Experimental Certification of Random Numbers via Quantum Contextuality

Abstract

The intrinsic unpredictability of measurements in quantum mechanics can be used to produce genuine randomness. Here, we demonstrate a random number generator where the randomness is certified by quantum contextuality in connection with the Kochen-Specker theorem. In particular, we generate random numbers from measurements on a single trapped ion with three internal levels, and certify the generated randomness by showing a bound on the minimum entropy through observation of violation of the Klyachko-Can-Binicioglu-Shumovsky (KCBS) inequality. Concerning the test of the KCBS inequality, we close the detection efficiency loophole for the first time and make it relatively immune to the compatibility loophole. In our experiment, we generate 1 × 10⁵ random numbers that are guaranteed to have 5.2 × 10⁴ bits of minimum entropy with a 99% confidence level.

Random number generation is important for many applications¹,². For cryptographic applications, random numbers should have good unpredictability in order to be secure under attack by the adversaries³. Genuine random numbers can never be generated by a classical device because any classical device bears in principle a deterministic description. Quantum mechanics, on the other hand, has intrinsic randomness, and thus can be explored to construct a genuine random number generator. There have been many demonstrations of random number generators based on quantum principles⁴,⁵,⁶,⁷,⁸,⁹,¹⁰,¹¹,¹²,¹³,¹⁴.

Self-certified random number generation is an advance made recently, where the randomness is guaranteed by violation of certain fundamental inequalities¹⁴,¹⁵,¹⁶. In particular, it was proposed in Refs. ^14,15 that through violation of the Clauser-Horn-Shimony-Holt (CHSH) inequality, one can certify the generated random numbers in a device-independent fashion that is secure against the adversaries who have only classical side information¹⁷. The first proof-of-principle experiment for this scheme has been recently demonstrated¹⁴.

We consider here a scenario where the provider of the device is assumed to be honest. However, we still need to physically certify that the random numbers are generated due to the intrinsic uncertainty of quantum mechanics instead of some uncontrolled classical noise process in the device. In this case, we can use quantum contextuality manifested through the violation of certain Kochen-Specker (KS) inequality to certify the generated random numbers¹⁸,¹⁹. Quantum contextuality is a basic property of quantum mechanics, where the measurement outcomes depend on the specific context of the measurements²⁰,²¹. Quantum contextuality would be revealed by violations of some KS inequalities, and such violations can be observed even in a single indivisible system without any entanglement²²,²³,²⁴,²⁵,²⁶,²⁷. Because there is no need of entanglement, a certification scheme of random numbers based on the KS theorem can significantly simplify the experimental requirement and generate certified random numbers with a much higher speed¹⁸. A proof-of-principle experimental implementation of this idea has been reported with a photonic system quite recently¹⁸.

A particular type of the KS inequality, the Klyachko-Can-Binicioglu-Shumovsky (KCBS) inequality²², is convenient for certification of random numbers. Violation of the KCBS inequality has been observed before in a single-photonic system²³. For experimental test of the KCBS inequality, there are two possible loopholes: the detection efficiency loophole if the detectors only register a subset of data due to their inefficiency, and the compatibility loophole, which occurs if additional assumptions are required to guarantee that the observables with simultaneous assignment of values in the KCBS inequality are compatible with each other and remain identical when their measurement contexts change. The test of the KCBS inequality with the photonic system is immune to the compatibility loophole²³, however, it requires the fair-sampling assumption due to the low photon detection efficiency and thus subject to the detection efficiency loophole.

In this paper, we report a random number generator certified by quantum contextuality with a single trapped ion, which allows us to close the detection efficiency loophole for the first time for the KCBS inequality. For the compatibility, we follow basically the same configurations as in Ref. 23, where errors in compatibible measurement settings only reduce the amount of the violations. Even with experimental noise and imperfections, we get significant violations of the KCBS inequality, which lead to lower bounds the minimum entropy of the generated random string. Compared to the experimental certification based on the CHSH inequality¹⁴, the generation rate of random numbers is increased by about four orders of magnitudes in our experiment, which is important for practical applications.

The paper is organized as follows. First, we introduce the KCBS inequality and show the experimental violation of this inequality. Then, we introduce the relation between the violation of the KCBS inequality and the minimum entropy of the generated random string for the case of an honest provider, and compare the theoretical prediction with our experimental observation. The generated random bits are tested under uniform or biased choice of measurement settings. We conclude the paper by summarizing the results and discussing further improvements of our random number generation scheme.

Results

The KCBS inequality

The Kochen-Specker theorem states that the results of quantum mechanics cannot be fully explained by non-contextual classical theories which assume that the measurement outcomes of a physical system are predetermined and independent of their own and other simultaneous compatible measurements²⁰,²¹. The KCBS inequality illustrates the conflict between quantum mechanics and non-contextual classical theory in the simplest possible system with the Hilbert space dimension d = 3²².

The KCBS inequality is connected with the following simple algebraic equation.

where the value of a_i is either 1 or −1. If the values of the observables are predetermined, the average of the left hand of the above equation should be no less than −3, leading to the following inequality:

In quantum mechanics, however, the outcomes of A_i do not have predetermined values, which allows violation of the KCBS inequality (2) for a specific state |ψ₀〉 in systems with d ≥ 3. In the case of d = 3, we denote the bases by |1〉, |2〉 and |3〉 and the observable A_i, represented by A_i = 1 – 2 |v_i〉 〈v_i|, is the projector on the axis |v_i〉. The maximal violation of the KCBS inequality (2) is achieved for the state along the symmetric axis of the pentagram shown in Fig. 1(a). Here |v₁〉 = |1〉, |v₂〉 = |2〉, |v₃〉 = R₁ (γ, 0) |v₁〉, |v₄〉 = R₂ (γ, 0) |v₂〉, |v₅〉 = R₁ (γ, 0) |v₃〉 and , where γ = 51.83° and R_1,2 denote the rotation operations between |1〉 to |3〉 and between |2〉 to |3〉, respectively. Maximal violation the KCBS inequality is achieved under the state (2), with the corresponding value .

Figure 1. The representation in 3d space and pulse sequences of a state and measurement configurations for the maximal violation of the KCBS inequality (2).

(a) The five vectors form a regular pentagram, which represent observables A₁, A₂, ···, A₅ that are the projectors on them. The vectors related to observables A_i, A_i+1 are orthogonal, which makes the neighboring observables compatible. The initial state |ψ₀〉 for the maximal violation is located at the center axis (blue arrow) of the pentagram. The initial state and measurements of the compatible observables are realized by the pulse sequences shown in (b) and (c)-(g). (b) The pulse sequence to prepare . Here, R₁ and R₂ represent the coherent rotations between |1〉 to |3〉 and between |2〉 to |3〉, respectively, where θ = 41.97° and ϕ = 64.09°. The sequence starts from |3〉 state (black filled circle) after optical pumping. (c)–(g) The pulse sequences for the measurement configurations (c) A₁A₂, (d) A₂A₃, (e) A₃A₄, (f) A₄A₅, (g) , where γ = 51.84°. The important aspect of the configuration is that the measurement scheme for A_i is perfectly unchanged when it is measured with either A_i–1 or A_i+1 except A₁, similarly to the photon realization²³. The pulse sequence for the confirmation of the identicalness between A₁ and is shown in Fig. 2(d). For the random number generation, we choose one of the five configurations shown in (c)–(g) based on software random numbers.

Figure 1(b) shows the scheme for preparation of the initial state |ψ₀〉 starting from the basis state |3〉, and Fig. 1(c)–(g) describe the implementation of the measurement configurations along the five axes. To ensure context independence, we emphasize that the measurement configuration of A_i remains the same when it is measured with either A_i–1 or A_i+1 (let A₀ ≡ A₅, A₆ ≡ A₁). For example, the scheme for the measurement A₂ is exactly the same in the first [Fig. 1(c)] and the second stage [Fig. 1(d)]. To move to the second configuration, we perform a rotation between the states |1〉 and |3〉, which does not influence the state |2〉 that corresponds to the observable A₂. Only the observable related to the state |1〉 is changed from A₁ to A₃.

The configuration for the measurement of A₁ in Fig. 1(c) is not the same as that in Fig. 1(g), which is therefore denoted by . If A₁ and are not identical, it is possible to violate the inequality (3) even in classical theory. To solve this problem, similarly to Ref. 23, we use a new inequality that includes the observable with the form

Note that the inequality (3) becomes the original KCBS inequality (2) when . Therefore, the difference between two measurements decrease the violation that can be obtained in the experiments²³. Another possible way out is to introduce an empirical parameter to upper bounds the violation of compatibility, which would be similar in spirit to a recent work where a parameter in introduced to bound violation of the locality loophole for test of the Bell inequality²⁸. Any imperfection in the initial state preparation or final measurements only leads to a reduction of violation of the KCBS inequality, so a significant violation of this inequality guarantees that the randomness comes from the quantum origin instead of a classical noise process.

Experimental violation of the KCBS inequality

The violation of the KCBS inequality have been observed with single photons¹⁸,²³, however, those experiments are subject to the detection efficiency loophole. Here, we present the experimental violation of the KCBS inequality in a single trapped ion. Because of the high detection efficiency for the trapped ion, we close the detection efficiency loophole for the first time for this inequality.

We perform the test of the KCBS inequalities (2) with a single trapped ¹⁷¹Yb⁺ ion in a four-rod radio-frequency trap²⁶,²⁹. The qubit states are represented by the two internal levels in the S_1/2 ground-state manifold, with |F = 1, m_F = 0〉 ≡ |↑〉 and |F = 0, m_F = 0〉 ≡ |↓〉. The transition frequency between |↑〉 to |↓〉 is ω_HF = (2π)12642.821 MHz, determined by the hyperfine interaction.

The procedure of the experiment consists of Doppler cooling, initialization, coherent operation, and detection (see the Method Section). The initial state preparation and the measurement configurations are shown in Fig. 1(b)-(g), and they are realized by two microwaves with the frequencies ω₁ and ω₂, which produce Rabi oscillations R₁ (θ₁, ϕ₁) and R₂ (θ₂, ϕ₂) between |1〉 to |2〉 and between |1〉 to |3〉, respectively. Here, θ_1,2 and ϕ_1,2 are controlled by the duration and phase of the microwaves. R₁ (θ₁, ϕ₁) and R₂ (θ₂, ϕ₂) are have the following explicit forms

For experimental convenience, we transform the observable A_i to V_i = (1 − A_i)/2, which is assigned to value v_i = 0 when photons are detected or v_i = 1 when no photons are detected. With V_i, the KCBS inequality (3) is rewritten as

We obtain 〈V_i〉 by mapping the axis v_i to the state |3〉 and then measuring the probability P_|3〉 (v_i = 1) = 〈V_i〉 (Fig. 2(b)). For simplicity, let P_|3〉 = P. The correlation terms 〈V_iV_i+1〉 are obtained by sequential measurements depicted in Fig. 2(c). First, we transfer V_i on the state |3〉 and apply the standard fluorescence detection scheme. If we detect photons, the state should not be |3〉 and we assign v_i = 0 to the observable V_i, where the outcome of the correlation term V_iV_j vanishes and no further measurements are needed. If we detect no photons, we assign v_i = 1 to the V_i. Then, we apply the swapping microwave π-pulse that converts V_j to |3〉 before another round of fluorescence detection. If we observe photons, v_j = 0, and if no photons, v_j = 1. We asign the value 1 to the correlation term V_iV_j only when we detect no photons for both rounds of measurements. We obtain the average of the correlation term 〈V_iV_j〉 = P (v_i = v_i+1 = 1) by repeating the same experimental sequence many times²⁶.

Figure 2. The trapped ¹⁷¹Yb⁺ ion system and detection schemes (a) The schematic diagram of trapped ion ¹⁷¹Yb⁺ experimental setup for observing the violation of the KCBS inequality and for generating random numbers certified by the inequality.

The three states |F = 1, m_F = 0〉, |F = 1, m_F = 1〉, and |F = 0, m_F = 0〉 in the S_1/2 ground state manifold are mapped onto |1〉, |2〉, and |3〉, respectively. One of the five measurement configurations in Fig. 1(c)–(g) is chosen by the software generated random number and the pulse sequence of the chosen setting is transfered to the arbitrary wave form generator and is applied to the ion through the amplifier. Depending on the photon counts on the PMT, we assign values on the observables mapped on the state |3〉. (b) The detection schemes for obtaining results of single observables V_i, V_j. First, V_i or V_j is mapped to the state |3〉 and apply the standard fluorescent detection method. If we detect photons (no photons), we assign zero (one) on the observable V_i or V_j. After repeating the same pulse sequence and the detection, we obtain the average value of the observable. (c) The sequential measurement scheme for the correlation V_iV_j. V_iV_j has a value one when both of V_i and V_j have one, where no photons are detected at each stage. (d) The experimental confirmation of the identicalness of V₁ and . Ideally, whenever V₁ has a result one (no photons), should have the same result (no photons). Any imperfection or changes in the system will cause the mismatch of them, which reduces the violation in the extended KCBS inequality (3).

The expectation value is obtained by the scheme shown in Fig. 2(d). If ideally, the correlation shoud be same to 〈V₁〉 since V₁ is projection operator . The state |1〉 at the beginning of Fig. 1(g) corresponds to the observable V₁, which is exactly the same configuration as in Fig. 1(c). Therefore, if photons are detected (v₁ = 0) or not detected (v₁ = 1) at the place where V₁ would be measured, photons should be observed () or not be observed () for the shown in Fig. 2 (d). After repeating the sequence of Fig. 2(d), we acquire the probability that no photons are measured (), which gives by definition.

We randomly choose one of the five configurations (c)–(g) of Fig. 1 based on computer generated random numbers and perform the sequential measurements. We change the order of sequential measurements ( V_iV_i+1 or V_i+1V_i) with equal probability. We occasionally check the overlap of V₁ and . We repeat the sequences 1 × 10⁵ times and observe 〈χ_KCBS〉 = 3.852(0.030), which violates the extended KCBS inequality (3,4) by 31 σ. The detailed results of the measurements are summarized in Table 1. We emphasize that our result of the violation cannot be explained by any non-contextual classical theory which does not exploit the compatibility loophole (the detection loophole is closed in our experiment). In other words, any classical part of the system such as technical noise, imperfections and/or unexpected changes of control parameters can not produce the violation. Therefore, as long as we observe the violation of the inequality, we can ensure that the outcomes of our measurements originate from quantum mechanics.

Table 1. Experimental results for each of five settings and five joint probabilities for the KCBS inequality (4). We also perform the same experiments with exchanged order. The total trials of the experiment are 1 × 10⁵. The standard deviations of the final result are 0.005 and 0.001 for the single observables and correlations, repectively as shown in the parenthesis. Our experimental test clearly shows the violation of the extended inequality (3) with 31 σ.

	P|3〉			Correlations
Setting	Term	Ideal	Result	Term	Ideal	Result
Fig. 1(c)	〈V1〉		0.452(5)	〈V1V2〉		0.014(1)
	〈V2〉		0.446(5)	〈V2V1〉		0.015(1)
Fig. 1(d)	〈V2〉		0.448(5)	〈V2V3〉		0.016(1)
	〈V3〉		0.436(5)	〈V3V2〉		0.016(1)
Fig. 1(e)	〈V3〉	0.447	0.428(5)	〈V3V4〉	0	0.014(1)
	〈V4〉		0.443(5)	〈V4V3〉		0.016(1)
Fig. 1(f)	〈V4〉		0.464(5)	〈V4V5〉		0.015(1)
	〈V5〉		0.439(5)	〈V5V4〉		0.014(1)
Fig. 1(g)	〈V5〉		0.443(5)	〈V5V1′〉		0.017(1)
	〈V1′〉		0.431(5)	〈V1′V5〉		0.014(1)
Fig. 2(d)				〈V1V1′〉	0.447	0.451(5)

The relation between violation of the KCBS inequality and the min-entropy

We establish the relation between violation of the KCBS inequality (2, 4) and randomness of the generated string from the experiment, similar to the photonic demonstration¹⁸. We focus on the scenario with an honest provider of the device¹⁷ rather than the extreme adversary scenario where the device has been produced by a malicious manufacturer. Even though we trust the device provider, we still need to ensure that the randomness of the generated sequence is caused by quantum uncertainty instead of technical noise¹⁷. For this purpose, we assume: (1) the system can be described by quantum theory; (2) the input at lth trial is chosen from a random process that is independent and uncorrelated from the system and its value is revealed to the system only at step l; (3) the outcomes of the corresponding pairs of measurements at step l are compatible (the measurement of one observable does not influence on the marginal distribution of the results of the other observable); (4) the adversary does not have any capability of controlling the inside of the system. The first and the second assumptions here are identical to those made in the certification scheme of Bell's inequality¹⁴. The third is the contextuality assumption that replaces the role of locality assumption for the Bell inequality. The fourth is an assumption about the honest provider¹⁷.

We consider five sets of measurement configurations S = {A₁A₂, A₂A₃, A₃A₄, A₄A₅, A₅A₁}, where A_i is the observable with the output a_i = ±1 and compatible with A_i–1 and A_i+1. We can rewrite the KCBS inequality (2) as

where P (a_i = a_i+1|A_iA_i+1) or P (a_i ≠ a_i+1|A_iA_i+1) is the probability that the output results are the same or different for a chosen measurement setting A_iA_i+1. Note that we change the sign of the inequality to make the derviation similar to that in Refs. ^14,17,30. In our experiment, since we use the observable V_i (result v_i = 0,1) intead of A_i and only distinguish the event of v_i = v_i+1 = 1 from others, the Eq. (5) is modified as

where P (v_i = 1|V_i) is the probability that the output result v_i is 1 at a measurement setting V_i. The result of terms inside {··· } is ideally zero and non-zero positive value can be occurred by experimental errors or imperfections, which only reduces the amount of violation from the optimal. Therefore, we can conclude that the experimental violations of the inequality (6) arise from solely quantum mechanical origin not any classical mean.

In our relization, we estimate the violation of the inequality (6) by repeating the sequences n times and additional runs n_cc of the comparibility check, the measurement setting . The estimation of Eq. (5), obtained from the experimental data, is written as

where N (v_i = 1|V_i) or N (v_i = v_i+1 = 1|V_iV_i+1) is the number of times that the outcome v_i or v_i and v_i+1 is one under a measurement setting V_i or V_i and V_i+1, respectively. P (V_i) or P (V_iV_i+1) is the probability with which a measurement configuration V_i or V_i and V_i+1 is chosen. Note that positive result of terms inside {···} and [···] originates from the experimental flaws, which only reduces the amount of violation.

The randomness of a single generated bit v_i from a measurement setting V_i can be characterized by the min-entropy , where P (v_i|V_i) is the conditional probability of obtaining v_i when the input setting V_i and the maximum is taken over all possible values of the output string. The theorem 1 of Ref. 17 shows that the min- entropy of the generated string after n trials is bounded by

where is a series of KCBS violation thresholds with the classical bound, and the maximum violation, and , with r the smallest probability of input choices min_iP (V_i). The parameter parameter denotes the closeness between the resulting distribution that characterize k successive uses of the device and another extended distribution that is well defined mathematically. The function f is found by semidefinite programming at various expectations L. Fig. 3 presents how the min-entropies are affected by the confidence levels, and 1 − δ. When we set a high confidence level, , the bound on the min-entropy reduces as expected. Note that the certified min-entropy is only determined by measured value and the choice of , independent of experimental details.

Figure 3. The min-entropy vs. the violation.

The function f(L) in Eq. (8) depending on the violation L of the KCBS inequality (5), which is calculated by semi-definite programming (SDP). The function at various confidence levels such as 90%, 99% and 99.9% are plotted for the uniform choices of measurement configurations, where and r = min_iP (A_iA_i+1) = 1/5. Here we divide interval with the spacing . Given a measured and confidence level, we can estimate the min-entropy of a generated random string as summarized in Eq. (8). Note that we ignore the term log₂ δ in Eq. (8) that does not have dependence on the trial n.

Random number results

We perform ten thousand trials to generate random bits as described in the previous section: [Experimental violation of the KCBS inequality]. At each trial, we choose one of the five measurement configurations shown in Fig. 1 (c)−(g) by computer-generated random numbers, perform the sequence composed of Doppler cooling, state initialization and rotations for the chosen configuration and finally record the existence of fluorescence (see Method section). As explained, we obtain a random bit, i.e., 1 (or 0) with fluorescence (or no fluorescence) for each trial. The sequence takes about 10 ms, mainly limited by the wave-form loading time to the pulse generator. Note that the random generator based on the CHSH inequality produced a random bit per several min.

Figure 4 shows the min-entropies of generated strings discussed in the previous section: [The relation between violation of the KCBS inequality and the min-entropy]. We produce a string of length 1 × 10⁵ with uniform choices of the measurement settings, P (V_i) = 1/5. As shown in Table 1, we observe the expectation , implying the min-entropy with 99% confidence. Note that the other confidence level δ does not have any noticable influence on the bound of min-entropy. Here we used the thresholds of KCBS violations .

Figure 4. Comparison between theory and experimental results.

(a)(c)The min-entropy H_∞ (v|V) (8) depending on the number of trials for (a) an uniform distribution of measurement settings P(V_i) = 1/5 and (c) a biased distribution with P (V₁) = 1 − 4q, P (V₂) = P (V₃) = P (V₄) = P (V₅) = q, where q = 6(100000)^−1/2 with the probablity of errors and δ = 0.001. The min-entropies H_∞ (a|A) (8) are bounded by the relation of the violation of the KCBS inequality (8), where we set the 10 intervals of between and . The min-entropies are linearly increasing as the number of trial increases and the slopes are basically dependent on the thresholds of the intervals (blue), (green), (yellow), and (red). The black dots are obtained from the violation values that were observed at the number of trials. (b)(d) The correlation between the KCBS violations (8) and the min-entropy (8) of the strings for (b) the uniform input choices and (d) the baised settings. Here we divide the total 1 × 10⁵ numbers by 10 division and show the KCBS violations and min-entropies in the division. We can clearly show that the monitor of at each division provides sufficient information to guarantee the min-entropy in the division.

Fig. 4 shows clearly the advantage of our certification scheme, i.e., we can guarantee the min-entropy of the generated random string by only monitoring the violation independent of experimental details. Fig. 4(a) shows the accumulated behavior of the min-entropy as the number of experimental trials n increases. The solid lines show the theoretical linear increment of the minentropies and the slopes are determined by only the thresholds . Due to drifts of experimental parameters, the violations are fluctuating from one threshold to another, which accordingly introduces the changes to the min-entropy, accordingly. Fig. 4(b) shows details of the transient behavior of the generated random string. We monitor the violation for each batch of n = 1 × 10⁴ trials and estimate the min-entropy in the batch. Fig. 4(b) reveals that the min-entropies are correlated to the violations and completely determined by the thresholds at given confidence level 99%. Here, we we do not need massive random tests to ensure the amount actual random number in the generated string. The amount of min-entropy of our random numbers is guaranteed by the the measured violations , regardless of unexpected changes of experimental parameters.

We also generate random bits with a biased choice of measurement settings, where P (V₁) = 1 − 4q, P (V₂) = P (V₃) = P (V₄) = P (V₅) = q, and q = αn^−1/2 with α = 6 and n = 10⁵. We observe basically the same behavior of the min-entropy for the generated stream except for a slightly smaller bound due to the non-uniform setting. We get the min-entropy bound from 1 × 10⁵ rounds with violation of . For the biased choice of measurement settings, the output entropy (1.35 × 10⁴) exceeds the input entropy (1.14 × 10⁴), and we obtain 2.1 × 10³ net random bits. For the case of uniform measurement settings, we always need more initial randomness and thus cannot obtain net randomness. This is similar to the random number generation scheme with the CHSH inequality, where to generate net randomness, one always needs to consider nonuniform measurement settings.

Finally, we carry out a series of random tests (see Methods)³¹ to examine the quality of our random numbers obtained by collecting the outcomes of the first measurement in each trial. As expected, our generated random numbers passed all the tests. Fig. 5 shows the summary of the test results. Actually the real randomness of our generated strings is already certified by the KCBS inequality, which is a much stronger statement than claiming that the produced numbers pass all the random tests, since no random tests on finite strings should be considered complete.

Figure 5. The results for random tests.

The summary for the results of random tests³¹ on our generated random numbers. In the tests, we can consider the sequences as random if P – values of the tests are over the threshold that we set, 0.01. All of random numbers pass the listed tests.

Discussion

In summary, we have demonstrated violations of the KCBS inequality using a single trapped ion, with the detection efficiency loophole closed for the first time. We use quantum contextuality to certify randomness of the measurement outcomes. The randomness of our device is ensured by observing violations of the inequality independent of experimental details. With our device, we already obtained a net output entropy. The device can generate random numbers with a higher speed, which is important for practical applications.

Methods

Experiment procedure

The experimental procedure consists of Doppler cooling, initialization, coherent operations and detection. After 1 ms Doppler cooling, the internal state of the ion is initialized to |3〉 by 3 μs standard optical pumping with efficiency 99.1%²⁶. The states are coherently manipulated by the microwaves ω₁ and ω₂ that are resonant to the transitions between |1〉 and |3〉, and between |2〉 and |3〉, respectively. The quantum operations of the microwaves ω₁ and ω₂ are described by the rotation matrix R₁ (θ₁, ϕ₁) and R₂ (θ₂, ϕ₂), respectively. Here θ₁, θ₂ and ϕ₁, ϕ₂ are controlled by the duration and the phase of the applied microwaves. The 2 π times for both Rabi oscillations are adjusted to 29.5 μs, that is Ω_1,2 = (2π) 33.9 kHz in frequency. The maximum probability of off-resonant excitation Ω²/(ω₂ − ω₁)² is about 1.6 × 10⁻⁵, small enough to ensure independence of each Rabi oscillation. The standard fluorescent-detection method enables us to differentiate between one state versus the other two states of a qutrit. We observe on average 10 photons at 369.5 nm for the |1〉 or the |2〉 state and detect no photon for the |3〉 state. The state detection error rates for wrongly registering the state |3〉 and missing the state |3〉 are 0.9% and 1.9%, respectively, with the discrimination threshold n_ph = 1. As shown in Fig. 2(b), we transfer the information of obervable A_i (A_j) by π-pulse and apply the measurement sequence. Then we assign the value a_i = 1 (a_j = 1) on the obsevable A_i (A_j) when photons detected or a_i = −1 (a_j = −1) when no photons are detected. After repeating the same experimental procedures, we obtain the 〈A_i〉 (〈A_j〉). Here we emphasize that our setup is not subject to detection loophole and provide a value of the measurement at every trial.

Random test

We apply the random tests that are appropriate for the size of our random numbers, which are ‘Frequency’, ‘Block Frequency’, Cumulative Sums (Cusums)’, ‘Runs’, ‘Longest-Run-of-Ones in a Block (LROB)’, ‘Rank’, ‘Discrete Fourier Transform Test (FTT)’, ‘Approximate Entropy (AE), ‘Serial.’ The p-values of all the test, which are the probabilities that an ideal random number generator would produce less random sequence than the tested one. Therefore, a p-value of 0 simply means that the tested sequence appears to be completely non-random, whereas a p-value of 1 implies that the sequence in test appears to be perfectly random. The p-values lie in the open interval (0, 1) and if p-value is larger than a significance level θ, we accept the sequence as random for the test. Typically θ is chosen to be in the range [0.0001, 0.01] and we set θ = 0.01. Note that we use Von-Neumann extractor for the output strings to make uniform distributions, which reduces the size of random numbers to one quarter. We also note that the random tests are different from guaranteeing the amount of min-entropy in the generated string. In other words, even the data could not pass the random tests but still have the quoted min-entropy.

Author Contributions

M.U., X.Z., J.Z. and Y.W. developed the experimental setup for the measurements. M.U., X.Z., J.Z., Y.W. and S.Y. carried out the measurements. M.U. analyzed the data and D.L.D., L.M.D. provided the theoretical support. K.K. supervised the experiment. All authors participated in writing the manuscript.