Optimal randomness certification in the quantum steering and prepare-and-measure scenarios

The scenario we treat in this work is the following [11]: two parties, Alice and Bob, are located in distant laboratories and receive a bipartite system from a source. One of the two parties, say Alice, does not trust her measuring devices, which are treated as 'black boxes'. She can, nevertheless, choose which measurement to perform, which she labels by $x\in \{0,\ldots ,{m}_{{\rm{A}}}-1\},$ each of which provides an outcomes, which she labels $a\in \{0,\ldots ,{n}_{{\rm{A}}}-1\}.$ The other party, Bob, has complete knowledge of his device, which allows him to perform quantum state tomography on his part of the system, and thus to obtain a complete description of his subsystem (see figure 1(a)). The states reconstructed by Bob will usually depend on Alice's input and output as ${\rho }_{a| x}\;=\;$ ${\mathrm{Tr}}_{{\rm{A}}}[({M}_{a| x}\otimes {{\mathbb{1}}}_{{\rm{B}}}){\rho }_{\mathrm{AB}}]/P(a| x),$ where ρ_AB is the unknown state shared with Alice, $P(a| x)$ is the probability that Alice observes outcome a given she chose x, and ${M}_{a| x}$ is the corresponding (unknown) element of Alice's measurement. The set of unnormalized states ${\sigma }_{a| x}={\mathrm{Tr}}_{{\rm{A}}}[({M}_{a| x}\otimes {{\mathbb{1}}}_{{\rm{B}}}){\rho }_{\mathrm{AB}}]={\rho }_{a| x}P(a| x)$ is called an assemblage and can be completely determined by Bob through tomographic measurements.

As noticed in [11], Bob can determine if ${\rho }_{\mathrm{AB}}$ is entangled by looking at the form of the assemblage ${\{{\sigma }_{a| x}\}}_{a,x}.$ This is because separable states can only lead to assemblages with the specific form

$$\begin{eqnarray}&&{\sigma }_{a| x}=\displaystyle \sum _{\lambda }q(\lambda )P(a| x,\lambda ){\sigma }_{\lambda },\end{eqnarray} \tag{ 1 }$$

where λ is a hidden variable distributed according to $q(\lambda ),$ which determines both Alice's response $P(a| x,\lambda ),$ and the states sent to Bob, σ_λ. Assemblages of this form are said to have a local hidden state model. Any assemblage which does not have this form can be detected through the violation of a steering inequality [29] (similar to a Bell inequality or an entanglement witness) or a simple semi-definite program [30].

It turns out that the confirmation of steering not only guarantees that the shared state is entangled, but also that Alice is performing incompatible measurements [31, 32]. It is thus very intuitive to expect a relation between steering and randomness: first, the correlations (entanglement) shared between Alice and Bob allows Bob to certify steering, and consequently the incompatibility of Alice's measurements. Second, since Alice's measurements are incompatible not all the outcomes she receives are predictable, and thus random.

In order to certify the local randomness of Alice's outcomes we work in the adversarial scenario, where a potential eavesdropper, Eve, wants to predict them. This framework is relevant for cryptographic tasks, namely ISDIQKD. In the most general case, we do not make any assumption on Alice's measurement device, so that it could even have been provided by Eve. We also consider that the state ${\rho }_{\mathrm{AB}}$ is the reduced state of a tripartite entangled state ${\rho }_{\mathrm{ABE}}$ shared by Alice, Bob and Eve, i.e. ${\rho }_{\mathrm{AB}}={\mathrm{Tr}}_{{\rm{E}}}[{\rho }_{\mathrm{ABE}}].$ Hence, by applying measurements to her subsystem Eve can in principle obtain information about Alice's outcome.

In this section we will focus on the case where Alice and Bob want to extract randomness from the outcomes of a single given measurement of Alice, let us say ${x}^{*}\in \{0,\ldots ,{m}_{A}-1\}.$ The motivation for considering this case is that it is the relevant one from the perspective of 1SDIQKD. We assume that the runs of the experiment are independent and identically distributed with respect to Eve's strategy⁵ . We consider the case where Eve also knows from which measurement ${x}^{*}$ Alice is going to extract randomness, so she can optimize her attack to obtain information about this measurement setting. The figure of merit we use to evaluate the amount of randomness in Alice's outcomes is the probability that Eve can correctly guess the outcome a of the measurement ${x}^{*}$ of Alice. This quantity, denoted by ${P}_{\mathrm{guess}}({x}^{*}),$ is given by the probability that Eve's guess e is equal to the outcome a that Alice obtained, whenever Alice performs the specific measurement $x={x}^{*}:$

$$\begin{eqnarray}&&{P}_{\mathrm{guess}}({x}^{*})=\displaystyle \sum _{e}{P}_{{\rm{A}}}(a=e| {x}^{*})\;{P}_{{\rm{E}}}(e| a=e,x={x}^{*}).\end{eqnarray} \tag{ 2 }$$

Applying Bayes theorem, this is equivalent to ${P}_{\mathrm{guess}}({x}^{*})={\displaystyle \sum }_{e}{P}_{\mathrm{AE}}(a=e,e| x={x}^{*}),$ i.e. equal to the joint probability that Alice and Eve give the same outcome whenever Alice measures $x={x}^{*}.$ Randomness is certified whenever the guessing probability is strictly less than 1, in which case Eve can not predict Alice's outcome with certainty.

After Alice and Eve have applied their measurements the assemblage prepared will be

$$\begin{eqnarray}&&{\sigma }_{a| x}^{e}={\mathrm{Tr}}_{\mathrm{AE}}[({M}_{a| x}\otimes {{\mathbb{1}}}_{{\rm{B}}}\otimes {M}_{e})\;{\rho }_{\mathrm{ABE}}],\end{eqnarray} \tag{ 3 }$$

where M_e is the element of Eve's (optimal) measurement which yields outcome $e\in \{0,\ldots ,{n}_{{\rm{A}}}-1\}.$ However, since Alice and Bob do not have access to Eve's outcomes the assemblage they will reconstruct will be given by

$$\begin{eqnarray}&&{\sigma }_{a| x}^{\mathrm{obs}}=\displaystyle \sum _{e}{\sigma }_{a| x}^{e}.\end{eqnarray} \tag{ 4 }$$

In order to compute the optimal strategy for Eve we need to maximize her guessing probability (for a given input ${x}^{*}$ of Alice), over all strategies. Naively, this would appear to constitute optimizing the triple $\{{\rho }_{\mathrm{ABE}},{M}_{a| x},{M}_{e}\},$ of state, measurements for Alice, and measurement for Eve, a nonlinear optimization problem. However, just as in the DI case [25, 26], we can instead replace this by an equivalent linear optimization over all physical assemblages $\{{\sigma }_{a| x}^{e}\}{}_{a,e,x}$ that are compatible with the no-signalling principle and the observed assemblage $\{{\sigma }_{a| x}^{\mathrm{obs}}\}{}_{a,x}.$ More precisely, the maximization problem can be formulated as the following semidefinite programme (SDP) [33]:

$$\begin{eqnarray}\underset{\{{\sigma }_{a| x}^{e}\}{}_{a,e,x}}{\mathrm{max}} & {P}_{\mathrm{guess}}({x}^{*})=\displaystyle \sum _{e}\mathrm{Tr}({\sigma }_{a=e| {x}^{*}}^{e}) & \\ \mathrm{subject}\ \mathrm{to} & \displaystyle \sum _{e}{\sigma }_{a| x}^{e}={\sigma }_{a| x}^{\mathrm{obs}} & \forall a,x\\ & \displaystyle \sum _{a}{\sigma }_{a| x}^{e}=\displaystyle \sum _{a}{\sigma }_{a| {x}^{\prime }}^{e} & \forall e,x\ne {x}^{\prime }\\ & {\sigma }_{a| x}^{e}\succcurlyeq 0 & \forall a,x,e.\end{eqnarray} \tag{ 5 }$$

In the objective function we used ${P}_{{\rm{E}}}(e){P}_{{\rm{A}}}(a| x,e)=P({ae}| x)=\mathrm{Tr}[{\sigma }_{a| x}^{e}]$ to re-express ${P}_{\mathrm{guess}}({x}^{*}).$ The first constraint assures that the decomposition for Eve is compatible with the assemblage Alice and Bob observe. The second constraint is the non-signalling condition—i.e. Alice cannot signal to Bob and to Eve. The last one is the requirement for every ${\sigma }_{a| x}^{e}$ to be a valid (unnormalized) quantum state. We defer to the appendix the full proof that this optimization problem is equivalent to optimizing over states and measurements, which follows from the Gisin–Hughston–Jozsa–Wootters (GHJW) theorem [34] (which shows that all bipartite no-signalling assemblages have quantum realizations), combined with the fact that Eve, making only one measurement, also cannot signal.

Notice that the SDP (5) can be seen as the steering analogue of the SDP provided in [25, 26] which bounds the amount of randomness given an observed nonlocal probability distribution ${P}_{\mathrm{obs}}({ab}| {xy}).$ As mentioned before, the SDP (5) provides an upper bound on the amount of randomness (i.e. a lower bound on the P_guess) that can be found using the SDP of [25, 26]. This follows because (5) does not allow Eve to attack the measurements of Bob. Thus, our SDP bounds the maximal amount of randomness that could be obtained if Bob were to perform any number of measurements (that Eve can attack) and compute the randomness based on the obtained probability distribution. The number of random bits is quantified by the min-entropy ${H}_{\mathrm{min}}(A| X)=-{\mathrm{log}}_{2}{P}_{\mathrm{guess}}^{*}({x}^{*}),$ where ${P}_{\mathrm{guess}}^{*}({x}^{*})$ is the result of the maximization (5).

Zoom In Zoom Out Reset image size

In figure 2 we plot the amount of randomness certified in the case that Alice applies two mutually unbiased Pauli spin measurements on a two-qubit Werner state ${\rho }_{\mathrm{AB}}\;=\;$ $v| {{\rm{\Phi }}}_{+}\rangle \langle {{\rm{\Phi }}}_{+}| +(1-v){\mathbb{1}}/4,$ where $| {{\rm{\Phi }}}_{+}\rangle =(| 00\rangle +| 11\rangle )/\sqrt{2},$ and compare it with the amount of randomness obtained in the case Bob also treats his measuring device as a black box (i.e. the fully DI case). In both cases randomness can be certified as long as $v\gt 1/\sqrt{2},$ which is the critical amount of noise for demonstrating either steering or nonlocality with only two measurements [35]. All numerical SDP calculations were performed using the cvx package for matlab [36], along with the library qetlab [37].

Zoom In Zoom Out Reset image size

In figure 3 we also compute the amount of randomness that can be obtained by measuring the same spin measurements with detection efficiency η (for visibility v = 1 and v = 0.9), again comparing to the case where Bob treats his measuring device as a black box. That is, (for steering) instead of ideal measurements, with elements ${M}_{a| x},$ we consider inefficient measurements ${M}_{a| x}^{(\eta )},$ with one additional outcome $a=\varnothing ,$ given by

$$\begin{eqnarray}{M}_{a| x}^{(\eta )}=\left\{\begin{array}{ll}\eta {M}_{a| x}, & \qquad a\ne \varnothing \\ (1-\eta ){\mathbb{1}}, & \qquad a=\varnothing \end{array}\right.\end{eqnarray} \tag{ 6 }$$

(the measurements of Bob are similarly made inefficient in the nonlocality scenario).

Zoom In Zoom Out Reset image size

In this case, two comparisons are made: (i) the case where Bob's detection efficiency is 1; and (ii) where Bob also has detection efficiency η. As one can see, for v = 1 in the steering scenario randomness can be certified whenever the detection efficiency is higher than 50%, matching the threshold below which no randomness can be obtained [38]. Moreover, we see that due to the much larger detection efficiencies needed to violate the CHSH inequality (82.8%) and for the DI case where Bob's measuring device is perfectly efficient (70.7%), the steering scenario offers a significant advantage when using the maximally entangled state over the nonlocality scenario, for the entire range of visibility which is experimentally significant (i.e. for v = 0.9 and above).

Finally, in figure 4 we plot the number of random bits certified in the case that Alice performs measurements in four mutually unbiased bases on her half of the entangled two-qutrit state $(| 00\rangle +| 11\rangle +| 22\rangle )/\sqrt{3}$ in the presence of losses. Again, we see that whenever the detection efficiency is above 50% Alice is able to certify local randomness. Moreover, for efficiency η = 1 she certifies ${H}_{\mathrm{min}}={\mathrm{log}}_{2}3$ bits of randomness.

Zoom In Zoom Out Reset image size

In the steering scenario one can also consider global randomness extraction from both the untrusted and trusted devices. Indeed, even though Bob trusts his devices, and knows which measurement he performs, there is still an optimal state that Eve can distribute which allows her to predict the outcome of Bob's measurement. This is because although Eve is not able to change the measurements performed by Bob, nor his reduced state, she still has additional classical side information that she can use to help her in guessing the result of Bob (since she holds the source).

Consider that, additionally to Alice's measurement $x={x}^{*},$ Eve wants to guess the outcomes of a measurement M_b performed by Bob. Eve now has a pair of guesses $(e,{e}^{\prime }),$ which will be her guess for the pair $(a,b).$ She will thus perform a measurement with elements ${M}_{{{ee}}^{\prime }}$ on her share of the state, which after Alice also measures will lead to the assemblage for Bob ${\sigma }_{a| x}^{{{ee}}^{\prime }}={\mathrm{tr}}_{\mathrm{AE}}[({M}_{a| x}\otimes {{\mathbb{1}}}_{{\rm{B}}}\otimes {M}_{{{ee}}^{\prime }}){\rho }_{\mathrm{ABE}}].$ Similarly to the case of local randomness, the global guessing probability P_g can straightforwardly be shown to be the solution to the following SDP

$$\begin{eqnarray}{P}_{{\rm{g}}}=\;\mathrm{max} & \displaystyle \sum _{{{ee}}^{\prime }}\mathrm{Tr}[{M}_{b={e}^{\prime }}{\sigma }_{a=e| {x}^{*}}^{{{ee}}^{\prime }}] & \\ {\rm{s.t.}} & \displaystyle \sum _{{{ee}}^{\prime }}{\sigma }_{a| x}^{{{ee}}^{\prime }}={\sigma }_{a| x}^{\mathrm{obs}}, & \forall a,x\\ & \displaystyle \sum _{a}{\sigma }_{a| x}^{{{ee}}^{\prime }}=\displaystyle \sum _{a}{\sigma }_{a| {x}^{\prime }}^{{{ee}}^{\prime }}, & \forall x\ne {x}^{\prime },a,e,{e}^{\prime }\\ & {\sigma }_{a| x}^{{{ee}}^{\prime }}\succcurlyeq 0, & \forall a,x,e,{e}^{\prime }.\end{eqnarray} \tag{ 7 }$$

We again require consistency with the observed assemblage ${\sigma }_{a| x}^{\mathrm{obs}},$ and demand positivity and no-signalling.

We computed the global randomness which can be certified without losses assuming X and Z measurements for Alice, and an X measurement for Bob, on two-qubit Werner states. The results can be seen in figure 5, alongside the corresponding curve calculated using the method of [25, 26] for the nonlocality scenario. As a result, we observe that the lower bound on the amount of global randomness that can be extracted in the steering scenario presented in [14] is tight.

Zoom In Zoom Out Reset image size

Up to now we have considered the steering scenario, where Alice and Bob receive an unknown state ${\rho }_{\mathrm{AB}}$ from an untrusted source. It turns out that the results on local randomness straightforwardly apply to the case where Bob prepares a known state and sends half of it to Alice (see figure 1(b)). In this case, since the global state ${\rho }_{\mathrm{AB}}$ is known, the assemblages reconstructed by Bob have to come from unknown measurements on this state, i.e. ${\sigma }_{a| x}={\displaystyle \sum }_{e}{\mathrm{Tr}}_{{\rm{A}}}[({M}_{a| x}^{e}\otimes {{\mathbb{1}}}_{{\rm{B}}}){\rho }_{\mathrm{AB}}].$ Thus the SDP (5) can be replaced by

$$\begin{eqnarray}\underset{\{{M}_{a| x}^{e}\}{}_{a,e,x}}{\mathrm{max}} & {P}_{\mathrm{guess}}({x}^{*})=\displaystyle \sum _{e}\mathrm{Tr}[({M}_{a=e| {x}^{*}}^{e}\otimes {{\mathbb{1}}}_{{\rm{B}}}){\rho }_{\mathrm{AB}}] & \\ \mathrm{subject}\ \mathrm{to} & \displaystyle \sum _{e}{\mathrm{Tr}}_{{\rm{A}}}[({M}_{a| x}^{e}\otimes {{\mathbb{1}}}_{{\rm{B}}}){\rho }_{\mathrm{AB}}]={\sigma }_{a| x}^{\mathrm{obs}} & \forall a,x\\ & \displaystyle \sum _{a}{M}_{a| x}^{e}=\displaystyle \sum _{a}{M}_{a| {x}^{\prime }}^{e} & \forall {x}^{\prime }\ne x,e\\ & \displaystyle \sum _{a,e}{M}_{a| x}^{e}={\mathbb{1}} & \forall x\\ & {M}_{a| x}^{e}\succcurlyeq 0 & \forall a,x,e.\end{eqnarray} \tag{ 8 }$$

This SDP can be understood as the maximization of Eve's guessing probability over all possible POVM measurements (where the outcome e goes to Eve and the outcome a goes to Alice), with Eve oblivious of x, that can be applied to the state ${\rho }_{\mathrm{AB}},$ given the observation of the assemblage $\{{\sigma }_{a| x}^{\mathrm{obs}}\}{}_{a,x}.$ A derivation of this SDP can be found in appendix B. We note that this scenario can also be thought of as the 'time-like steering' scenario introduced in [39].

We used the above program to calculate the amount of randomness that can be obtained from the two qubit Werner state, and from the isotropic two-qutrit state ${\rho }_{\mathrm{AB}}=v| {{\rm{\Phi }}}_{+}^{(3)}\rangle \langle {{\rm{\Phi }}}_{+}^{(3)}| +(1-v){\mathbb{1}}/9,$ where $| {{\rm{\Phi }}}_{+}^{(3)}\rangle =(| 00\rangle +| 11\rangle +| 22\rangle )/\sqrt{3}.$ In both cases we consider that Alice performs two mutually unbiased measurements (Pauli X and Z for qubits, and their generalization for qutrits).

For the case of no-losses, we observe that the amount of randomness that can be extracted is independent of the visibility v, and equal to 1 bit and 1 trit = ${\mathrm{log}}_{2}(3)$ bits respectively⁶ . This coincides with the amount which is obtained in the steering scenario for v = 1, i.e. the ideal case. This demonstrates that if knowledge of the state is assumed, then the lack of visibility cannot be used by Eve to guess the outcomes of Alice's measurements.

Turning to the case of losses, consistent with the above, we observe that, independent of the visibility, the dependence of the randomness on the loss coincides with that found in the steering scenario for perfect visibility. That is, the solid black curves in figures 3 and 4 are obtained, for any fixed value of the visibility v.

This shows that the prepare-and-measure scenario greatly improves over the steering scenario when considering lack of visibility (i.e. noise) on the state.

The SDP (5) provides a way of quantifying the randomness in Alice's outcomes given the observation of a given assemblage. A natural question is, given a fixed state distributed between Alice and Bob and a fixed number of measurements for Alice, what is the best scheme they can implement (i.e. the best choice of measurements) which allows for the certification of the most randomness.

Here we propose a numerical see-saw method that, starting from an initial amount of certified randomness, seeks for measurement schemes that lead to higher randomness certification. We focus on the case of local randomness. A similar scheme can also be implemented for global randomness.

Every SDP has a dual program, also an SDP, that can be obtained through the theory of Lagrange multipliers [33]. The dual of (5) is equivalent to

$$\begin{eqnarray}&&\underset{{\{{F}_{a| x}\}}_{a,x}}{\mathrm{min}}\qquad \displaystyle \sum _{a,x}\mathrm{Tr}({F}_{a| x}\;{\sigma }_{a| x}^{\mathrm{obs}})\\ &&\mathrm{subject}\ \mathrm{to}\qquad \mathrm{Tr}[{\sigma }_{{a}^{\prime }| {x}^{*}}]\leqslant \displaystyle \sum _{a,x}\mathrm{Tr}({F}_{a| x}{\sigma }_{a| x})\qquad \forall {a}^{\prime },{\sigma }_{a| x},\end{eqnarray} \tag{ 9 }$$

where in the constraint, $\forall {\sigma }_{a| x}$ should be understood as for all non-signalling assemblages, i.e. those satisfying ${\displaystyle \sum }_{a}{\sigma }_{a| x}={\displaystyle \sum }_{a}{\sigma }_{a| {x}^{\prime }}$ for all⁷ ${x}^{\prime }\ne x$. Since strong duality holds, the optimal value of this optimization problem is equal to the optimal value of (5), i.e. ${P}_{\mathrm{guess}}^{*}({x}^{*})={\displaystyle \sum }_{a,x}\mathrm{Tr}({F}_{a| x}^{*}\;{\sigma }_{a| x}^{\mathrm{obs}}).$ Moreover, it outputs the coefficients ${F}_{a| x}^{*}$ of the optimal steering inequality that gives the tight upper bound on ${P}_{\mathrm{guess}}^{*}({x}^{*}).$

Once we have solved the dual problem (9) we can run a second SDP that optimizes the violation of the steering inequality ${\displaystyle \sum }_{a,x}\mathrm{Tr}({F}_{a| x}^{*}\;{\sigma }_{a| x})$ over Alice's measurements ${\{{M}_{a| x}\}}_{{ax}}:$

$$\begin{eqnarray}\underset{{\{{M}_{a| x}\}}_{{ax}}}{\mathrm{min}} & \displaystyle \sum _{{ax}}\mathrm{Tr}[({M}_{a| x}\otimes {F}_{a| x}){\rho }_{{AB}}] & \\ \mathrm{subject}\ \mathrm{to} & \displaystyle \sum _{a}{M}_{a| x}={\mathbb{1}} & \forall x\\ & {M}_{a| x}\succcurlyeq 0 & \forall a,x.\end{eqnarray} \tag{ 10 }$$

The solution of this optimization problem provides the measurements for Alice that allow for the certification of the most randomness using the steering inequality provided by the first SDP.

At this point, one can perform a see-saw iteration of the two SDPs in order to obtain the maximal randomness that can be certified from a given state, along with the optimal steering inequality and measurements ${M}_{a| x}.$ For every given initial state, the SDP (5) (and its dual (9)) gives the best inequality to certify randomness from an assemblage, while the SDP (10) gives the best set of measurements—and therefore the best assemblage—for a given steering inequality.

In figure 6 we plot the result of this see-saw iteration, starting from two randomly chosen projective measurements, for η = 1 and η = 0.9, for the two-qubit partially entangled state $| \psi \rangle =\mathrm{cos}\theta | 00\rangle +\mathrm{sin}\theta | 11\rangle .$ When there are no losses, one bit of randomness is already known to be possible from any partially entangled state in the fully DI scenario [40]. Since this scenario is more demanding, it implies one bit can also be obtained from any partially entangled state of two qubits in the steering scenario. If the method works it should be able to reproduce this result. As can be seen, 1 bit of randomness is indeed found, thus demonstrating the utility of the method.

Zoom In Zoom Out Reset image size

Further exploration showed numerically that the measurements which achieve 1 bit of randomness from any partially entangled state can always be taken to be X and Z measurements for Alice (with the randomness obtained from the X measurement)⁸ .

In the appendix we show that this numerical evidence can in fact be turned into an analytic construction, which proves that 1 bit can be obtained from any partially entangled state of two qubits (which is notably completely different to the approach used in [40] for nonlocality). Moreover, the construction generalizes to qudits in a straightforward manner, showing that 1 dit of randomness can be obtained by performing two generalized Pauli measurements on any Schmidt-rank d state. This is contrary to the fully DI case, where it is only known how to extract 1 bit from any pure partially entangled state.

We have presented a method that certifies the optimal amount of local or global randomness that can be extracted in a steering experiment. We also considered the case where the source is trusted (prepare-and-measure scenario). Our method relies on optimization techniques that quantify the amount of certified randomness and provide the optimal steering inequality for randomness certification. Applying this method to realistic implementations—i.e. in presence of noise and losses—we have shown that a detection efficiency above 50% is sufficient to have reliable local randomness certification in the steering scenario. This result is also valid for DI randomness certification and, in general, in scenarios with lower levels of trust.

Finally, we have introduced a method which produces, for any given initial state, the optimal measurements which in turn give the optimal assemblage from which maximal randomness can be certified. Using this method as a starting point, we have shown analytically that 1 dit of randomness can be obtained from any pure entangled Schmidt-rank d state.

Since local randomness certification is of fundamental importance for 1SDI and DI QKD, the results presented here have a natural application in cryptographic protocols.

We thank R Rabelo for discussions on randomness in an early stage of this project. This work was supported by the Beatriu de Pinós fellowship (BP-DGR 2013),the Marie Curie COFUND action through the ICFOnest program, the ERC CoG QITBOX, the ERC AdG NLST, the EU project SIQS, the Spanish project FOQUS, the Generalitat de Catalunya (SGR875) and the John Templeton Foundation. EP acknowledges the Max Planck Institute for Quantum Optics for hospitality.

In this appendix we will show how to arrive at the SDP (5) for Eve's guessing probability.

The most general attack that Eve can implement in the case that she is interested in guessing the result of a single measurement ($x={x}^{*}$) Alice, is to distribute a state ${\rho }_{\mathrm{ABE}}$ to Alice and Bob (keeping a part for herself) on which she will perform a measurement with POVM elements M_e, for $e=0,\ldots ,{m}_{{\rm{A}}}-1,$ and distribute to Alice a set of measuring devices which implement the POVMs with elements ${M}_{a| x},$ for $x=0,\ldots ,{n}_{{\rm{A}}}-1$ and $a=0,\ldots ,{m}_{{\rm{A}}}-1.$ When Eve obtains outcome e from her measurement she will give this as her guess for the outcome of Alice. Thus, the guessing probability of Eve is given by

$$\begin{eqnarray}&&{P}_{\mathrm{guess}}({x}^{*})=\displaystyle \sum _{e}\mathrm{Tr}[({M}_{a=e| {x}^{*}}\otimes {M}_{e}){\rho }_{\mathrm{AE}}].\end{eqnarray} \tag{ A.1 }$$

Alice and Bob can however determine the assemblage ${\sigma }_{a| x}^{\mathrm{obs}}$ that they hold, (i.e. the set of conditional states prepared for Bob, along with the corresponding probabilities). Thus the optimization problem we need to solve is given by

$$\begin{eqnarray}&&\underset{{\rho }_{\mathrm{ABE}},{\{{M}_{a| x}\}}_{a,x},{\{{M}_{e}\}}_{e}}{\mathrm{max}}\quad \displaystyle \sum _{e}\mathrm{Tr}[({M}_{a=e| {x}^{*}}\otimes {M}_{e}){\rho }_{\mathrm{AE}}]\\ &&\quad \mathrm{subject}\ \mathrm{to}\quad {\mathrm{Tr}}_{{\rm{A}}}[({M}_{a| x}\otimes {{\mathbb{1}}}_{{\rm{B}}})\;{\rho }_{\mathrm{AB}}]={\sigma }_{a| x}^{\mathrm{obs}},\forall a,x\\ &&{\rho }_{\mathrm{ABE}}\succcurlyeq 0,\quad \mathrm{Tr}{\rho }_{\mathrm{ABE}}=1\\ &&{M}_{a| x}\succcurlyeq 0,\forall a,x\quad \displaystyle \sum _{a}{M}_{a| x}={\mathbb{1}},\forall x\\ &&{M}_{e}\succcurlyeq 0,\forall e\quad \displaystyle \sum _{e}{M}_{e}={\mathbb{1}}.\end{eqnarray} \tag{ A.2 }$$

Here, the first constraint is the consistency with the observed assemblage, the second constraints demand that ${\rho }_{\mathrm{ABE}}$ is a valid quantum state and the third and fourth constraints that the measurements ${M}_{a| x}$ and M_e are valid POVMs.

Defining now the joint assemblage for Alice, Bob and Eve

$$\begin{eqnarray}&&{\sigma }_{a| x}^{e}={\mathrm{Tr}}_{\mathrm{AE}}[({M}_{a| x}\otimes {{\mathbb{1}}}_{{\rm{B}}}\otimes {M}_{e})\;{\rho }_{\mathrm{ABE}}],\end{eqnarray} \tag{ A.3 }$$

it is straightforward to see that all of the constraints appearing in (5) are satisfied whenever the constraints in (A.2) are satisfied, and that the objective functions match. Thus it is straightforward to see that the optimization problem (5) is at least a relaxation of (A.2). What we will show now is that they are in fact equivalent optimization problems by showing that any solution to (5) also implies a solution to (A.2).

First of all, consider an assemblage ${\sigma }_{a| x}^{e}$ satisfying all of the constraints in (5). For a fixed e, we can define⁹ ${P}_{{\rm{E}}}(e)={\displaystyle \sum }_{a}\mathrm{Tr}{\sigma }_{a| x}^{e}$, and ${\tilde{\sigma }}_{a| x}^{e}={\sigma }_{a| x}^{e}/{P}_{{\rm{E}}}(e).$ This has the following properties

$$\begin{eqnarray}&&\displaystyle \sum _{a}{\tilde{\sigma }}_{a| x}^{e}=\displaystyle \sum _{a}{\tilde{\sigma }}_{a| {x}^{\prime }}^{e}\quad \forall e,x\ne {x}^{\prime },\quad \quad \mathrm{Tr}\displaystyle \sum _{a}{\tilde{\sigma }}_{a| x}^{e}=1\quad \forall e\end{eqnarray} \tag{ A.4 }$$

which show that for each e, ${\tilde{\sigma }}_{a| x}^{e}$ is a valid assemblage [30]. From the GHJW theorem [34] it therefore follows that there is a quantum state ${\rho }_{\mathrm{AB}}^{e}$ and POVM elements ${M}_{a| x}^{e}$ such that

$$\begin{eqnarray}&&{\mathrm{Tr}}_{{\rm{A}}}[({M}_{a| x}^{e}\otimes {{\mathbb{1}}}_{{\rm{B}}}){\rho }_{\mathrm{AB}}^{e}]={\tilde{\sigma }}_{a| x}^{e}.\end{eqnarray} \tag{ A.5 }$$

Now, we finally consider that Eve also sends an additional degree of freedom which is read by the measuring device of Alice—an auxiliary classical 'flag' systems, which we label ${{\rm{A}}}^{\prime }.$ This system has orthogonal states $| e\rangle ,$ for $e=0,\ldots ,{m}_{{\rm{A}}}-1.$ This system will be read by Alice's measuring device, and, conditioned on the flag, the appropriate measurement will be made. We can thus now construct the complete strategy of Eve

$$\begin{eqnarray}{\rho }_{\mathrm{ABE}} & = & \displaystyle \sum _{e}{P}_{{\rm{E}}}(e)| e\rangle {\langle e| }_{{{\rm{A}}}^{\prime }}\otimes {\rho }_{\mathrm{AB}}^{e}\otimes | e\rangle {\langle e| }_{{\rm{E}}}\\ {M}_{a| x} & = & \displaystyle \sum _{e}| e\rangle {\langle e| }_{{{\rm{A}}}^{\prime }}\otimes {M}_{a| x}^{e}\\ {M}_{e} & = & | e\rangle {\langle e| }_{{\rm{E}}}.\end{eqnarray} \tag{ A.6 }$$

Clearly this defines a valid state and valid measurements, hence they satisfy the latter constraints of (A.2). Furthermore, by construction it also satisfies the first consistency constraint, which is straightforwardly verified.

In total, we thus conclude that the two optimization problems are equivalent, since the solution to either one implies a solution to the other, obtaining the same ${P}_{\mathrm{guess}}({x}^{*}).$ We thus focus on the problem (5) which is easier to solve, being an SDP optimization, linear in the optimization variables ${\sigma }_{a| x}^{e}.$

In this appendix we will show that the amount of randomness that can be certified in the prepare-and-measure scenario when Alice receives her share of the state through an untrusted channel, and does not trust her measuring device, is given by the SDP (6) in the main text.

Bob prepares a known bipartite state ${\rho }_{\mathrm{AB}}$ half of which is sent to Alice through the insecure quantum communication channel. Eve can intercept the state, and the most general operation she can perform (in the case that she is guessing only the outcome of a single measurement $x={x}^{*}$) is a measurement with Kraus operators K_e, i.e. the POVM elements are ${M}_{e}={K}_{e}^{\dagger }{K}_{e},$ and the state prepared by Eve after obtaining outcome e is

$$\begin{eqnarray}&&{\rho }_{\mathrm{AB}}^{e}=\displaystyle \frac{({K}_{e}\otimes {\mathbb{1}}){\rho }_{\mathrm{AB}}({K}_{e}^{\dagger }\otimes {\mathbb{1}})}{\mathrm{Tr}[{K}_{e}{\rho }_{{\rm{A}}}{K}_{e}^{\dagger }]}\end{eqnarray} \tag{ B.1 }$$

which occurs with probability ${P}_{{\rm{E}}}(e)=\mathrm{Tr}[{M}_{e}{\rho }_{{\rm{A}}}].$ Eve will guess that the outcome of Alice's measurement is e. Eve now forwards the state onto Alice, and since she controls completely Alice's device, she will allow the device to perform the measurement ${N}_{a| x}^{e}$ when her outcome was e, and when Alice chooses to make measurement x (that is, Eve sends the classical information of which outcome she obtained along with the quantum state). Thus, the probability for Alice to obtain outcome a, given that she made measurement x and Eve obtained outcome e is given by

$$\begin{eqnarray}&&{P}_{{\rm{A}}}(a| x,e)=\displaystyle \frac{\mathrm{Tr}[{N}_{a| x}^{e}{K}_{e}{\rho }_{{\rm{A}}}{K}_{e}^{\dagger }]}{\mathrm{Tr}[{K}_{e}{\rho }_{{\rm{A}}}{K}_{e}^{\dagger }]}.\end{eqnarray} \tag{ B.2 }$$

Putting everything together, we see therefore that the guessing probability is given by allowing Eve to optimize over all available strategies, and is given by

$$\begin{eqnarray} & {P}_{\mathrm{guess}}({x}^{*})=\underset{{K}_{e},{N}_{a| x}^{e}}{\mathrm{max}}\displaystyle \sum _{e}\mathrm{Tr}[{N}_{a=e| {x}^{*}}^{e}{K}_{e}{\rho }_{{\rm{A}}}{K}_{e}^{\dagger }] & \\ \mathrm{subject}\ \mathrm{to} & \displaystyle \sum _{e}{\mathrm{Tr}}_{{\rm{A}}}[({N}_{a| x}^{e}\otimes {\mathbb{1}})({K}_{e}\otimes {\mathbb{1}}){\rho }_{\mathrm{AB}}({K}_{e}^{\dagger }\otimes {\mathbb{1}})]={\sigma }_{a| x}^{\mathrm{obs}} & \forall a,x\\ & \displaystyle \sum _{a}{N}_{a| x}^{e}={\mathbb{1}} & \forall e,x\\ & \displaystyle \sum _{e}{K}_{e}^{\dagger }{K}_{e}={\mathbb{1}} & \\ & {N}_{a| x}^{e}\succcurlyeq 0 & \forall a,e,x.\end{eqnarray} \tag{ B.3 }$$

Currently, this optimization is not in the form of an SDP, due to the nonlinear nature of the objective function and the constraints. However, it can easily be written in the form of an SDP by introducing the new variable ${M}_{a| x}^{e}={K}_{e}^{\dagger }{N}_{a| x}^{e}{K}_{e}.$ The three final constraints on ${N}_{a| x}^{e}$ and K_e imply the following constraints on ${M}_{a| x}^{e},$

$$\begin{eqnarray}\displaystyle \sum _{a}{M}_{a| x}^{e}=\displaystyle \sum _{a}{M}_{a| {x}^{\prime }}^{e}, & \forall e,{x}^{\prime }\ne x, & \\ & \displaystyle \sum _{{ae}}{M}_{a| x}^{e}={\mathbb{1}}, & \forall x,\\ & {M}_{a| x}^{e}\succcurlyeq 0, & \forall a,e,x.\end{eqnarray} \tag{ B.4 }$$

However, we can see that whenever we have a set of ${M}_{a| x}^{e}$ satisfying the above constraints, it implies that there exist ${N}_{a| x}^{e}$ and K_e satisfying the original constraints—i.e. the two sets are equivalent. To see this, we denote first ${M}_{e}={\displaystyle \sum }_{a}{M}_{a| x}^{e}\succcurlyeq 0$ (which is independent of x), and therefore we can write ${M}_{e}={K}_{e}^{\dagger }{K}_{e},$ for some K_e, which is always possible for a positive semi-definite operator. Moreover, since ${\displaystyle \sum }_{{ae}}{M}_{a| x}^{e}={\displaystyle \sum }_{e}{K}_{e}^{\dagger }{K}_{e}={\mathbb{1}},$ the second constraint is satisfied. Finally, defining ${N}_{a| x}^{e}={({K}_{e}^{\dagger })}^{-1}{M}_{a| x}^{e}{({K}_{e})}^{-1}\succcurlyeq 0$ (using the pseudo-inverse when necessary), we also have that

$$\begin{eqnarray}&&\displaystyle \sum _{a}{N}_{a| x}^{e}={({K}_{e}^{\dagger })}^{-1}{M}_{e}{({K}_{e})}^{-1}={({K}_{e}^{\dagger })}^{-1}{K}_{e}^{\dagger }{K}_{e}{({K}_{e})}^{-1}={\mathbb{1}}.\end{eqnarray} \tag{ B.5 }$$

Thus, we can re-express the optimization problem (B.3) in the form of the following SDP

$$\begin{eqnarray} & {P}_{\mathrm{guess}}({x}^{*})=\underset{{M}_{a| x}^{e}}{\mathrm{max}}\displaystyle \sum _{e}\mathrm{Tr}[{M}_{a=e| {x}^{*}}^{e}{\rho }_{{\rm{A}}}] & \\ \mathrm{subject}\ \mathrm{to} & \displaystyle \sum _{e}{\mathrm{Tr}}_{{\rm{A}}}[({M}_{a| x}^{e}\otimes {\mathbb{1}}){\rho }_{\mathrm{AB}}]={\sigma }_{a| x}^{\mathrm{obs}} & \forall a,x\\ & \displaystyle \sum _{a}{M}_{a| x}^{e}=\displaystyle \sum _{a}{M}_{a| {x}^{\prime }}^{e} & \forall e,x\ne {x}^{\prime }\\ & \displaystyle \sum _{{ae}}{M}_{a| x}^{e}={\mathbb{1}} & \forall x,\\ & {M}_{a| x}^{e}\succcurlyeq 0 & \forall a,e,x\end{eqnarray} \tag{ B.6 }$$

which is exactly the optimization problem given in the main text.

In this appendix we show the explicit form of the dual of the SDP (5), and explain why equation (9) is an equivalent form, which is easier to interpret.

As a reminder, the primal problem is given by

$$\begin{eqnarray}{P}_{\mathrm{guess}}({x}^{*})=\underset{{\sigma }_{a| x}^{e}}{\mathrm{max}} & \displaystyle \sum _{e}\mathrm{Tr}[{\sigma }_{a=e| {x}^{*}}^{e}] & \\ \quad \mathrm{subject}\ \mathrm{to} & \displaystyle \sum _{e}{\sigma }_{a| x}^{e}={\sigma }_{a| x}^{\mathrm{obs}} & \forall a,x\\ & \displaystyle \sum _{a}{\sigma }_{a| x}^{e}=\displaystyle \sum _{a}{\sigma }_{a| {x}^{*}}^{e} & \forall e,x\ne {x}^{*}\\ & {\sigma }_{a| x}^{e}\succcurlyeq 0 & \forall a,x,e.\end{eqnarray} \tag{ C.1 }$$

Let us introduce dual variables ${F}_{a| x},$G_x^e and ${H}_{a| x}^{e},$ with respect to the first, second and third set of constraints respectively, and form the Lagrangian for this problem

$$\begin{eqnarray}{\mathcal{L}} & = & \displaystyle \sum _{e}\mathrm{Tr}[{\sigma }_{a=e| {x}^{*}}^{e}]+\displaystyle \sum _{{ax}}\mathrm{Tr}[{F}_{a| x}({\sigma }_{a| x}^{\mathrm{obs}}-\displaystyle \sum _{e}{\sigma }_{a| x}^{e})]\\ & & +\displaystyle \sum _{{aex}}\mathrm{Tr}[{G}_{x}^{e}({\sigma }_{a| x}^{e}-{\sigma }_{a| {x}^{*}}^{e})]+\displaystyle \sum _{{aex}}\mathrm{Tr}[{H}_{a| x}^{e}{\sigma }_{a| x}^{e}].\end{eqnarray} \tag{ C.2 }$$

After re-arranging, and grouping terms, this is equivalent to

$$\begin{eqnarray}{\mathcal{L}} & = & \displaystyle \sum _{{ax}}\mathrm{Tr}[{F}_{a| x}{\sigma }_{a| x}^{\mathrm{obs}}]\\ & & +\displaystyle \sum _{{aex}}\mathrm{Tr}[({\delta }_{a,e}{\delta }_{x,{x}^{*}}{\mathbb{1}}-{F}_{a| x}+{G}_{x}^{e}-{\delta }_{x,{x}^{*}}\displaystyle \sum _{{x}^{\prime }}{G}_{{x}^{\prime }}^{e}+{H}_{a| x}^{e}){\sigma }_{a| x}^{e}].\end{eqnarray} \tag{ C.3 }$$

This Lagrangian provides an upper bound on the primal objective as long as ${H}_{a| x}^{e}\succcurlyeq 0.$ Moreover, it provides a non-trivial upper bound only when the inner bracket in the second line identically vanishes for each value of $a,e,x.$ Thus, we arrive at the dual problem

$$\begin{eqnarray}{P}_{\mathrm{guess}}({x}^{*})=\underset{{F}_{a| x},{G}_{x}^{e},{H}_{a| x}^{e}}{\mathrm{min}} & \displaystyle \sum _{{ax}}\mathrm{Tr}[{F}_{a| x}{\sigma }_{a| x}^{\mathrm{obs}}] & \\ \mathrm{subject}\ \mathrm{to} & {\delta }_{a,e}{\delta }_{x,{x}^{*}}{\mathbb{1}}-{F}_{a| x}+{G}_{x}^{e}-{\delta }_{x,{x}^{*}}\displaystyle \sum _{{x}^{\prime }}{G}_{{x}^{\prime }}^{e}+{H}_{a| x}^{e}=0 & \forall a,e,x\\ & {H}_{a| x}^{e}\succcurlyeq 0 & \forall a,e,x.\end{eqnarray} \tag{ C.4 }$$

However, ${H}_{a| x}^{e}$ is playing the role of a slack variable, since it does not appear in the objective function, so we can finally simplify the dual to arrive at

$$\begin{eqnarray}&&{P}_{\mathrm{guess}}({x}^{*})=\underset{{F}_{a| x},{G}_{x}^{e}}{\mathrm{min}}\displaystyle \sum _{{ax}}\mathrm{Tr}[{F}_{a| x}{\sigma }_{a| x}^{\mathrm{obs}}]\\ &&\mathrm{subject}\ \mathrm{to}\qquad {F}_{a| x}+{\delta }_{a,e}{\delta }_{x,{x}^{*}}{\mathbb{1}}-{G}_{x}^{e}-{\delta }_{x,{x}^{*}}\displaystyle \sum _{{x}^{\prime }}{G}_{{x}^{\prime }}^{e}\preccurlyeq 0\qquad \forall a,e,x.\end{eqnarray} \tag{ C.5 }$$

The dual is easily seen to be strictly feasible, for example by taking ${G}_{x}^{e}=0$ and ${F}_{a| x}=\alpha {\mathbb{1}}$ for $\alpha \gt 1.$ Thus strong duality holds, and the optimal value of the dual is equal to the optimal value of the primal. In the form (C.5), the dual is seen manifestly to be an SDP, as expected. Finally, to understand the meaning of the constraint, we multiply by an arbitrary valid assemblage ${\sigma }_{a| x},$ and take the sum in a and x and the trace. We find

$$\begin{eqnarray}&&\displaystyle \sum _{{ax}}\mathrm{Tr}[{F}_{a| x}{\sigma }_{a| x}]\geqslant \mathrm{Tr}[{\sigma }_{e| {x}^{*}}]=P(e| {x}^{*})\end{eqnarray} \tag{ C.6 }$$

must hold for all e. Since this condition also holds for all valid assemblages, we see that the second constraint enforces that the value of the inequality is a uniform upper bound on the probability that any individual outcome occurs for the measurement ${x}^{*},$ independent of the assemblage. Hence, one sees immediately why this bounds the guessing probability.

In this section we will show analytically that appropriate measurements on all partially entangled qudit states necessarily lead to 1 dit of randomness.

Consider first the partially entangled two-qubit state in Schmidt form, $| \psi \rangle =\mathrm{cos}\theta | 00\rangle +\mathrm{sin}\theta | 11\rangle ,$ for $\theta \in (0,\pi /4],$ and that Alice's two measurements are X and Z measurements respectively. The assemblage created for Bob is then

$$\begin{eqnarray}{\sigma }_{0| 0} & = & \displaystyle \frac{1}{2}| {\uparrow }_{\theta }\rangle \langle {\uparrow }_{\theta }| ,\\ {\sigma }_{1| 0} & = & \displaystyle \frac{1}{2}| {\uparrow }_{-\theta }\rangle \langle {\uparrow }_{-\theta }| ,\\ {\sigma }_{0| 1} & = & {\mathrm{cos}}^{2}\theta | 0\rangle \langle 0| ,\\ {\sigma }_{1| 1} & = & {\mathrm{sin}}^{2}\theta | 1\rangle \langle 1| ,\end{eqnarray} \tag{ D.1 }$$

where $| {\uparrow }_{\theta }\rangle =\mathrm{cos}\theta | 0\rangle +\mathrm{sin}\theta | 1\rangle .$ Crucially, each element of the assemblage is pure, i.e. each element is of the form ${\sigma }_{a| x}=P(a| x){{\rm{\Pi }}}_{a| x},$ where ${{\rm{\Pi }}}_{a| x}$ is a one-dimensional projector. The purity of Bob's assemblage substantially constrains Eve's possible strategies, such that

$$\begin{eqnarray}&&{\sigma }_{a| x}^{e}=q({ae}| x){{\rm{\Pi }}}_{a| x},\end{eqnarray} \tag{ D.2 }$$

where each $q({ae}| x)\geqslant 0.$ This says that Eve must prepare the same pure state for Bob in each instance, all she can vary is the probability of the two outcomes (which must still be positive). To be consistent with the observed assemblage, we must have that

$$\begin{eqnarray}&&\displaystyle \sum _{e}q({ae}| x)=P(a| x).\end{eqnarray} \tag{ D.3 }$$

The guessing probability also now becomes

$$\begin{eqnarray}&&{P}_{{\rm{g}}}=\displaystyle \sum _{e}\mathrm{tr}[{\sigma }_{a=e| 0}^{e}]=q(00| 0)+q(11| 0).\end{eqnarray} \tag{ D.4 }$$

Now, the no-signalling constraint says that ${\displaystyle \sum }_{a}{\sigma }_{a| 0}^{e}={\displaystyle \sum }_{a}{\sigma }_{a| 1}^{e}$ for all e. Specifically, in the case at hand

$$\begin{eqnarray}&&q(0e| 0){{\rm{\Pi }}}_{0| 0}+q(1e| 0){{\rm{\Pi }}}_{1| 0}=q(0e| 1){{\rm{\Pi }}}_{0| 1}+q(1e| 1){{\rm{\Pi }}}_{1| 1},\end{eqnarray} \tag{ D.5 }$$

which must be true for all matrix elements. While the projectors on the right-hand side, corresponding to measurements of Z, are diagonal, the left-hand side, corresponding to X, are in general not diagonal. Thus, taking the trace with $| 1\rangle \langle 0| ,$ we arrive at the condition

$$\begin{eqnarray}&&\mathrm{cos}\theta \mathrm{sin}\theta (q(0e| 0)-q(1e| 0))=0.\end{eqnarray} \tag{ D.6 }$$

Since $\mathrm{cos}\theta \mathrm{sin}\theta \ne 0$ for $\theta \in (0,\pi /4],$ this implies that $q(0e| 0)=q(1e| 0).$ In particular, this says that $q(01| 0)=q(11| 0).$ However, to be consistent $q(00| 0)+q(01| 0)=p(0| 0)=1/2,$ and thus we arrive at

$$\begin{eqnarray}&&1/2=q(00| 0)+q(01| 0)=q(00| 0)+q(11| 0)={P}_{{\rm{g}}}.\end{eqnarray} \tag{ D.7 }$$

Thus, analytically it must be the case that ${P}_{{\rm{g}}}=1/2,$ and hence 1 bit of randomness is obtained by measuring X and Z on any partially entangled state of two qubits.

The above also extends to qudits; assuming that the state has Schmidt-rank d then 1 dit of randomness can always be obtained. Let us now write the state as

$$\begin{eqnarray}&&| \psi \rangle =\displaystyle \sum _{k=0}^{d-1}\sqrt{{\lambda }_{k}}| k\rangle | k\rangle ,\end{eqnarray} \tag{ D.8 }$$

where ${\displaystyle \sum }_{k}{\lambda }_{k}=1,$ and ${\lambda }_{k}\gt 0.$ Alice's first measurement will now be in the Fourier transform basis, with eigenstates

$$\begin{eqnarray}&&| \tilde{a}\rangle =\displaystyle \frac{1}{\sqrt{d}}\displaystyle \sum _{k=0}^{d-1}{\omega }^{{ak}}| k\rangle \end{eqnarray} \tag{ D.9 }$$

and $\omega ={{\rm{e}}}^{2\pi {\rm{i}}/d}$ the corresponding root of unity. Her second measurement will be in the Z basis with eigenstates $\{| a\rangle \}.$ For Alice's first measurement she obtains each outcome with equal probability $P(a| 0)=1/d,$ and prepares the pure states for Bob ${{\rm{\Pi }}}_{a| 0},$ given by

$$\begin{eqnarray}&&{{\rm{\Pi }}}_{a| 0}=\displaystyle \sum _{{kl}}\sqrt{{\lambda }_{k}{\lambda }_{l}}{\omega }^{a(l-k)}| k\rangle \langle l| .\end{eqnarray} \tag{ D.10 }$$

For Alice's second measurement, she obtains outcome a with probability $P(a| 1)={\lambda }_{a},$ and prepares the state ${{\rm{\Pi }}}_{a| 1}=| a\rangle \langle a| .$ As above, the purity of Bob's assemblage means that Eve is again forced to use strategies of the form ${\sigma }_{a| x}^{e}=q({ae}| x){{\rm{\Pi }}}_{a| x}.$ For consistency we still have ${\displaystyle \sum }_{e}q({ae}| x)=P(a| x),$ for the guessing probability ${P}_{{\rm{g}}}={\displaystyle \sum }_{e}q({ee}| 0),$ and from no-signalling ${\displaystyle \sum }_{a}q({ae}| 0){{\rm{\Pi }}}_{a| 0}={\displaystyle \sum }_{a}q({ae}| 1){{\rm{\Pi }}}_{a| 1}.$ Once again, the right-hand side is diagonal, and hence by looking at the off-diagonal matrix elements, i.e. by taking the trace with $| k\rangle \langle l| ,$ we find that

$$\begin{eqnarray}&&\displaystyle \sum _{a}q({ae}| 0)\sqrt{{\lambda }_{k}{\lambda }_{l}}{\omega }^{a(l-k)}=0.\end{eqnarray} \tag{ D.11 }$$

Since, by assumption of being Schmidt-rank d, none of the Schmidt coefficients vanish, we therefore must have that

$$\begin{eqnarray}&&\displaystyle \sum _{a}q({ae}| 0){\omega }^{a(l-k)}=0.\end{eqnarray} \tag{ D.12 }$$

Considering only the elements with k = 0 (and $l=1,\ldots ,d-1$), along with the equation ${\displaystyle \sum }_{a}q({ae}| 0)=P(e),$ which says that Eve's probability to output e is just the marginal distribution, we notice that this set of equations, when combined, has the familiar form of a discrete Fourier transform (up to normalization):

$$\begin{eqnarray}\left[\begin{array}{llll}1 & 1 & ... & 1\\ 1 & \omega & ... & {\omega }^{d-1}\\ \vdots & \vdots & \ddots & \vdots \\ 1 & {\omega }^{d-1} & ... & {\omega }^{{(d-1)}^{2}}\end{array}\right]\left[\begin{array}{c}q(0e| 0)\\ q(1e| 0)\\ \vdots \\ q(d-1,e| 0)\end{array}\right]=\left[\begin{array}{c}P(e)\\ 0\\ \vdots \\ 0\end{array}\right].\end{eqnarray} \tag{ D.13 }$$

Thus, this equation is readily inverted, and we obtain as solution $q({ae}| 0)=P(e)/d$ for all $a,e.$ In particular, this implies that Eve's guess is completely uncorrelated from Alice's, and her guessing probability is ${P}_{{\rm{g}}}={\displaystyle \sum }_{e}q({ee}| 0)=\displaystyle \frac{1}{d}{\displaystyle \sum }_{e}P(e)=1/d.$ Thus 1 dit of randomness is obtained from Alice's measurement.