(27)

As in [15], we ignore the ${log}_2\left(\kappa \right)$ term in the asymptotic regime, as the completeness parameter $\kappa$ can be thought of as a “reasonable” lower bound on the probability that the protocol does not abort, a type of error parameter that one might try to decrease somewhat for longer experiments but not at the exponential decay rate required to make this term asymptotically significant. Focusing then on the $-(1/n){log}_2\left(p\right)$ term, recall that success of the protocol is determined by the occurrence of the event $\mathsf{S} := \left\{{\left(ϵ{\prod }_{i=1}^n{F}_i\right)}^{-1/\beta }⩽p\right\}$, the inequality in which can be expressed equivalently as:

$$\frac{1}{n\beta }\sum _{i=1}^n{log}_2\left(F_i\right)+\frac{1}{n\beta }{log}_2\left(ϵ\right)⩾-\frac{1}{n}{log}_2\left(p\right).$$

The expression on the left hand side of the above inequality is the negative base-2 logarithm of the upper bound on ${\mu }_{\mathbf{e}}(\mathbf{C}\left|\mathbf{Z}\right)$ for each $\mathbf{e}\in {\mathcal{E}}^n$ (refer to (2) and the comments following Corollary 1) and so is a rough measure of the amount of randomness, up to an error probability of $ϵ$, present in the outcome data. More concretely, since p will be chosen to make $-(1/n)log\left(p\right)$ as large as reasonably possible to optimise min-entropy certified by (27), the anticipated value of the left hand side quantity can be used as a measure of certifiable randomness. For a stable experiment (i.e., one with each trial having the same distribution $\sigma$ belonging to the same model $\Pi$), the quantity $(1/n){\sum }_{i=1}^n{log}_2\left(F_i\right)/\beta$ approaches ${\mathbb{E}}_{\sigma }\left[{log}_2\left(F\left(CZ\right)\right)\right]/\beta$ in the limit $n\to \infty$, while the term $(1/n\beta ){log}_2\left(ϵ\right)$ goes to zero for any fixed value of $\beta$ and $ϵ$. Hence, we introduce the following quantity as a measure of per-trial min-entropy certified by a PEF.

Definition 7 (Log-Prob Rate).

The log-prob rate of a PEF $F\left(CZ\right)$ with power β at a distribution $\rho \left(CZ\right)$ is defined as ${\mathcal{O}}_{\rho }(F;\beta )={\mathbb{E}}_{\rho }\left[{log}_2\left(F\left(CZ\right)\right)\right]/\beta$.

We say that a PEF certifies randomness at a distribution $\rho$ if the quantity ${\mathcal{O}}_{\rho }(F;\beta )$ is positive. We note that this definition is consistent with our expectation that only nonlocal distributions allow the certification of randomness, as the log-prob rate for a local distribution is a non-positive number, i.e., ${\mathcal{O}}_{{\sigma }_{\mathrm{L}}}(F;\beta )⩽0$: a local behaviour is a convex mixture of (finitely many) local deterministic behaviours ${\sigma }_{\mathrm{LD}}(C\left|Z\right)$. Hence, with a fixed settings distribution $\pi \left(z\right)>0$, the defining condition ${\mathbb{E}}_{\sigma }[F\left(CZ\right)\sigma \left(C{\left|Z\right)}^{\beta }\right]⩽1$ of a PEF for a distribution defined as $\sigma \left(cz\right)={\sigma }_{\mathrm{LD}}(c\left|z\right)\pi \left(z\right)$, for all $c,z$, is equivalently expressed as ${\mathbb{E}}_{\sigma }\left[F\left(CZ\right)\right]⩽1$, since ${\sigma }_{\mathrm{LD}}(c\left|z\right)$ is either 0 or 1 for all $c,z$. Due to the concavity of log function, we then have ${\mathbb{E}}_{\sigma }\left[{log}_2\left(F\left(CZ\right)\right)\right]⩽{log}_2\left({\mathbb{E}}_{\sigma }\left[F\left(CZ\right)\right]\right)⩽0$ using Jensen’s inequality. Hence, no device-independent randomness can be certified at a local-realistic distribution.

Theorem 6.

Given an entropy estimator $K\left(CZ\right)$ and an observed distribution $\rho \left(CZ\right)$, for any $ϵ\in (0,1/2)$ there is a PEF whose log-prob rate at ρ is greater than ${\mathbb{E}}_{\rho }\left[K\left(CZ\right)\right]-ϵ$.

Our proof follows the general approach of Theorem 41 in [15], though we are able to shorten the argument.

Proof. 

Given an entropy estimator $K\left(CZ\right)$ and $ϵ\in (0,1/2)$ from the statement of the theorem, for any $\gamma >0$ we can define a function

$$F\left(CZ\right)=2^{\left(K\right(CZ)-ϵ)\gamma }$$

(28)

We will show that there exists a (small) positive value of $\gamma$ for which $F\left(CZ\right)$ is a PEF with power $\beta =\gamma$; the asymptotic log-prob rate of this PEF at $\rho$ will then be ${\mathbb{E}}_{\rho }\left[{log}_2\left(F\left(CZ\right)\right)\right]/\beta ={\mathbb{E}}_{\rho }\left[K\left(CZ\right)\right]-ϵ$ as desired. So, our task is to find a value of $\gamma$ such that the following inequality holds for all $\sigma \in \Pi$:

$${\mathbb{E}}_{\sigma }\left[F\left(CZ\right)\sigma {\left(C\right|Z)}^{\gamma }\right]⩽1$$

We study the left side of the above expression as a function of $\gamma$; specifically, define a function

$$f_{\sigma }\left(\gamma \right)={\mathbb{E}}_{\sigma }\left[F\left(CZ\right)\sigma {\left(C\right|Z)}^{\gamma }\right]=\sum _{c,z:\sigma \left(cz\right)>0}{\left[2^{K\left(cz\right)-ϵ}\sigma \left(c\right|z)\right]}^{\gamma }\sigma \left(cz\right)$$

which is, for any fixed choice of $\sigma$ and $K\left(CZ\right)$, a convex combination of positive constants raised to the power of $\gamma$ and so is infinitely differentiable at all $\gamma \in \mathbb{R}$. (Note that we never encounter the problematic form $0^0$ because the argument of ${[·]}^{\gamma }$ will always be strictly positive, as the sum defining $f_{\sigma }$ extends only over values of $c,z$ for which $\sigma \left(cz\right)$ is positive, and hence $\sigma \left(c\right|z)>0$.) We can thus Taylor-expand $f_{\sigma }$ about $\gamma =0$, obtaining via the Lagrange remainder theorem that, for any positive $\gamma$, there exists a $k\in (0,\gamma )$ making the following equality hold:

$$f_{\sigma }\left(\gamma \right)=f_{\sigma }\left(0\right)+f_{\sigma }^{\prime }\left(0\right)\gamma +\frac{f_{\sigma }^{″}\left(k\right)}{2}{\gamma }^2$$

(29)

The first term in the expansion satisfies $f_{\sigma }\left(0\right)={\sum }_{cz}1·\sigma \left(cz\right)=1$. The coefficient of $\gamma$ in (29) satisfies:

$$\begin{array}{cc}\hfill f_{\sigma }^{\prime }\left(0\right)& =\sum _{c,z:\sigma \left(cz\right)>0}{\left[2^{K\left(cz\right)-ϵ}\sigma \left(c\right|z)\right]}^0\sigma \left(cz\right)ln\left[2^{K\left(cz\right)-ϵ}\sigma \left(c\right|z)\right]\hfill \\ \hfill & =\sum _{c,z:\sigma \left(cz\right)>0}\sigma \left(cz\right)[K\left(cz\right)-ϵ+{log}_2\left(\sigma \left(c\right|z)\right)]ln\left(2\right)\hfill \\ \hfill & =ln\left(2\right)\left({\mathbb{E}}_{\sigma }\left[K\left(CZ\right)\right]-\mathbb{E}[-{log}_2\left(\sigma \left(c\right|z)\right)]-ϵ\right)⩽-ϵln\left(2\right)\hfill \end{array}$$

where the inequality follows from the condition ${\mathbb{E}}_{\sigma }\left[K\left(CZ\right)\right]⩽{\mathbb{E}}_{\sigma }[-{log}_2\left(\sigma \left(C\left|Z\right)\right)\right]$ in the definition of an entropy estimator. Hence, (29) yields

$$f_{\sigma }\left(\gamma \right)⩽1-ϵ\gamma ln\left(2\right)+\frac{f_{\sigma }^{″}\left(k\right)}{2}{\gamma }^2$$

(30)

for some $k\in (0,\gamma )$. Now, it is given that a fixed $\gamma$, k may be different in (30) for different choices of $\sigma$; however, it must always lie in the interval $(0,\gamma )$, so if we can show that there is a choice of $\gamma$ such that for any $\sigma$ the following inequality holds for all $k\in (0,\gamma )$

$$\frac{f_{\sigma }^{″}\left(k\right)}{2}{\gamma }^2⩽ϵ\gamma ln\left(2\right)$$

(31)

then, for that value of $\gamma$, we will know that $F\left(CZ\right)$ as defined in (28) is a valid PEF satisfying the conditions of the theorem. To find the needed value of $\gamma$ making (31) hold and complete the proof, we calculate

$$\begin{array}{cc}\hfill f_{\sigma }^{″}\left(k\right)& ={ln}^2\left(2\right)\sum _{c,z:\sigma \left(cz\right)>0}{\left[2^{K\left(cz\right)-ϵ}\sigma (c\left|z\right)\right]}^k{\left[{log}_2\left(2^{K\left(cz\right)-ϵ}\sigma (c\left|z\right)\right)\right]}^2\sigma \left(cz\right)\hfill \\ \hfill & ⩽{ln}^2\left(2\right)M^k\sum _{cz:\sigma \left(cz\right)>0}{\sigma (c\left|z\right)}^{k+1}{\left[K\left(cz\right)-ϵ+{log}_2(\sigma \left(c\left|z\right)\right)\right]}^2\sigma \left(z\right)\hfill \end{array}$$

where $M={max}_{cz}{2}^{K\left(cz\right)}$. We now assert that each quantity $\sigma {\left(c\right|z)}^{k+1}{\left[K\left(cz\right)-ϵ+{log}_2\left(\sigma \left(c\right|z)\right)\right]}^2$ is bounded above by a constant $N_{cz}$ for all $k>0$ and $N_{cz}$ is independent of $\sigma$. This follows because, for any fixed choice of c and z, this quantity is strictly smaller than the expression $g_{cz}\left(x\right)=x{\left[K\left(cz\right)-ϵ+{log}_2\left(x\right)\right]}^2$ for the choice of $x=\sigma \left(c\right|z)\in (0,1]$ (note that since $\sigma \left(c\right|z)\in (0,1]$, $\sigma {\left(c\right|z)}^{k+1}⩽\sigma \left(c\right|z)$ holds for any $k>0$). Then, two applications of l’Hôpital’s rule demonstrate that ${lim}_{x\to 0}{g}_{cz}\left(x\right)$ exists and so $g_{cz}$ can be extended to a continuous function on $[0,1]$ where it has a maximum by the extreme value theorem. Invocation of the extreme value theorem, rather than computing an explicit bound, is what primarily allows us to shorten the proof compared to the argument proving Theorem 41 in [15]. Referring to this maximum as $N_{cz}$ and letting $N={max}_{cz}{N}_{cz}$, we obtain the desired bound as shown below.

$$f_{\sigma }^{″}\left(k\right)⩽{ln}^2\left(2\right)M^k\sum _{z:\sigma \left(z\right)>0}\sigma \left(z\right)\sum _{c:\sigma (c,z)>0}N⩽ln\left(2\right)M^k\sum _{z:\sigma \left(z\right)>0}\sigma \left(z\right)\left|\mathcal{C}\right|N=ln\left(2\right)M^k\left|\mathcal{C}\right|N.$$

(32)

This shows that, if $M^k\gamma ⩽2ϵ/\left|\mathcal{C}\right|N$ holds, then (31) holds, from which it follows that a sufficiently small choice of $\gamma >0$ makes (31) hold for all $k\in (0,\gamma )$. □

The combination of Theorem 5, which shows the existence of an entropy estimator with entropy estimate $h_{min}\left(\rho \right)$, and Theorem 6, which enables the construction of a family of PEFs with log-prob rate arbitrarily close to this entropy estimate, demonstrates the asymptotic optimality of the PEF method.

3.3. Robustness of PEFs

We want to consider a question not considered in the previous PEF papers: can a PEF optimised for $\rho \left(CZ\right)$ certify randomness for a distribution different from $\rho$, where the difference is measured in terms of the total variation distance between them; in other words, how robust is the PEF? We will see in the next section that, in the (2,2,2) Bell scenario, for any behaviour corresponding to $\rho$ violating the CHSH–Bell inequality, PEFs can be (up to any desired $ϵ$-tolerance) asymptotically optimal in terms of log-prob rate at $\rho$ while also generating randomness at a positive rate for any behaviour (corresponding to a distribution of outcomes and settings) that violates the CHSH–Bell inequality by a fixed positive amount, which can be chosen to be as small as desired.

The following theorem gives a useful sufficient condition for a distribution different from $\rho$ to have a positive log-prob rate and demonstrates that any nontrivial (i.e., non-constant) PEF will have at least some degree of robustness.

Theorem 7.

Let $F\left(CZ\right)=G{\left(CZ\right)}^{\beta }$ be a non-constant positive PEF with power $\beta >0$ for Π. The log-prob rate ${\mathcal{O}}_{\sigma }(F;\beta )$ at a distribution $\sigma \left(CZ\right)\in \Pi$ is related to the log-prob rate ${\mathcal{O}}_{\rho }(F;\beta )$ at $\rho \left(CZ\right)\in \Pi$ and the total variation distance between ρ and σ as

$$|{\mathcal{O}}_{\rho }(F;\beta )-{\mathcal{O}}_{\sigma }(F;\beta )|⩽(L-l)d_{\mathrm{TV}}(\rho ,\sigma ),$$

(33)

where $L={max}_{cz}{log}_2\left(G\left(cz\right)\right)$ and $l={min}_{cz}{log}_2\left(G\left(cz\right)\right)$. Consequently, assuming that ${\mathcal{O}}_{\rho }(F;\beta )$ is positive, the following upper bound on the total variation distance between $\rho \left(CZ\right)$ and $\sigma \left(CZ\right)$ is a sufficient condition for F to have a positive log-prob rate at $\sigma \left(CZ\right)$

$$d_{\mathrm{TV}}(\rho ,\sigma )<{\mathbb{E}}_{\rho }\left[{log}_2\left(G\right)\right]/(L-l).$$

(34)

Proof. 

Using the definition of log-prob rate at a given distribution we have

$$\begin{array}{cc}\hfill & |{\mathcal{O}}_{\rho }(F;\beta )-{\mathcal{O}}_{\sigma }(F;\beta )|=|\sum _{cz}\frac{1}{\beta }\left[{log}_2\left(G{\left(cz\right)}^{\beta }\right)\left(\rho \left(cz\right)-\sigma \left(cz\right)\right)\right]|\hfill \\ \hfill & =|\sum _{cz}\left({log}_2\left(G\left(cz\right)\right)+\frac{L+l}{2}-\frac{L+l}{2}\right)(\rho \left(cz\right)-\sigma \left(cz\right))|\hfill \\ \hfill & =|\sum _{cz}\left({log}_2\left(G\left(cz\right)\right)-\frac{L+l}{2}\right)\left(\rho \left(cz\right)-\sigma \left(cz\right)\right)+\frac{L+l}{2}\sum _{cz}\left(\rho \left(cz\right)-\sigma \left(cz\right)\right)|\hfill \\ \hfill & ⩽\sum _{cz}|{log}_2\left(G\left(cz\right)\right)-\frac{L+l}{2}\left|\right|\rho \left(cz\right)-\sigma \left(cz\right)|\hfill \\ \hfill & ⩽(L-l)\frac{1}{2}\sum _{cz}\left|\rho \left(cz\right)-\sigma \left(cz\right)\right|=(L-l)d_{\mathrm{TV}}(\rho ,\sigma )\hfill \end{array}$$

Hence, we have

$${\mathcal{O}}_{\rho }(F;\beta )-(L-l)d_{\mathrm{TV}}(\rho ,\sigma )⩽{\mathcal{O}}_{\sigma }(F;\beta )⩽{\mathcal{O}}_{\rho }(F;\beta )+(L-l)d_{\mathrm{TV}}(\rho ,\sigma ).$$

Assuming that ${\mathcal{O}}_{\rho }(F;\beta )$ is positive, a sufficient condition for ${\mathcal{O}}_{\sigma }(F;\beta )$ to be positive is ${\mathcal{O}}_{\rho }(F;\beta )>\left|L-l\right|d_{\mathrm{TV}}(\rho ,\sigma )$ or, equivalently, the following bound on $d_{\mathrm{TV}}(\rho ,\sigma )$:

$$d_{\mathrm{TV}}(\rho ,\sigma )<{\mathcal{O}}_{\rho }(F;\beta )/(L-l)={\mathbb{E}}_{\rho }\left[{log}_2\left(G\right)\right]/(L-l).$$

□

We will see in Section 4.2 that the bound (33) can be saturated and so is tight.

4. Application to the (2,2,2) Bell Scenario

Here, we explore the application of the results of the previous section to the (2,2,2) Bell scenario (that of two parties, two measurement settings and two outcomes). First, working within the trial model of no-signalling distributions ${\Pi }_{\mathrm{NS}}$, we show that PEFs can be simultaneously asymptotically optimal and robust by means of an explicit construction of a sequence of PEFs that approaches the optimal log-prob rate for the target distribution while simultaneously generating randomness at a positive rate for any other distribution violating the CHSH inequality.

In the course of this exercise, we will observe that the optimal adversarial attack—one generating the observed statistics (consistent with an expected trial distribution $\rho$) while asymptotically yielding $h_{min}\left(\rho \right)$ amount of per-trial randomness—is always achieved through a single-trial distribution that marginalises to $\rho$ through a convex combination of a single extremal no-signalling nonlocal distribution and a local realistic distribution (which itself consists of a convex mixture of up to eight extremal local deterministic distributions). This is a notable feature, revealing that the adversary never needs to prepare more than one nonlocal distribution to simulate the observed distribution with as little min-entropy as possible. Later in this section, we explore the potential for generalisation of this feature to the (2,2,2) scenario restricted to quantum distributions (${\Pi }_{\mathrm{Q}}$); if true, this would be an important finding, outlining the optimal approach of a (more realistic) quantum-limited adversary attacking the PEF protocol. The general observation that preparing a single nonlocal state is preferable to preparing multiple ones underlies the significance of the answer to this question. We find some evidence that the feature—only requiring one extremal nonlocal distribution in the convex combination attack—may hold for ${\Pi }_{\mathrm{Q}}$ in the (2,2,2) Bell scenario but this may be a difficult question to resolve due to the complicated geometry of the quantum set. We also explore possible generalisations of this feature to no-signalling trial models for $(n,m,k)$ Bell scenarios where n, m or k exceed 2, and find that it does not hold in any of these cases—so the question of whether this holds in a given Bell scenario and trial model is non-trivial in general.

We begin with a brief review of the (2,2,2) Bell scenario and some features of the set ${\Pi }_{\mathrm{NS}}$ of no-signalling distributions in this scenario.

4.1. A Brief Review of the (2,2,2) Bell Scenario

The (2,2,2) Bell scenario is the minimal Bell scenario, comprising two spatially separated parties Alice and Bob, each having two measurement settings and two possible outcomes corresponding to each setting. The measurement settings for Alice and Bob are represented by the RVs $X,Y$ realising values $x,y\in \{0,1\}$ and the measurement outcomes are represented by the RVs $A,B$ realising values $a,b\in \{0,1\}$. With ${\sigma }_{\mathrm{s}}\left(XY\right)$ representing a fixed settings distribution, we refer to the sets ${\Pi }_{\mathrm{NS}},{\Pi }_{\mathrm{Q}}\mathrm{and}{\Pi }_{\mathrm{L}}$ as no-signalling, quantum and local models, respectively, when they comprise of distributions $\mu \left(ABXY\right) := \mu (AB\left|XY\right){\sigma }_{\mathrm{s}}\left(XY\right)$, where the conditional probabilities $\mu \left(AB\right|XY)$, referred to as behaviours, are constrained by the no-signalling, quantum and local realism principle, respectively. Henceforth, all distributions $\mu \left(ABXY\right)$ belonging to a model are defined as $\mu \left(ABXY\right) := \mu (AB\left|XY\right){\sigma }_{\mathrm{s}}\left(XY\right)$, and we associate a model with its constituent behaviour $\mu \left(AB\right|XY)$ or distribution $\mu \left(ABXY\right)$, indistinctively, since the settings distribution is fixed. Recall that the model ${\Pi }_{\mathrm{NS}}$ is a polytope, the extremal points of which consist of the behaviours ${\mu }_{\mathrm{extr}}(AB\left|XY\right)\equiv \left\{{\mu }_{\mathrm{extr}}(ab\left|xy\right):a,b,\left[0\right]x,y\in \{0,1\}\right\}$ defined below.

$$\begin{array}{cc}\hfill {\mu }_{\mathrm{PR}}^{\alpha \beta \gamma }(ab\left|xy\right) := & \left\{\begin{array}{cc}\frac{1}{2}\hfill & :a\oplus b=xy\oplus \alpha x\oplus \beta y\oplus \gamma \hfill \\ 0\hfill & :\mathrm{otherwise}\hfill \end{array}\right.\hfill \end{array}$$

(35)

$$\begin{array}{cc}\hfill {\mu }_{\mathrm{LD}}^{\alpha \beta \gamma \delta }(ab\left|xy\right) := & \left\{\begin{array}{cc}1\hfill & :a=\alpha x\oplus \beta ,b=\gamma y\oplus \delta \hfill \\ 0\hfill & :\mathrm{otherwise}\hfill \end{array}\right.\hfill \end{array}$$

(36)

where $\alpha ,\beta ,\gamma ,\delta \in \{0,1\}$ and ⊕ denotes addition modulo 2; (35) and (36) are known as the Popescu–Rohrlich (PR) behaviours [22] and the local deterministic (LD) behaviours, respectively. The CHSH–Bell inequalities shown below are known to be the only non-trivial facet inequalities delimiting the local polytope which is the convex hull of the LD behaviours [23]. Corresponding to each choice of $\alpha ,\beta ,\gamma \in \{0,1\}$, the inequalities represent a version of the canonical CHSH–Bell inequality.

$$B^{\alpha \beta \gamma } := {(-1)}^{\gamma }{E}_{00}+{(-1)}^{\beta +\gamma }{E}_{01}+{(-1)}^{\alpha +\gamma }{E}_{10}+{(-1)}^{\alpha +\beta +\gamma +1}{E}_{11}⩽2,$$

(37)

where $E_{xy} := {\sum }_{a,b=0}^1{(-1)}^{a+b}\mu (ab\left|xy\right)$ for $x,y\in \{0,1\}$. The nonlocal algebraic maximum for the expression $B^{\alpha \beta \gamma }$ is 4. The local maximum is obtained by eight ${\mu }_{\mathrm{LD}}^{\alpha \beta \gamma \delta }(AB\left|XY\right)$ behaviours for each $B^{\alpha \beta \gamma }$. The sets ${\mathsf{LD}}_i,i\in \{1,2,\dots ,8\}$, each comprise of eight LD behaviours that saturate—i.e., achieve a value of 2—exactly one $B^{\alpha \beta \gamma }$. A result proven in [24] (see Theorems 2.1 and 2.2 therein) states that any behaviour violating (37) can be represented as a convex combination of one PR box achieving the nonlocal maximum for $B^{\alpha \beta \gamma }$ and (up to) eight LD behaviours of the corresponding ${\mathsf{LD}}_i$ set saturating it. In fact, the geometry of the no-signalling polytope in this Bell scenario is such that there is a one-to-one correspondence between the nonlocal no-signalling extremal points, the PR boxes, in (35) and the non-trivial facets of the local polytope described by (37), with exactly one extremal point violating it up to the algebraic maximum of four for each choice of $(\alpha ,\beta ,\gamma )\in {\{0,1\}}^3$. Hence, any nonlocal behaviour—that violates a given version of the CHSH–Bell inequality—is contained in a nonlocal 8-simplex whose vertices are the one PR box that maximally violates that particular version and the eight LD behaviours that saturate it. Recall that a p-simplex is a p-dimensional polytope which is the convex hull of its $p+1$ vertices. More formally, if the set $C := \{{\overrightarrow{a}}_0,{\overrightarrow{a}}_1,\dots ,{\overrightarrow{a}}_p\}\subset {\mathbb{R}}^n$ of $p+1$ points are affinely independent, then the p-simplex determined by them is the following set of points:

$${\Delta }^p := \left\{\sum _{k=0}^p{\theta }_k{\overrightarrow{a}}_k|\sum _{k=0}^p{\theta }_k=1,{\theta }_k⩾0\mathrm{for}k=0,1,\dots ,p\right\}.$$

The affine independence condition means that the only admissible choice of ${\theta }_k\in \mathbb{R}$ such that ${\sum }_{k=0}^p{\theta }_k{\overrightarrow{a}}_k=\overrightarrow{0}$ and ${\sum }_{k=0}^p{\theta }_k=0$ are satisfied is ${\theta }_k=0$ for all k; this holds if and only if the vectors ${\overrightarrow{a}}_k-{\overrightarrow{a}}_0$ are linearly independent for $k=1,2,\dots ,p$.

One can check that the PR box that achieves the nonlocal maximum for a given version of the CHSH–Bell expression $B^{\alpha \beta \gamma }$ and the eight LD behaviours that achieve the local maximum for it are affinely independent. Since $a,b,x,y\in \{0,1\}$ and ${|\{0,1\}}^4|=16$, we can represent the behaviours $\mu \left(ab\right|xy)$ in this Bell scenario as vectors $\overrightarrow{\mu }\in {\mathbb{R}}^{16}$ as shown in

Table 1. These probability vectors in ${\mathbb{R}}^{16}$ are the PR box ${\overrightarrow{\mu }}_{\mathrm{PR},1}\equiv {\mu }_{\mathrm{PR}}^{000}$ that achieves the nonlocal maximum of 4 and the eight LD behaviours ${\overrightarrow{\mu }}_{\mathrm{LD},1},\dots ,{\overrightarrow{\mu }}_{\mathrm{LD},8}$ that achieve the local maximum of 2 for the standard CHSH–Bell expression $B^{000}$, with the LD behaviours corresponding to the eight probability tables numbered 1, 4, 5, 8, 9, 12, 14 and 15 in Table A2 of [24], and also given in the first row of Table 2. One can verify the affine independence of the nine vectors above by verifying that the eight vectors obtained by subtracting the first vector from the remaining eight are linearly independent.

	xy
	00				01				10				11
	ab				ab				ab				ab
	00	01	10	11	00	01	10	11	00	01	10	11	00	01	10	11
${\overrightarrow{\mu }}_{\mathrm{PR},1}$	$1/2$	0	0	$1/2$	$1/2$	0	0	$1/2$	$1/2$	0	0	$1/2$	0	$1/2$	$1/2$	0
${\overrightarrow{\mu }}_{\mathrm{LD},1}$	1	0	0	0	1	0	0	0	1	0	0	0	1	0	0	0
${\overrightarrow{\mu }}_{\mathrm{LD},2}$	0	0	0	1	0	0	0	1	0	0	0	1	0	0	0	1
${\overrightarrow{\mu }}_{\mathrm{LD},3}$	1	0	0	0	0	1	0	0	1	0	0	0	0	1	0	0
${\overrightarrow{\mu }}_{\mathrm{LD},4}$	0	0	0	1	0	0	1	0	0	0	0	1	0	0	1	0
${\overrightarrow{\mu }}_{\mathrm{LD},5}$	1	0	0	0	1	0	0	0	0	0	1	0	0	0	1	0
${\overrightarrow{\mu }}_{\mathrm{LD},6}$	0	0	0	1	0	0	0	1	0	1	0	0	0	1	0	0
${\overrightarrow{\mu }}_{\mathrm{LD},7}$	0	1	0	0	1	0	0	0	0	0	0	1	0	0	1	0
${\overrightarrow{\mu }}_{\mathrm{LD},8}$	0	0	1	0	0	0	0	1	1	0	0	0	0	1	0	0

. Then, the affine independence is apparent: letting the PR box behaviour be ${\overrightarrow{a}}_0$ and the LD behaviours be the other ${\overrightarrow{a}}_k$, each ${\overrightarrow{a}}_k-{\overrightarrow{a}}_0$ term has a unique column where it contains a “1” while all of the other terms contain “0”, ensuring linear independence.

It is known that a behaviour belonging to ${\Pi }_{\mathrm{NS}}\setminus {\Pi }_{\mathrm{L}}$ violates exactly one of the eight CHSH–Bell inequalities. The impossibility of simultaneously violating a specific pair of CHSH–Bell inequalities can be seen as presented in [25]: suppose a behaviour in ${\Pi }_{\mathrm{NS}}\setminus {\Pi }_{\mathrm{L}}$ violates both inequalities corresponding to $(\alpha ,\beta ,\gamma )=(0,0,0)$ and $(\alpha ,\beta ,\gamma )=(1,0,0)$, then $E_{00}+E_{01}+E_{10}-E_{11}>2$ and $E_{00}+E_{01}-E_{10}+E_{11}>2$ holds for the same behaviour. Adding these two inequalities we have $2(E_{00}+E_{01})>4$, i.e., $E_{00}+E_{01}>2$, which is not possible to satisfy since the correlations $E_{xy}$ satisfy $|E_{xy}|⩽1$.

Table 2. The eight nonlocal 8-simplices containing behaviours that violate the corresponding version of the CHSH–Bell inequality. We identify each 8-simplex ${\Delta }_{\mathrm{PR},i}^8$ with a PR box which solely contributes to the nonlocality of the behaviour violating the CHSH–Bell inequality.

${\mathit{B}}^{\mathit{\alpha }\mathit{\beta }\mathit{\gamma }}$	${\Delta }_{\mathbf{PR},\mathit{i}}^8$
$B^{000}$	${\Delta }_{\mathrm{PR},1}^8 := \mathrm{conv}\left\{{\mu }_{\mathrm{PR}}^{000},{\mu }_{\mathrm{LD}}^{0000},{\mu }_{\mathrm{LD}}^{0101},{\mu }_{\mathrm{LD}}^{0010},{\mu }_{\mathrm{LD}}^{0111},{\mu }_{\mathrm{LD}}^{1000},{\mu }_{\mathrm{LD}}^{1101},{\mu }_{\mathrm{LD}}^{1011},{\mu }_{\mathrm{LD}}^{1110}\right\}$
$B^{001}$	${\Delta }_{\mathrm{PR},2}^8 := \mathrm{conv}\left\{{\mu }_{\mathrm{PR}}^{001},{\mu }_{\mathrm{LD}}^{0001},{\mu }_{\mathrm{LD}}^{0011},{\mu }_{\mathrm{LD}}^{0100},{\mu }_{\mathrm{LD}}^{0110},{\mu }_{\mathrm{LD}}^{1001},{\mu }_{\mathrm{LD}}^{1010},{\mu }_{\mathrm{LD}}^{1100},{\mu }_{\mathrm{LD}}^{1111}\right\}$
$B^{010}$	${\Delta }_{\mathrm{PR},3}^8 := \mathrm{conv}\left\{{\mu }_{\mathrm{PR}}^{010},{\mu }_{\mathrm{LD}}^{0000},{\mu }_{\mathrm{LD}}^{0010},{\mu }_{\mathrm{LD}}^{0101},{\mu }_{\mathrm{LD}}^{0111},{\mu }_{\mathrm{LD}}^{1001},{\mu }_{\mathrm{LD}}^{1010},{\mu }_{\mathrm{LD}}^{1100},{\mu }_{\mathrm{LD}}^{1111}\right\}$
$B^{011}$	${\Delta }_{\mathrm{PR},4}^8 := \mathrm{conv}\left\{{\mu }_{\mathrm{PR}}^{011},{\mu }_{\mathrm{LD}}^{0001},{\mu }_{\mathrm{LD}}^{0011},{\mu }_{\mathrm{LD}}^{0100},{\mu }_{\mathrm{LD}}^{0110},{\mu }_{\mathrm{LD}}^{1000},{\mu }_{\mathrm{LD}}^{1011},{\mu }_{\mathrm{LD}}^{1101},{\mu }_{\mathrm{LD}}^{1110}\right\}$
$B^{100}$	${\Delta }_{\mathrm{PR},5} := \mathrm{conv}\left\{{\mu }_{\mathrm{PR}}^{100},{\mu }_{\mathrm{LD}}^{0000},{\mu }_{\mathrm{LD}}^{0011},{\mu }_{\mathrm{LD}}^{0101},{\mu }_{\mathrm{LD}}^{0110},{\mu }_{\mathrm{LD}}^{1000},{\mu }_{\mathrm{LD}}^{1010},{\mu }_{\mathrm{LD}}^{1101},{\mu }_{\mathrm{LD}}^{1111}\right\}$
$B^{101}$	${\Delta }_{\mathrm{PR},6}^8 := \mathrm{conv}\left\{{\mu }_{\mathrm{PR}}^{101},{\mu }_{\mathrm{LD}}^{0001},{\mu }_{\mathrm{LD}}^{0010},{\mu }_{\mathrm{LD}}^{0100},{\mu }_{\mathrm{LD}}^{0111},{\mu }_{\mathrm{LD}}^{1001},{\mu }_{\mathrm{LD}}^{1011},{\mu }_{\mathrm{LD}}^{1100},{\mu }_{\mathrm{LD}}^{1110}\right\}$
$B^{110}$	${\Delta }_{\mathrm{PR},7}^8 := \mathrm{conv}\left\{{\mu }_{\mathrm{PR}}^{110},{\mu }_{\mathrm{LD}}^{0001},{\mu }_{\mathrm{LD}}^{0010},{\mu }_{\mathrm{LD}}^{0100},{\mu }_{\mathrm{LD}}^{0111},{\mu }_{\mathrm{LD}}^{1000},{\mu }_{\mathrm{LD}}^{1010},{\mu }_{\mathrm{LD}}^{1101},{\mu }_{\mathrm{LD}}^{1111}\right\}$
$B^{111}$	${\Delta }_{\mathrm{PR},8}^8 := \mathrm{conv}\left\{{\mu }_{\mathrm{PR}}^{111},{\mu }_{\mathrm{LD}}^{0000},{\mu }_{\mathrm{LD}}^{0011},{\mu }_{\mathrm{LD}}^{0101},{\mu }_{\mathrm{LD}}^{0110},{\mu }_{\mathrm{LD}}^{1001},{\mu }_{\mathrm{LD}}^{1011},{\mu }_{\mathrm{LD}}^{1100},{\mu }_{\mathrm{LD}}^{1110}\right\}$

lists the eight versions of the Bell expression $B^{\alpha \beta \gamma }$ and the eight nonlocal 8-simplices ${\Delta }_{\mathrm{PR},i}^8$ containing points that violate the corresponding CHSH–Bell inequality. Any nonlocal no-signalling behaviour ultimately belongs to exactly one such simplex.

4.2. Robust PEFs and Optimal Adversarial Attacks in the (2,2,2) Bell Scenario

We now examine the robustness of PEFs that are optimal for an anticipated distribution $\rho$ and a fixed number of planned trials n. We first review how we find optimal PEFs in this scenario. The constrained maximisation routine in (10) provides a method to find useful PEFs with respect to an anticipated trial distribution, with Lemma 1 showing that the feasibility constraints in (10) can be restricted to only the distributions corresponding to the eight PR and sixteen LD behaviours (with a fixed settings distribution ${\sigma }_{\mathrm{s}}\left(XY\right)>0$).

In practice, the number of trials n will affect the choice of $\beta$ and the PEF that optimises the quantity ${\mathbb{E}}_{\rho }[(n{log}_2\left(F\left(CZ\right)\right)+{log}_2\left(ϵ\right))/\beta ]$, a quantity which (per the discussion surrounding (10)) can be thought of as the anticipated amount of raw randomness from running the experiment whose trial distribution is expected to be $\rho$. If we divide this quantity by n, we arrive at a measure of expected randomness per trial for the optimal PEF at a given value of $\beta$, called the net log-prob rate: the function $\left({max}_F{\mathcal{O}}_{\rho }(F;\beta )\right)+{log}_2\left(ϵ\right)/n\beta$. Figure 2 shows a plot of the net log-prob rates corresponding to two different values of n, as well as the supremum of the log-prob rate, for $\beta$ varying from $0.001$ to $0.1$ and $ϵ$ fixed at the value ${10}^{-4}$. The value of $\beta$, and the corresponding PEF that maximises the curve, is then the best choice for the given planned number of trials n.

The plot illustrates some notable features of PEFs. First, it was proved in Appendix D of [14] that assuming a stable experiment (with each trial distribution $\rho$) the function ${sup}_F{\mathcal{O}}_{\rho }(F;\beta )$ is monotonically non-increasing in $\beta >0$ which implies that the global supremum of the log-prob rates ${sup}_{\beta >0}{sup}_F{\mathcal{O}}_{\rho }(F;\beta )$, for all PEFs with positive powers, is achieved in the limit $\beta \to 0$. We observe this with the top curve. For a fixed $ϵ$, the net log-prob rate converges upwards to ${sup}_F{\mathcal{O}}_{\rho }(F;\beta )$ for each $\beta$ as $n\to 0$ but, for any fixed value of n, ${log}_2\left(ϵ\right)/n\beta$ diverges to $-\infty$ as $\beta \to 0$. Hence, in a finite trial regime the supremum of the log-prob rates (attainable by PEFs with positive powers) is not achieved—the maximum value of the net log-prob rate is achieved at a $\beta$ away from 0. The general trend is that for a value of n the net log-prob rate achieves a higher value corresponding to a lower value of $\beta$; the net log-prob rate is improved by a reduction in power and an increase in the number of trials. This is observed in Figure 2 for the two choices of $n=1.5\times {10}^5$ and $n=2.4\times {10}^5$. As a side note, the proof that ${\beta }^{\prime }<\beta$ implies ${sup}_F{\mathcal{O}}_{\rho }(F;{\beta }^{\prime })⩽{sup}_F{\mathcal{O}}_{\rho }(F;\beta )$ is straightforward: write ${\beta }^{\prime }=\gamma \beta$ with $0<\gamma <1$; then, for any F in the scope of ${sup}_F{\mathcal{O}}_{\rho }(F;\beta )$, it turns out $F^{\gamma }$ is a PEF with power ${\beta }^{\prime }$, for which the equality ${\mathcal{O}}_{\rho }(F^{\gamma };{\beta }^{\prime })={\mathcal{O}}_{\rho }(F;\beta )$ follows immediately from the definition of log-prob rate—hence, the supremum of log-prob rates cannot be smaller at ${\beta }^{\prime }$. $F^{\gamma }$ is a PEF with power ${\beta }^{\prime }$ as ${\mathbb{E}}_{\rho }\left(F^{\gamma }\sigma {\left(c\right|z)}^{\beta \gamma }\right)⩽{\mathbb{E}}_{\rho }{\left(F\sigma {\left(c\right|z)}^{\beta }\right)}^{\gamma }⩽1^{\gamma }=1$, with the first inequality holding by Jensen’s inequality ($f\left(x\right)=x^{\gamma }$ is concave) and the second because F is a PEF with power $\beta$.

The arguments above illustrate how it is necessary to consider a range of $\beta$ values to find the optimal choice. We remark there is an upper limit to the range of $\beta$ values that must be considered: it was noted in [14] (see Appendix F therein) that there exists a certain threshold value ${\beta }_{\mathrm{th}}^{\mathrm{NS}}$ such that, for all $\beta ⩾{\beta }_{\mathrm{th}}^{\mathrm{NS}}$, the optimisation problem in (10) will return the same PEF independent of the choice of $\beta$ and [14] cites numerical evidence that this bound is ${\beta }_{\mathrm{th}}^{\mathrm{NS}}\simeq 0.4151$. The following result, whose proof we give in the appendix, derives this threshold analytically, finding it to have the exact value ${log}_2(4/3)$.

Proposition 1.

For the set of behaviours ${\Pi }_{\mathrm{NS}}$, the PEF optimisation in (10) is independent of the power β for $\beta ⩾{log}_2(4/3)$.

Proof. 

See Appendix F. □

We now ask how optimal PEFs for lower and lower values of $\beta$ (and correspondingly higher values of n) compare on the question of robustness, in the following sense: can a PEF optimised with respect to a distribution $\rho$ violating the standard CHSH–Bell inequality be used to certify randomness of distributions that are different from $\rho$, provided they violate the same CHSH–Bell inequality? This question is relevant because, in practice, the observed experimental distribution will never be exactly the same as the anticipated one and may be somewhat different depending on many potential factors. Figure 3 gives an illustration of the matter of robustness. Comparing the two plots of the log-prob rate for quantum-realisable distributions on the two-dimensional slice (shown in Figure 4b) above the standard CHSH–Bell facet, we observe that the level set denoting a zero amount of certified randomness in the right hand plot (which corresponds to a lower value of $\beta$ than that on the left) is pushed further down to (almost touching) the standard CHSH–Bell facet.

This suggests that the asymptotic optimality of a PEF need not entail a trade-off with its robustness; indeed, we observed that, in many cases, as $\beta >0$ assumes smaller and smaller values, the PEF optimised for a fixed $\rho$ violating the standard CHSH–Bell inequality becomes more and more robust in the sense that it certifies randomness at a positive rate (asymptotically) for increasingly statistically different $\sigma$.

We show that this is a general feature. To this end, we define a sequence of PEFs that is both asymptotically optimal with respect to the log-prob rate and is asymptotically robust in the sense that, given any distribution violating the standard CHSH–Bell inequality, all the PEFs beyond a point in the sequence certify randomness at a positive rate. To construct this PEF sequence, we first define the function $K_{*}\left(ABXY\right)$ as shown below:

$$K_{*}\left(abxy\right) := 4\left[[a\oplus b=xy]\right]-3,$$

(38)

where $a,b,x,y\in \{0,1\}$ and the function $\left[\right[·\left]\right]$ evaluates to 1 if the condition within holds, 0 otherwise. The function defined in (38) is an entropy estimator for the distributions in the no-signalling polytope when the settings are equiprobable, i.e., ${\sigma }_{\mathrm{s}}\left(xy\right)=1/4$ for all choices of x and y. To see this, recalling Definition 6 we can check—by direct evaluation—whether $K_{*}$ satisfies the inequality ${\mathbb{E}}_{\sigma }\left[K\left(CZ\right)\right]⩽{\mathbb{E}}_{\sigma }[-{log}_2\left(\sigma \left(C\left|Z\right)\right)\right]$ when $\sigma$ is each of the extremal points of the no-signalling polytope. It is sufficient to check this condition for the extremal points of the no-signalling set, i.e., the PR behaviours and the LD behaviours. This is because if $\sigma$ is expressible as $\sigma =\lambda {\sigma }_1+(1-\lambda ){\sigma }_2$ then, for any function K satisfying ${\mathbb{E}}_{{\sigma }_i}\left[K\left(ABXY\right)\right]⩽{\mathbb{H}}_{{\sigma }_i}(AB\left|XY\right)$, we have ${\mathbb{E}}_{\sigma }\left[K\right]=\lambda {\mathbb{E}}_{{\sigma }_1}\left[K\right]+(1-\lambda ){\mathbb{E}}_{{\sigma }_2}\left[K\right]⩽\lambda {\mathbb{H}}_{{\sigma }_1}(AB\left|XY\right)+(1-\lambda ){\mathbb{H}}_{{\sigma }_2}(AB\left|XY\right)⩽{\mathbb{H}}_{\sigma }(AB\left|XY\right)$. Hence, if the condition holds for the extremal points, it will hold for all points in the set. To see that it does, we confirm by inspection that ${\mathbb{E}}_{\sigma }\left[K_{*}\right]$ attains the value 1 for the PR behaviour achieving the no-signalling maximum for the standard CHSH function, the value $-3$ for the PR behaviour achieving $-4$ and the value $-1$ for each of the PR behaviours that achieve the value 0, which are all less than or equal to the conditional Shannon entropy of the respective PR behaviours, which is 1. Likewise, we can check that $K_{*}$ is a valid entropy estimator for all the LD behaviours; it takes the value zero for the eight local deterministic distributions appearing in Table 1 and $-2$ for the other eight, while $\mathbb{H}\left(AB\right|XY)=0$ for these distributions. Hence, we have verified that $K_{*}$ satisfies the entropy estimator condition for all the extremal behaviours and by extension all behaviours in the no-signalling polytope.

Having shown $K_{*}$ is a is an entropy estimator, we next consider a sequence of functions ${\left\{F_k\right\}}_{k=1}^{\infty }$ where $F_k$ is defined according to the construction in Theorem 6:

$$F_k\left(ABXY\right)=2^{(K_{*}\left(ABXY\right)-e^{-k}){\beta }_k},$$

(39)

where we choose a positive ${\beta }_k$ making $F_k$ a PEF for each k, whose existence is guaranteed by the theorem. By construction, for each k the function $F_k$ is a valid PEF with power ${\beta }_k>0$ for the set of no-signalling distributions. The log-prob rate of $F_k$ at $\sigma$ is:

$${\mathcal{O}}_{\sigma }(F_k;{\beta }_k)=\frac{1}{{\beta }_k}{\mathbb{E}}_{\sigma }\left[{log}_2\left(2^{(K_{*}-e^{-k}){\beta }_k}\right)\right]={\mathbb{E}}_{\sigma }\left[K_{*}\right]-e^{-k}.$$

(40)

We show robustness of the sequence in the following sense: for any $\sigma \in {\Pi }_{\mathrm{NS}}$ violating the standard CHSH–Bell inequality, the log-prob rate of the sequence of PEFs ${\left\{F_k\right\}}_{k=1}^{\infty }$ is eventually positive. To see this, recall that, as discussed in our brief review of the (2,2,2) Bell scenario, behaviours violating the standard CHSH–Bell inequality are contained in the nonlocal 8-simplex ${\Delta }_{\mathrm{PR},1}^8$ (see Table 2). Hence, $\sigma$ is expressible as a convex combination of the vertices of ${\Delta }_{\mathrm{PR},1}^8$:

$$\sigma (ab\left|xy\right){\sigma }_{\mathrm{s}}\left(xy\right)={\lambda }_{\mathrm{PR},1}{\mu }_{\mathrm{PR},1}(ab\left|xy\right){\sigma }_{\mathrm{s}}\left(xy\right)+\sum _{i=1}^8{\alpha }_i{\mu }_{\mathrm{LD},i}(ab\left|xy\right){\sigma }_{\mathrm{s}}\left(xy\right),$$

(41)

where ${\lambda }_{\mathrm{PR},1}+{\sum }_{i=1}^8{\alpha }_i=1$. This decomposition allows us to express the log-prob rate in terms of the standard CHSH–Bell function, which we define as

$$S\left(ABXY\right) := {(-1)}^{XY}{(-1)}^{A+B}/{\sigma }_{\mathrm{s}}\left(XY\right),$$

where ${\sigma }_{\mathrm{s}}\left(XY\right)$ is the fixed settings distribution. We see that ${\lambda }_{\mathrm{PR},1}=(S_{\sigma }-2)/2$ in (41), where $S_{\sigma }$ is the expected standard CHSH–Bell value according to the distribution $\sigma \left(ABXY\right)=\sigma (ab\left|xy\right){\sigma }_{\mathrm{s}}\left(xy\right)$. This follows by computing the expectation of S according to the PR box distribution ${\mu }_{\mathrm{PR},1}={\mu }_{\mathrm{PR},1}\left(abxy\right)={\mu }_{\mathrm{PR},1}(ab\left|xy\right){\sigma }_{\mathrm{s}}\left(xy\right)$, which is 4, and the expectation of S according to the local distribution ${\mu }_{\mathrm{L},i}={\mu }_{\mathrm{L},i}\left(abxy\right)={\mu }_{\mathrm{LD},i}(ab\left|xy\right){\sigma }_{\mathrm{s}}\left(xy\right)$, which is 2. The log-prob rate ${\mathcal{O}}_{\sigma }(F_k;{\beta }_k)$ for $F_k$ at $\sigma$ is then expressed as:

$${\mathcal{O}}_{\sigma }(F_k;{\beta }_k)=\left(\frac{S_{\sigma }-2}{2}\right){\mathbb{E}}_{{\mu }_{\mathrm{PR},1}}\left[K_{*}\right]+\sum _{i=1}^8{\alpha }_i{\mathbb{E}}_{{\mu }_{\mathrm{LD},i}}\left[K_{*}\right]-e^{-k}.$$

(42)

Since ${\mathbb{E}}_{{\mu }_{\mathrm{LD},i}}\left[K_{*}\right]$ evaluates to zero for each ${\mu }_{\mathrm{LD},i}$ and ${\mathbb{E}}_{{\mu }_{\mathrm{PR},1}}\left[K_{*}\right]$ evaluates to 1, the expression for ${\mathcal{O}}_{\sigma }(F_k;{\beta }_k)$ reduces to ${\mathcal{O}}_{\sigma }(F_k;{\beta }_k)=\frac{S_{\sigma }-2}{2}-e^{-k}$. As $k\to \infty$, ${\mathcal{O}}_{\sigma }(F_k;{\beta }_k)=(S_{\sigma }-2)/2$ and so the quantity is eventually strictly positive provided $S_{\sigma }>2$, i.e., provided $\sigma$ violates the standard CHSH–Bell inequality.

Continuing our discussion on robustness, a different perspective on it would be to ask: given a PEF F with power $\beta >0$ optimised with respect to the distribution $\rho$, how far in terms of total-variation distance can another distribution $\sigma$ be such that the same PEF (with the same power) can be used to certify randomness? Theorem 7 provides a sufficient condition for the robustness of a positive, non-constant PEF $F=G^{\beta }$ with power $\beta$ in the following sense: assuming the log-prob rate of F at $\rho$ is positive, the log-prob rate of F at a different distribution $\sigma$ is positive if $d_{\mathrm{TV}}(\rho ,\sigma )$ is within a certain bound (as given in (34)). For the sequence ${\left\{F_k\right\}}_{k=1}^{\infty }$ of PEFs the upper bound on $d_{\mathrm{TV}}(\rho ,\sigma )$ is computed as follows: Notice that in the sequence ${\left\{F_k\right\}}_{k=1}^{\infty }$ of PEFs, $F_k$ is of the form $F_k=G_k^{{\beta }_k}$, where $G_k=2^{K_{*}-e^{-k}}$. The upper bound on $d_{\mathrm{TV}}(\rho ,\sigma )$ (as given in (34)) is then ${\mathbb{E}}_{\rho }\left[G_k\right]/(L-l)=\frac{1}{4}\left(\frac{S_{\rho }-2}{2}-e^{-k}\right)$. It is worthwhile to observe that, given a standard CHSH–Bell inequality violating distribution $\rho$, this upper bound approaches the strength of nonlocality for $\rho$ which is expressed as $(S_{\rho }-2)/8$. The strength of nonlocality is defined in terms of how far the nonlocal no-signalling distribution $\rho$ is from the local set ${\Pi }_{\mathrm{L}}$ [26]. It is defined as follows:

$$d_{\mathrm{NL}}\left(\rho \right) := \frac{1}{\left|\mathcal{X}\right|\left|\mathcal{Y}\right|}\frac{1}{2}\underset{\tau \in {\Pi }_L}{min}\sum _{abxy}\left|\rho \left(ab\right|xy)-\tau (ab\left|xy\right)\right|,$$

(43)

where the minimum is over all distributions $\tau$ belonging to the local set ${\Pi }_{\mathrm{L}}$. In the definition of $d_{\mathrm{NL}}\left(\rho \right)$ in (43) we have assumed a uniform settings distribution as is evident from the factor $1/\left|\mathcal{X}\right|\left|\mathcal{Y}\right|$, where $\left|\mathcal{X}\right|$ and $\left|\mathcal{Y}\right|$ denote the number of the measurement settings choices for Alice and Bob, respectively (which for the (2,2,2) Bell scenario is 2 for Alice and 2 for Bob). A theorem in [24] (see Theorem 3.1) provides a condition for the local distribution $\tau$ such that the minimum $(1/2){min}_{\tau \in {\Pi }_{\mathrm{L}}}{\sum }_{abxy}\left|\rho \left(ab\right|xy)-\tau (ab\left|xy\right)\right|$ in (43) is achieved and that the minimum comes out to be the weight $(S_{\rho }-2)/2$ on the PR box in the expression of $\rho$ as the convex combination of the vertices of ${\Delta }_{\mathrm{PR},1}^8$; and so per the definition in (43) $d_{\mathrm{NL}}\left(\rho \right)=(S_{\rho }-2)/8$. Thus, the bound $\frac{1}{4}\left(\frac{S_{\rho }-2}{2}-e^{-k}\right)$ from Theorem 7 approaches $\frac{S_{\rho }-2}{8}$ which is the strength of nonlocality $d_{\mathrm{NL}}\left(\rho \right)$ for $\rho$. This illustrates that a bound of this form cannot be improved, in the sense that increasing the total variation distance from $\rho$ by any positive amount will encompass local distributions which cannot certify randomness.

Thus, ${\left\{F_k\right\}}_{k=1}^{\infty }$ is fully robust as $k\to \infty$. Next, we confirm that ${\left\{F_k\right\}}_{k=1}^{\infty }$ is asymptotically optimal in terms of min-entropy per trial (i.e., log-prob rate), for any distribution $\sigma$ violating the standard CHSH inequality. Since ${\Pi }_{\mathrm{NS}}$ is closed and equal to the convex hull of its extremal points, Theorem 4 implies that, given such a $\sigma$, the adversary has a strategy obtained through an IID attack based on a single-trial distribution whose conditional Shannon entropy is equal to the infimum defined in (26). We can identify this attack. The optimisation in (26) can be expressed as follows:

$$h_{min}\left(\sigma \right)=min\left\{H_{\nu }(AB\left|XYE\right):{\nu }_e\in {\Pi }_{\mathrm{NS}},\sum _e\nu \left(e\right){\nu }_e=\sigma \right\},$$

(44)

where ${\nu }_e=\nu (ABXY\left|e\right)$. We compute $H_{\nu }\left(AB\right|XYE)$ for the decomposition of $\sigma$ given in (41), where we have noted ${\lambda }_{\mathrm{PR},1}=(S_{\sigma }-2)/2$. Since the conditional Shannon entropy is one for PR boxes and zero for LD behaviours, we obtain $H_{\nu }\left(AB\right|XYE)=(S_{\sigma }-2)/2$ and, hence, $h_{min}\left(\sigma \right)$ is no larger than this value. But since this expression is the same as that of the asymptotic log-prob rate of the sequence ${\left\{F_k\right\}}_{k=1}^{\infty }$ of valid PEFs, we can say $h_{min}\left(\sigma \right)$ is also no smaller than this value and so $h_{min}\left(\sigma \right)=(S_{\sigma }-2)/2$. This demonstrates the asymptotic optimality of the sequence ${\left\{F_k\right\}}_{k=1}^{\infty }$ in the sense that the PEFs in the sequence become arbitrarily close to certifying an asymptotic randomness rate of $h_{min}\left(\sigma \right)$.

In our proof of the asymptotic optimality of the sequence ${\left\{F_k\right\}}_{k=1}^{\infty }$, we identified the optimal attack by an adversary: it is to prepare the decomposition in (41) with each e corresponding to one of the (up to) nine extremal behaviours, with respective $\nu \left(e\right)$ weights of ${\lambda }_{\mathrm{PR},1}$ and ${\alpha }_i$. This can be seen to be the unique attack achieving $h_{min}\left(\sigma \right)$, through an argument we sketch as follows: (1) any $\nu$-decomposition of $\sigma$ can be improved upon (i.e., reducing $H_{\nu }\left(AB\right|XYE)$) by considering only extremal ${\nu }_e$, by the concavity of conditional Shannon entropy; (2) any decomposition including positive weights on more than one PR box can be strictly improved upon by one with weights on a single PR box, by Theorem 2.1 of [24], which shows how to replace equal mixtures of two PR boxes with mixtures of a single PR box and local deterministic distributions; (3) this decomposition can be further strictly improved via Theorem 2.2 of [24] by removing any local deterministic distributions not saturating the CHSH–Bell inequality with those that do (the improvement being obtained by decreasing the weight on the sole remaining PR box). The resulting decomposition—that of (41)—is thus the unique optimiser of (44). It witnesses the bound of $1+dim{\Pi }_{\mathrm{NS}}=1+8=9$ on the set $\mathcal{E}$ (as shown in Theorem 4). In general, positive weight on all nine extremal boxes may be necessary, due to their affine independence which was noted in Section 4.1. One can confirm this visually from Table 1: weight on the (only) nonlocal distribution, the PR box, is necessary to violate the CHSH–Bell inequality and any distribution with non-zero probabilities for each possible outcome (a property possessed by, for example, the quantum distribution saturating Tsirelson’s bound) will require positive weight on all the local deterministic behaviours, as each LD behaviour corresponds to a distinct sole appearance of the number “1” in a column otherwise populated by zeroes in Table 1. This witnesses that further reduction of the $1+dim{\Pi }_{\mathrm{NS}}$ bound on $\left|\mathcal{E}\right|$ in Theorem 4 is impossible and so this bound is optimal.

It is an important observation that the adversary needs to prepare only one non-classical state in her realisation of the optimal attack, since the preparation of a non-classical state is likely the most difficult aspect of the attack. We now explore possible generalisations of this feature to other trial models.

4.3. Characterising the Optimal Attack in Different Scenarios

We start by exploring the possibility of arriving at a similar analytic characterisation of the optimal adversarial attack when the adversary is limited to only quantum-realisable distributions. Suppose now that our trial model is the set ${\Pi }_{\mathrm{Q}}$ of quantum-achievable distributions for the (2,2,2) scenario. The adversary is still constrained to performing probabilistic attacks to simulate the trial statistics, while generating the least amount of randomness possible; however, she now tries to mimic the trial statistics using quantum-achievable distributions. The optimisation routine depicting this goal is:

$${\tilde{h}}_{min}\left(\sigma \right)=min\left\{H_{\omega }(AB\left|XYE\right):{\omega }_e\in {\Pi }_{\mathrm{Q}},\sum _e\omega \left(e\right){\omega }_e=\sigma \right\},$$

(45)

where ${\omega }_e=\omega (ABXY\left|e\right)$. The set ${\Pi }_{\mathrm{Q}}$ is compact and convex, but, unlike ${\Pi }_{\mathrm{NS}}$, is not a polytope and so there is a continuum of extremal points.

We conjecture that the minimum in (45) is achieved at a distribution that marginalises to the observed trial distribution through a convex combination of (only) one quantum extremal distribution violating the standard CHSH–Bell inequality and no more than eight local deterministic distributions that saturate the same inequality.

An attempt to prove this will require an understanding of the geometry of the quantum set and in particular its extremal points. We do not yet have a complete characterisation of the set of behaviours ${\Pi }_{\mathrm{Q}}$ (in the true ${\mathbb{R}}^8$ space), although a recent work has conjectured an analytic criterion for extremality in the CHSH scenario [27]. However, a characterisation does exist when we make the assumption of unbiased marginals: $\mu (A=0|x)=\mu (A=1\left|x\right)=1/2$ for all $x\in \{0,1\}$ and $\mu (B=0|y)=\mu (B=1\left|y\right)=1/2$ for all $y\in \{0,1\}$, in which case the set of behaviours is four dimensional. The unbiased marginal case has been completely characterised, a detailed exposition of which can be found in [25] (see Theorem 1 therein).

A key enabling step in the direction of characterising the optimal attack in the unbiased marginals case would be to see if the following two conditions hold simultaneously: first, a convex combination of any two extremal quantum behaviours can be expressed equivalently as a different convex combination of one extremal quantum behaviour (different from the previous two) and classical noise (mixtures of the local deterministic behaviours), i.e., for extremal quantum behaviours ${\overrightarrow{\mu }}_1,{\overrightarrow{\mu }}_2$, the convex combination $\lambda {\overrightarrow{\mu }}_1+(1-\lambda ){\overrightarrow{\mu }}_2$ can be re-expressed as the convex combination $\delta {\overrightarrow{\mu }}_3+(1-\delta ){\overrightarrow{\mu }}_0$, where $\lambda ,\delta \in (0,1)$, ${\overrightarrow{\mu }}_3$ is a third extremal quantum behaviour and ${\overrightarrow{\mu }}_0$ is a mixture of the local deterministic behaviours; and, second, $\lambda {\mathbb{H}}_{{\mu }_1}(AB\left|XY\right)+(1-\lambda ){\mathbb{H}}_{{\mu }_2}(AB\left|XY\right)⩾\delta {\mathbb{H}}_{{\mu }_3}(AB\left|XY\right)$, where the term $(1-\delta ){\mathbb{H}}_{{\mu }_0}\left(AB\right|XY)$ that might be expected to appear on the right vanishes due to the concavity of conditional Shannon entropy and the fact that it is zero for local deterministic behaviours, into which ${\overrightarrow{\mu }}_0$ can be decomposed.

A numerical inspection to check—by means of an exhaustive search—whether these two conditions hold simultaneously (in the uniform marginals case) introduces a lot of free variables. If we add more symmetry to the behaviours with uniform marginals and constrain ourselves to the two-dimensional slice as shown in Figure 4a, one can perform a numerical search to see whether the two conditions mentioned above hold simultaneously and we did observe it to hold in some initial numerical investigations comparing the $\overrightarrow{\theta }$ decompositions against the $\overrightarrow{\nu }$ decompositions as depicted in Figure 4b. The behaviours in the two-dimensional are represented by the formula:

$$\overrightarrow{\mu }=\frac{\mathcal{S}}{4}{\overrightarrow{\mu }}_{\mathrm{PR},1}+\frac{{\mathcal{S}}^{\prime }}{4}{\overrightarrow{\mu }}_{\mathrm{PR},2}+\left(1-\frac{\mathcal{S}+{\mathcal{S}}^{\prime }}{4}\right){\overrightarrow{\mu }}_0,\mathcal{S},{\mathcal{S}}^{\prime }\in [-4,4],$$

(46)

where ${\overrightarrow{\mu }}_0$ is the maximally random behaviour obtained as the equal mixtures of all 16 local deterministic behaviours. The disk ${\mathcal{S}}^2+{\left({\mathcal{S}}^{\prime }\right)}^2⩽8$ represents the set of quantum behaviours.

Table 3. Tabular representation of the no-signalling behaviours on the two-dimensional slice shown in Figure 4a. The behaviours have uniform marginals, i.e., the probability of observing an outcome conditioned on a measurement setting is $1/2$ for each party for all outcomes and settings. The behaviours are further constrained in having the third and fourth row completely determined by the first and second, which need not hold in general for uniform marginal distributions, and brings the dimensionality down from four to two. Any behaviour represented as above is parameterised as the values $\mathcal{S}$ and ${\mathcal{S}}^{{}^{\prime }}$ of the two versions of the CHSH–Bell expression $E_{00}+E_{01}+E_{10}-E_{11}$ and $-E_{00}+E_{01}+E_{10}+E_{11}$, respectively: $s_1=(4+\mathcal{S}-{\mathcal{S}}^{\prime })/16$, $s_2=(4+{\mathcal{S}}^{\prime }-\mathcal{S})/16$, $s_3=(4+\mathcal{S}+{\mathcal{S}}^{\prime })/16$, $s_4=(4-\mathcal{S}-{\mathcal{S}}^{\prime })/16$, where for the no-signalling set $-4⩽{\mathcal{S}}^{\prime }+\mathcal{S}⩽4,-4⩽{\mathcal{S}}^{\prime }-\mathcal{S}⩽4$ and for the quantum set ${\mathcal{S}}^2+{\left({\mathcal{S}}^{\prime }\right)}^2⩽8$.

		ab
		00	01	10	11
xy	00	$s_1$	$s_2$	$s_2$	$s_1$
	01	$s_3$	$s_4$	$s_4$	$s_3$
	10	$s_3$	$s_4$	$s_4$	$s_3$
	11	$s_2$	$s_1$	$s_1$	$s_2$

depicts a tabular representation of the behaviours expressible as (46). (As a side note, one way to add more symmetry to the behaviours with uniform marginals is as follows: a behaviour with uniform marginals can be completely specified by the correlators $(E_{00},E_{01},E_{10},E_{11})$, where $-1⩽E_{xy}⩽1,\forall x,y$; see the line following (37) for the definition of $E_{xy}$. To obtain behaviours in the two-dimensional slice as shown in Figure 4a one can restrict attention to distributions of the form $\mu (ab\left|xy\right)=\frac{1}{4}(1+{(-1)}^{a+b}{C}_{xy})$ where $C_{00}=-C_{11}=\frac{E_{00}-E_{11}}{2}$ and $C_{01}=C_{10}=\frac{E_{01}+E_{10}}{2}$.)

Going beyond the minimal Bell scenario, we considered the possibility of a similar characterisation of optimal no-signalling adversarial attack in higher $(n,m,k)$ Bell scenarios. In the (2,2,2) Bell scenario the analytical characterisation of the optimal adversarial attack crucially relied upon the geometric features of the no-signalling polytope, namely Theorems 2.1 and 2.2 in [24]: that equal mixtures of two PR behaviours are expressible as equal mixtures of four distinct LD behaviours and, consequently, a behaviour violating any of the eight versions (up to local relabelling of the outcomes and settings) of the CHSH–Bell inequality is expressible as a convex combination of the one PR behaviour achieving the nonlocal maximum and (up to) eight LD behaviours achieving the local maximum of the corresponding CHSH–Bell expression. These geometric features, however, do not extend to the no-signalling polytopes of higher $(n,m,k)$ Bell scenarios. Membership of equal mixtures of extremal no-signalling nonlocal behaviours in the local polytope holds solely in the (2,2,2) Bell scenario.

Below, we provide examples of equal mixtures of no-signalling nonlocal extremal behaviours in the $(2,2,3)$, $(2,3,2)$ and $(3,2,2)$ Bell scenarios that do not belong to the local polytope. One can use linear programming to check the nonlocality of such examples. Assessment of the locality of a behaviour is an instance of the membership problem of the local polytope. Since the local deterministic (LD) behaviours are the extremal points of the local polytope, we can formulate our problem as a feasibility linear program. Suppose $\left\{{\overrightarrow{\mu }}_{\mathrm{LD},1},{\overrightarrow{\mu }}_{\mathrm{LD},2},\dots ,{\overrightarrow{\mu }}_{\mathrm{LD},{\#}_{\mathrm{LD}}}\right\}$ is the set of LD behaviours for some Bell scenario. The vector ${\overrightarrow{\mu }}_{\mathrm{LD},i}\in {\mathbb{R}}^d$ denotes the joint probability of outcomes conditioned on the input choices and d is the dimension of the ambient space in which the vector lies. The feasibility linear program has the variable $\overrightarrow{x}\in {\mathbb{R}}^{{\#}_{\mathrm{LD}}}$. The inequality constraints comprise $x_i⩾0,i\in \left[{\#}_{\mathrm{LD}}\right]$ and the equality constraints are ${\sum }_{i=1}^{{\#}_{\mathrm{LD}}}{x}_i=1$ and the following:

$$\frac{1}{2}{\overrightarrow{\mathsf{NS}}}_{\mathrm{extr}}+\frac{1}{2}{\overrightarrow{{\mathsf{NS}}^{\prime }}}_{\mathrm{extr}}=\sum _{k=1}^{{\#}_{\mathrm{LD}}}{x}_k{\overrightarrow{\mu }}_{\mathrm{LD},k}$$

(47)

where ${\overrightarrow{\mathsf{NS}}}_{\mathrm{extr}}$ is a nonlocal no-signalling extremal behaviour. The details on formulating the dual of this linear program can be found in section E.2.1 of the Appendix of [6].

Before presenting the counter-examples we briefly review the $(n,m,k)$ Bell scenario: This scenario consists of n spatially separated parties, where each party $i\in \left[n\right]$ has a choice of m different k-outcome measurements. For $\mathcal{X}\equiv \{0,1,\dots ,m-1\}$ and $\mathcal{A}\equiv \{0,1,\dots ,k-1\}$ the joint probability $\mu (a_1{a}_2\dots a_n|x_1{x}_2\dots x_n)$ of obtaining the outcomes $(a_1,a_2,\dots ,a_n)\in {\mathcal{A}}^n$ conditioned on the inputs $(x_1,x_2,\dots ,x_n)\in {\mathcal{X}}^n$ can be viewed as a probability vector $\overrightarrow{\mu }\in {\mathbb{R}}^d$, where $d={\left(\left|\mathcal{A}\right|\left|\mathcal{X}\right|\right)}^n$.

The extremal points of the no-signalling polytope comprise the local deterministic (LD) behaviours and the nonlocal extremal behaviours. The LD behaviours consist of all possible assignments ${\Lambda }_{\mathrm{LD}}=\{{\left\{{\lambda }_{1x_1}\right\}}_{x_1\in \mathcal{X}};{\left\{{\lambda }_{2x_2}\right\}}_{x_2\in \mathcal{X}};\dots ;{\left\{{\lambda }_{n{x}_n}\right\}}_{x_n\in \mathcal{X}}\}$, where ${\lambda }_{i{x}_i}\in \mathcal{A}$ for $i\in \left[n\right]$. The number of such assignments is ${\#}_{\mathrm{LD}}={\left(\right|\mathcal{A}\left|\right)}^{n\left|\mathcal{X}\right|}$. Corresponding to each assignment $\lambda \in {\Lambda }_{\mathrm{LD}}$ the LD probabilities are expressed as

$${\mu }_{\mathrm{LD},k}(a_1{a}_2\dots a_n|x_1{x}_2\dots x_n)=\left[[a_1={\lambda }_{1x_1}]\right]\left[[a_{12}={\lambda }_{2x_2}]\right]\cdots \left[[a_n={\lambda }_{n{x}_n}]\right]$$

(48)

where $\left[\right[·\left]\right]$ is the function that evaluates to 1 if the condition within holds, 0 otherwise. A behaviour ${\overrightarrow{\mu }}_{\mathcal{L}}$ is local if it can be expressed as ${\overrightarrow{\mu }}_{\mathcal{L}}={\sum }_{k=1}^{{\#}_{\mathrm{LD}}}{q}_k{\overrightarrow{\mu }}_{\mathrm{LD},k}$, where $q_k⩾0$ and ${\sum }_{k=1}^{{\#}_{\mathrm{LD}}}{q}_k=1$.

$(2,2,3)$ Bell scenario: This scenario is an instance of the more general $(2,2,k)$ scenario, also known in the literature as the CGLMP scenario [28], for $k=3$. In this bipartite scenario the parties have two three-output choices of settings. The extremal behaviours for the no-signalling polytope for the CGLMP scenario have been fully described in [29]. The nonlocal no-signalling extremal behaviours for the $(2,2,3)$ scenario, up to relabelling of inputs and outcomes, are given by the following formula:

$${\mathsf{NL}}_{\mathrm{ext}}(ab\left|xy\right) := \left\{\begin{array}{cc}\frac{1}{3}\hfill & :b-a\equiv xy\left(\mathrm{mod}3\right)\hfill \\ 0\hfill & :\mathrm{otherwise}\hfill \end{array}\right.$$

(49)

where $a,b\in \{0,1,2\}$ and $x,y\in \{0,1\}$ are the outputs and inputs for the parties, respectively. We found that (47) does not necessarily hold for all equal mixtures of a pair of distinct nonlocal extremal behaviours. Among the several examples we found that violate (47),

Table 4. Two nonlocal extremal behaviours for the CGLMP scenario with 3 outcomes whose equal mixtures are nonlocal. The inputs $x,y\in \{0,1\}$ and the outcomes $a,b\in \{0,1,2\}$ with $x^{\prime }=x\oplus 1,y^{\prime }=y\oplus 1$ and $a^{\prime }=a{\oplus }_{3}1,a^{″}=a{\oplus }_{3}2,b^{\prime }=b{\oplus }_{3}1,b^{″}=b{\oplus }_{3}2$. The symbol ⊕ denotes addition modulo 2 and ${\oplus }_3$ denotes addition modulo 3. The missing entries correspond to 0. The top behaviour comes directly from (49) while the bottom behaviour is obtained through the relabelling $x\leftrightarrow x^{\prime }$ and $y\leftrightarrow y^{\prime }$. An equal mixture of these two boxes lies outside the local polytope.

	$\mathbf{ab}$	${\mathbf{ab}}^{\prime }$	${\mathbf{ab}}^{″}$	${\mathit{a}}^{\prime }\mathit{b}$	${\mathit{a}}^{\prime }{\mathit{b}}^{\prime }$	${\mathit{a}}^{\prime }{\mathit{b}}^{″}$	${\mathit{a}}^{″}\mathit{b}$	${\mathit{a}}^{″}{\mathit{b}}^{\prime }$	${\mathit{a}}^{″}{\mathit{b}}^{″}$
$xy$	$1/3$				$1/3$				$1/3$
$x{y}^{\prime }$	$1/3$				$1/3$				$1/3$
$x^{\prime }y$	$1/3$				$1/3$				$1/3$
$x^{\prime }{y}^{\prime }$		$1/3$				$1/3$	$1/3$
$xy$		$1/3$				$1/3$	$1/3$
$x{y}^{\prime }$	$1/3$				$1/3$				$1/3$
$x^{\prime }y$	$1/3$				$1/3$				$1/3$
$x^{\prime }{y}^{\prime }$	$1/3$				$1/3$				$1/3$

shows one such example.

$(2,3,2)$ Bell scenario: More generally, the extremal behaviours of $(2,k,2)$ no-signalling polytope, with $k>2$, have been completely characterised in [30,31], of which $(2,3,2)$ is an instance. Following Table II of [31], we can obtain

Table 5. Nonlocal no-signalling extremal behaviour with all input choices $x,y\in \{0,1,2\}$ for Alice and Bob having uniform probabilities of outcomes.

		y
		0		1		2
x	0	$1/2$	0	$1/2$	0	$1/2$	0
		0	$1/2$	0	$1/2$	0	$1/2$
	1	$1/2$	0	0	$1/2$	?
		0	$1/2$	$1/2$	0
	2	$1/2$	0	?		?
		0	$1/2$

and

Table 6. All inputs for Alice and inputs $y\in \{0,1\}$ for Bob have uniform probabilities of outcomes, while Bob’s outcome for $y=2$ is deterministic.

		y
		0		1		2
x	0	$1/2$	0	$1/2$	0	$1/2$	0
		0	$1/2$	0	$1/2$	$1/2$	0
	1	$1/2$	0	0	$1/2$	$1/2$	0
		0	$1/2$	$1/2$	0	$1/2$	0
	2	$1/2$	0	?		$1/2$	0
		0	$1/2$			$1/2$	0

which are two representative examples of nonlocal no-signalling extremal behaviours, equal mixtures of which lie outside the local polytope. In Table 5 all input choices, $x,y\in \{0,1,2\}$, for Alice and Bob have uniform probabilities of outcomes; in Table 6 all inputs for Alice and inputs $y\in \{0,1\}$ for Bob have uniform probabilities of outcomes, with the exception that Bob’s outcome for $y=2$ is deterministic.

$$\begin{array}{c}\_\\ \left|\begin{array}{cc}p\left(00\right|xy)& p\left(01\right|xy)\\ p\left(10\right|xy)& p\left(11\right|xy)\end{array}\right|\\ \_\end{array}\hspace{1em}\mathrm{with}\hspace{1em}\begin{array}{c}\_\\ \left|\begin{array}{cc}?& \\ & \end{array}\right|\\ \_\end{array}\equiv \begin{array}{c}\_\\ \left|\begin{array}{cc}1/2& 0\\ 0& 1/2\end{array}\right|\\ \_\end{array}\mathrm{or}\begin{array}{c}\_\\ \left|\begin{array}{cc}0& 1/2\\ 1/2& 0\end{array}\right|\\ \_\end{array}$$

There are 16 possible mixtures of the two behaviours in Table 5 and Table 6 corresponding to each ‘?’ in each table being a perfect correlation or a perfect anti-correlation, all of which represent mixtures of extremal nonlocal boxes [31] and all lie outside the local polytope. The nonlocality of the mixtures is confirmed by noting that the four cells in the upper left corner, corresponding to restricting the settings choices to $x,y\in \{0,1\}$, is the PR box distribution which is of course nonlocal.

$(3,2,2)$ Bell scenario: This is a tripartite scenario with each party having binary input choices and outcomes. The no-signalling polytope consists of 46 inequivalent classes of extremal behaviours, of which one is the class comprising 64 LD behaviours. A complete characterisation can be found in [32]. As an example violating (47) we can refer to the observation made in Section 2.3 of [32] that equal mixtures of two behaviours in Class 46 (see Table 1 of [32]) are a GHZ correlation which is expressed (entirely in terms of correlators $\langle A_x{B}_y{C}_z\rangle$) as $P_{\mathrm{GHZ}}(abc\left|xyz\right)=\frac{1}{8}(a+abc\langle A_x{B}_y{C}_z\rangle )$. ${\overrightarrow{P}}_{\mathrm{GHZ}}$ is a nonlocal behaviour which is obtained by measuring $\frac{1}{\sqrt{2}}(000+111)$ in suitable local bases [33].

5. Conclusions

In this work, we revisited the probability estimation framework with the goal of presenting a complete and self-contained proof of its optimality in the asymptotic regime and obtaining a better characterisation of optimal adversarial attack strategies on the protocol. We obtained in Theorem 4 an improved and tight upper bound on the cardinality of the set of states needed in the optimal attack, and studied the implications of this result for specific scenarios in Section 4. We also considered the question of robustness for the PEF method, finding that asymptotic optimality of PEFs (in terms of randomness generation rate) need not entail a trade-off with robustness to small deviations from expected experimental behaviour.

In proving the optimality of the framework, our results show that there remains nothing to be gained, asymptotically, for an adversary implementing memory attacks—an i.i.d. attack is asymptotically optimal. However, in real world applications this may not hold. The number of trials in a Bell experiment is finite, albeit large, and there are unavoidable correlations between the successive trials (referred to as memory effects). We leave to future work considerations of side-channel attacks in the non-asymptotic (finite trials) regime for the probability estimation framework.