Certifying Quantum Randomness by Probability Estimation

Abstract

We introduce probability estimation, a broadly applicable framework to certify randomness in a finite sequence of measurement results without assuming that these results are independent and identically distributed. Probability estimation can take advantage of verifiable physical constraints, and the certification is with respect to classical side information. Examples include randomness from single-photon measurements and device-independent randomness from Bell tests. Advantages of probability estimation include adaptability to changing experimental conditions, unproblematic early stopping when goals are achieved, optimal randomness rates, applicability to Bell tests with small violations, and unsurpassed finite-data efficiency. We greatly reduce latencies for producing random bits and formulate an associated rate-tradeoff problem of independent interest. We also show that the latency is determined by an information-theoretic measure of nonlocality rather than the Bell violation.

Randomness is a key enabling resource for computation and communication. Besides being required for Monte-Carlo simulations and statistical sampling, private random bits are needed for initiating authenticated connections and establishing shared keys, both common tasks for browsers, servers and other online entities [1]. Public random bits from “randomness beacons” have applications to fair resource sharing [2] and can seed private randomness sources based on quantum mechanics [3]. Common requirements for random bits are that they are unpredictable to all before they are generated, and private to the users before they are published.

Quantum mechanics provides natural opportunities for generating randomness. The best known example involves measuring a two-level system that is in an equal superposition of its two levels. A disadvantage of such schemes is that they require trust in the measurement apparatus, and undiagnosed failures are always a possibility. This disadvantage is overcome by a loophole-free Bell test [4, 5], which can generate output whose randomness can be certified solely by statistical tests of setting and outcome frequencies. The devices preparing the quantum states and performing the measurements may come from an untrusted source. This strategy for certified randomness generation is known as device-independent randomness generation (DIRG).

Loophole-free Bell tests have been realized with nitrogen-vacancy (NV) centers [6], with atoms [7] and with photons [8, 9], enabling the possibility of full experimental implementations of DIRG. However, for NV centers and atoms, the rate of trials is too low, and for photons, the violation per trial is too small. As a result, previously available DIRG protocols [3, 10–18] are not ready for implementation with current loophole-free Bell tests. These protocols do not achieve good finite-data efficiency and therefore require an impractical number of trials. Experimental techniques will improve, but for many applications of randomness generation, including randomness beacons and key generation, it is desirable to achieve finite-data efficiency that is as high as possible, since these applications often require short blocks of fresh random bits with minimum delay or latency.

Excellent finite-data efficiency was achieved by a method that we described and implemented in Refs. [19, 20], which reduced the time required for generating 1024 low-error random bits with respect to classical side information from hours to minutes for a state-of-the-art photonic loophole-free Bell test. The method in Refs. [19, 20] is based on the prediction-based ratio (PBR) analysis [21] for hypothesis tests of local realism. Specifically, in Refs. [19, 20] we established a connection between the PBR-based p-value and the amount of randomness certified against classical side information. The basis for success of the method of Refs. [19, 20] motivates our development of probability estimation for randomness certification, with better finite-data efficiency and with broader applications.

In the probability estimation framework, the amount of certified randomness is directly estimated without relying on hypothesis tests of local realism. To certify randomness, we first obtain a bound on the conditional probability of the observed outcomes given the chosen settings, valid for all classical side information. Then we show how to obtain conditional entropy estimates from this bound to quantify the number of extractable random bits [22]. By focusing on data-dependent probability estimates, we are able to take advantage of powerful statistical techniques to obtain the desired bound. The statistical techniques are based on test supermartingales [23] and Markov’s bounds. Probability estimation inherits several features of the theory of test supermartingales. For example, probability estimation has no independence or stationarity requirement on the probability distribution of trial results. Also, probability estimation supports stopping the experiment early, as soon as the randomness goal is achieved.

Probability estimation is broadly applicable. In particular it is not limited to device-independent scenarios and can be applied to traditional randomness generation with quantum devices. Such applications are enabled by the notion of models, which are sets of probability distributions that capture verified, physical constraints on device behavior. In the case of Bell tests, these constraints include the familiar non-signaling conditions [24, 25]. In the case of two-level systems such as polarized photons, the constraints can capture that measurement angles are within a known range, for example.

In this paper, we first describe the technical features of probability estimation and the main results that enable its practical use. We propose a general information-theoretic rate-tradeoff problem that closely relates to finite-data efficiency. We then show how the general theoretical concepts are instantiated in experimentally relevant examples involving Bell-test configurations. We demonstrate advantages of probability estimation such as its optimal asymptotic randomness rates and show large improvements in finite-data efficiency, which corresponds to great reductions in latency.

Theory.

Consider an experiment with “inputs” Z and “outputs” C. The inputs normally consist of the random choices made for measurement settings but may include choices of state preparations such as in the protocols of Refs. [26, 27]. The outputs consist of the corresponding measurement outcomes. In the cases of interest, the inputs and outputs are obtained in a sequence of n time-ordered trials, where the i’th trial has input Z_i and output C_i, and $\mathbf{Z}={(Z_i)}_{i=1}^n$ and $\mathbf{C}={(C_i)}_{i=1}^n$. We assume that Z_i and C_i are countable-valued. We refer to the trial inputs and outputs collectively as the trial “results”, and to the trials preceding the upcoming one as the “past”. The party with respect to which the randomness is intended to be unpredictable is represented by an external classical system, whose initial state before the experiment may be correlated with the devices used. The classical system carries the side information E, which is assumed to be countable-valued. After the experiment, the joint of Z, C and E is described by a probability distribution μ. The upper-case symbols introduced in this paragraph are treated as random variables. As is conventional, their values are denoted by the corresponding lower-case symbols.

The amount of extractable uniform randomness in C conditional on both Z and E is quantified by the (classical) smooth conditional min-entropy $H_{\min }^{ϵ}{(\mathbf{C}\mid \mathbf{Z}E)}_{\mu }$ where ϵ is the “error bound” (or “smoothness”) and μ is the joint distribution of Z, C and E. One way to define the smooth conditional min-entropy is with the conditional guessing probability P_guess(C|ZE)_μ defined as the average over values z and e of the maximum conditional probability max_c μ(c|ze). The ϵ-smooth conditional min-entropy $H_{\min }^{ϵ}{(\mathbf{C}\mid \mathbf{Z}E)}_{\mu }$ is the greatest lower bound of −log₂ P_guess(C|ZE)_μ′ for all distributions μ′ within total-variation distance ϵ of μ. Our goal is to obtain lower bounds on $H_{\min }^{ϵ}{(\mathbf{C}\mid \mathbf{Z}E)}_{\mu }$ with probability estimation.

The application of probability estimation requires a notion of models. A model $\mathcal{H}$ for an experiment is defined as the set of all probability distributions of Z and C achievable in the experiment conditionally on values e of E. If a joint distribution μ of Z, C and E satisfies that for all e, the conditional distributions μ(CZ|e), considered as distributions of Z and C, are in $\mathcal{H}$, we say that the distribution μ satisfies the model $\mathcal{H}$.

To apply probability estimation to an experiment consisting of n time-ordered trials, we construct the model $\mathcal{H}$ for the experiment as a chain of models ${\mathcal{C}}_i$ for each individual trial i in the experiment. The trial model ${\mathcal{C}}_i$ is defined as the set of all probability distributions of trial results C_iZ_i achievable at the i’th trial conditionally on both the past trial results and the side information E. For example, for Bell tests, ${\mathcal{C}}_i$ may be the set of non-signaling distributions with uniformly random inputs. Let ${\mathbf{z}}_{<i}={(z_j)}_{j=1}^{i-1}$ and ${\mathbf{c}}_{<i}={(c_j)}_{j=1}^{i-1}$ be the results before the i’th trial. The sequences z_≤i and c_≤i are defined similarly. The chained model $\mathcal{H}$ consists of all conditional distributions μ(CZ|e) satisfying the following two conditions. First, at each trial i the conditional distributions μ(C_iZ_i|c_<iz_<ie) for all c_<i, z_<i and e are in the trial model ${\mathcal{C}}_i$. Second, at each trial i the input Z_i is independent of the past outputs C_<i given E and the past inputs Z_<i. The second condition prevents leaking information about the past outputs through the future inputs, which is necessary for certifying randomness in the outputs C conditional on both the inputs Z and the side information E. In the common situation where the inputs are chosen independently with distributions known before the experiment, the second condition is always satisfied.

Since the model $\mathcal{H}$ consists of all conditional distributions μ(CZ|e) regardless of the value e, the analyses in the next paragraph apply to the worst-case conditional distribution over e. To simplify notation we normally write the distribution μ(CZ|e) conditional on e as μ_e(CZ), abbreviated as μ_e.

To estimate the conditional probability μ_e(c|z), we design trial-wise probability estimation factors (PEFs) and multiply them. Consider a generic trial with trial model $\mathcal{C}$, where for generic trials, we omit the trial index. Let β > 0. A PEF with power β for $\mathcal{C}$ is a function F : cz ↦ F(cz) ≥ 0 such that for all $\sigma \in \mathcal{C}$, ${\mathbb{E}}_{\sigma }(F(\mathit{CZ})\sigma {(C\mid Z)}^{\beta })\le 1$, where $\mathbb{E}$ denotes the expectation functional. Note that F(cz) = 1 for all cz defines a valid PEF with each positive power. For each i, let F_i be a PEF with power β for the i’th trial, where the PEF can be chosen adaptively based on the past results c_<iz_<i. Other information from the past may also be used, see Ref. [28]. Let T₀ = 1 and $T_i={\prod }_{j=1}^i{F}_j(C_j{Z}_j).$ The final value T_n of the running product T_i, where n is the total number of trials in the experiment, determines the probability estimate. Specifically, for each value e of E, each μ_e in the chained model $T_i={\Pi }_{j=1}^i{F}_j(C_j{Z}_j)$, and ϵ > 0, we have

$${\mathbb{P}}_{{\mu }_e}({\mu }_e(\mathbf{C}|\mathbf{Z})\ge U(\mathbf{CZ}))\le ϵ,$$ (1)

where ${\mathbb{P}}_{{\mu }_e}$ denotes the probability according to the distribution μ_e and U(CZ) = (ϵT_n)^−1/β. The proof of Eq. (1) is given in Appendix C1. The meaning of Eq. (1) is as follows: For each e and each ${\mu }_e\in \mathcal{H}$, the probability that C and Z take values c and z for which U(C = c, Z = z) ≤ μ_e (C = c|Z = z) is at most ϵ. This defines U(CZ) = (ϵT_n)^−1/β as a level-ϵ probability estimator.

A main theorem of probability estimation is the connection between probability estimators and conditional min-entropy estimators, which is formalized as follows:

Theorem 1. Suppose that the joint distribution μ of Z, C and E satisfies the chained model $\mathcal{H}$. Let 1 ≥ κ, ϵ > 0 and 1 ≥ p ≥ 1/|Rng(C)|, where |Rng(C)| is the number of possible outputs. Define {ϕ} to be the event that T_n ≥ 1/(p^βϵ), and let $\kappa \le {\mathbb{P}}_{\mu }(\varphi )$. Then the smooth conditional min-entropy satisfies

$$H_{\min }^{ϵ}(\mathbf{C}|\mathbf{Z}E;\varphi )\ge -{\log }_2(p/k^{1+1/\beta }).$$

The probability of the event {ϕ} can be interpreted as the probability that the experiment succeeds, and κ is an assumed lower bound on the success probability. The theorem is proven in Appendix C2.

When constructing PEFs, the power β > 0 must be decided before the experiment and cannot be adapted. Thm. 1 requires that p, ϵ and κ also be chosen beforehand, and success of the experiment requires T_n ≥ 1/(p^β ϵ), or equivalently,

$${\log }_2(T_n)/\beta +{\log }_2(ϵ)/\beta \ge -{\log }_2(p).$$ (2)

Since log₂(T_n) = ∑_i log₂(F_i), before the experiment we choose PEFs in order to aim for large expected values of the logarithms of the PEFs F_i. Consider a generic next trial with results CZ and model $\mathcal{C}$. Based on prior calibrations or the frequencies of observed results in past trials, we can determine a distribution $\nu \in \mathcal{C}$ that is a good approximation to the distribution of the next trial’s results CZ. Many experiments are designed so that each trial’s distribution is close to ν. The PEF can be optimized for this distribution but, by definition, is valid regardless of the actual distribution of the next trial in $\mathcal{C}$. Thus, one way to optimize PEFs before the next trial is as follows:

$$\begin{gathered} \mathrm{Max}:{\mathbb{E}}_v(n{\log }_2(F(CZ))/\beta +{\log }_2(ϵ)/\beta ) \\ \text{With}:{\sum }_{cz}F(cz)\sigma {(c|z)}^{\beta }\sigma (cz)\le 1\text{for all}\sigma \in \mathcal{C}, \\ F(cz)\ge 0,\text{for all}\mathit{cz}. \end{gathered}$$ (3)

The objective function is strictly concave and the constraints are linear, so there is a unique maximum, which can be found by convex programming. More details are available in Appendix E.

Before the experiment, one can also optimize the objective function in Eq. (3) with respect to the power β. During the experiment ϵ and β are fixed, so it suffices to maximize ${\mathbb{E}}_{\nu }({\log }_2(F(\mathit{CZ})))$. If during the experiment, the running product T_i with i < n exceeds the target 1/(p^β ϵ), we can set future PEFs to F(CZ) = 1, which is a valid PEF with power β. This ensures that T_n = T_i and is equivalent to stopping the experiment after trial i. Since the target needs to be set conservatively in order to make the actual experiment succeed with high probability, this can result in a significant reduction in the number of trials actually executed.

A question is how PEFs perform asymptotically for a stable experiment. This question is answered by determining the rate per trial of entropy production assuming constant ϵ and κ independent of the number of trials. In view of Thm. 1, after n trials the entropy rate is given by (−log₂(p) + log₂(κ^1+1/β))/n. Considering Eq. (2), when n is large the entropy rate is dominated by log₂(T_n)/(nβ), which is equal to ${\Sigma }_{i=1}^n{\log }_2(F_i)∕(n\beta )$. Therefore, if each trial has distribution ν and each trial model is the same $\mathcal{C}$, then in the limit of large n the asymptotic entropy rate witnessed by a PEF F with power β is given by ${\mathbb{E}}_{\nu }({\log }_2(F(\mathit{CZ}))∕\beta )$. Define the rate

$$g(\beta )=\underset{F}{\sup }{\mathbb{E}}_{\nu }({\log }_2(F(CZ))/\beta ),$$ (4)

where the supremum is over PEFs F with power β for $\mathcal{C}$. The maximum asymptotic entropy rate at constant ϵ and κ witnessed by PEFs is g₀ = sup_β>0 g(β). The rate g(β) is non-increasing in β (see Appendix D), so g₀ is determined by the limit as β goes to zero. A theorem proven in Ref. [28] is that g₀ is the worst-case conditional entropy H(C|ZE) over joint distributions of CZE allowed by $\mathcal{C}$ with marginal ν. Since this is a tight upper bound on the asymptotic randomness rate [29], probability estimation is asymptotically optimal and we identify g₀ as the asymptotic randomness rate. We also remark that probability estimation enables exponential expansion of input randomness [28].

For finite data and applications requiring fresh blocks of randomness, the rate g₀ is not achieved. To understand why, consider the problem of certifying a fixed number of bits b of randomness at error bound ϵ and with as few trials as possible, where each trial has distribution ν. In view of Thm. 1, the PEF optimization problem in Eq. (3), and the definition of g(β) in Eq. (4), n needs to be sufficiently large so that

$$ng(\beta )+{\log }_2(ϵ)/\beta +(1+1/\beta ){\log }_2(\kappa )\ge b.$$ (5)

The left-hand side is maximized at positive β, whereas g(β) increases to g₀ as β goes to zero. As a result the best actual rate b/n is less than g₀.

Setting κ = 1 in Eq. (5) shows that the number of trials n must exceed −log₂(ϵ)/(β_g(β)) before randomness can be produced, which suggests that the maximum of β_g(β) is a good indicator of finite-data performance. Another way to arrive at this quantity is to consider ϵ = 2^−γn, where γ > 0 is the “certificate rate”. Given ν and the trial model, we can ask for the maximum certificate rate for which it is possible to have positive entropy rate at κ = 1. It follows from Eq. (5) with κ = 1 that this rate is at most

$${\gamma }_{\mathrm{PEF}}=\underset{\beta >0}{\text{sup}}\beta g(\beta ).$$ (6)

We propose a general information-theoretic rate-tradeoff problem given trial model $\mathcal{C}$ and $\nu \in \mathcal{C}$: For a given certificate rate γ, determine the supremum of the entropy rates achievable by protocols. Eq. (5) implies lower bounds on the resulting tradeoff curve.

Our protocol assumes classical-only side information. There are more costly DIRG protocols that handle quantum side information [11, 13–17], but verifying that side information is effectively classical only requires confirming that the quantum devices used in the experiment have no long-term quantum memory. Verifying the absence of long-term quantum memory in current experiments is possibly less difficult than ensuring that there are no backdoors or information leaks in the experiment’s hardware and software.

Applications.

We consider DIRG with the standard two-party, two-setting, two-outcome Bell-test configuration [30]. The parties are labeled A and B. In each trial, a source prepares a state shared between the parties, and each party chooses a random setting (their input) and obtains a measurement outcome (their output). We write Z = XY, where X and Y are the inputs of A and B, and C = AB, where A and B are the respective outputs. For this configuration, A, B, X, Y ∈ {0,1}.

Consider the trial model $\mathcal{N}$ consisting of distributions of ABXY with uniformly random inputs and satisfying non-signaling [24]. We begin by determining and comparing the asymptotic randomness rates witnessed by different methods. The rates are usually quantified as functions of the expectation $\widehat{I}$ of the C-HSH Bell function (Eq. G4) for $\widehat{I}>2$ (the classical upper bound). We prove in Appendix G that the maximum asymptotic randomness rate for any $\nu \in \mathcal{N}$ is equal to $(\widehat{I}-2)∕2$, and the rate g₀ witnessed by PEFs matches this value. Most previous studies, such as Refs. [3, 10, 12, 18, 31–33], estimate the asymptotic randomness rate by the singletrial conditional min-entropy H_min(AB|XY E). We determine that $H_{\min }(\mathit{AB}\mid \mathit{XY}E)=-{\log }_2((6-\widehat{I})∕4)<g_0$ when $2<\widehat{I}<4$. As $\widehat{I}$ decreases to 2 the ratio of g₀ to H_min(AB|XYE) approaches 1.386, demonstrating an improvement at small violations.

Next, we investigate finite-data performance. We consider three different families of quantum-achievable distributions of trial results. For the first family ν_E,θ, A and B share the unbalanced Bell state |Φ_θ⟩ = cos θ|00⟩ + sin θ|11⟩ with θ ∈ (0, π/4] and apply projective measurements that maximize $\widehat{I}$. This determines ν_E,θ. This family contains the goal states for many experiments suffering from detector inefficiency. For the second family ν_W,p, A and B share a Werner state $\rho =p\mid {\Psi }_{\pi ∕4}\rangle \langle {\Psi }_{\pi ∕4}\mid +(1-p)1∕4$ with $p\in (1∕\sqrt{2},1]$ and again apply measurements that maximize $\widehat{I}$. Werner states are standard examples in quantum information and are among the worst states for our application. In experiments with photons, measurements are implemented with imperfect detectors. For the third family ν_P,η, A and B use detectors with efficiency η ∈ (2/3, 1) to implement the measurements and to close the detection loophole [34]. They choose the unbalanced Bell state |Φ_θ⟩ and measurements such that an information-theoretic measure of nonlocality, the statistical strength for rejecting local realism [35–37], is maximized.

For each family of distributions, we determine the maximum certificate rate γ_PEF as given in Eq. (6). For this, we consider the trial model $\mathcal{N}$, but we note that γ_PEF does not depend on the specific constraints on the quantum-achievable conditional distributions $\mathbb{P}(\mathit{AB}\mid \mathit{XY})$ (see Appendix F). As an indicator of finite-data performance, γ_PEF depends not only on $\widehat{I}$, but also on the distribution ν. To illustrate this behavior, we plot the rates γ_PEF as a function of $\widehat{I}$ for each family of distributions in Fig. 1. To obtain these plots, we note that $\widehat{I}$ is a monotonic function of the parameter θ, p or η for each family. We also find that γ_PEF is given by the statistical strength of the distribution ν for rejecting local realism (see Appendix F for a proof). Conventionally, experiments are designed to maximize $\widehat{I}$, but in general, the optimal state and measurements maximizing $\widehat{I}$ are different from those maximizing the statistical strength [36, 37].

FIG. 1:

Maximum certificate rates γ_PEF (Eq. (6)) as a function of $\widehat{I}$ for each family of distributions.

We further determine the minimum number of trials, n_PEF,b, required to certify b bits of ϵ-smooth conditional min-entropy with a given distribution ν of trial results. From Eq. (5), we get

$$n_{\mathrm{PEF},b}=\underset{\beta >0}{\inf }\frac{b\beta -{\log }_2(ϵ)-(1+\beta ){\log }_2(\kappa )}{\beta g(\beta )},$$

where for simplicity we allow non-integer values for n_PEF,b. We can upper bound n_PEF,b by means of the simpler-to-compute certificate rate γ_PEF given in Eq. (6). For the trial model $\mathcal{N}$, γ_PEF is achieved when β is above a threshold β₀ that depends on ν (see Appendix F). From γ_PEF and β₀, we can determine the upper bound

$$n_{\mathrm{PEF},b}^{\prime }=(b{\beta }_0-{\log }_2(ϵ)-(1+{\beta }_0){\log }_2(\kappa ))/{\gamma }_{\mathrm{PEF}}$$

on n_PEF,b. The minimum number of trials required can be determined for other published protocols, which usually certify conditional min-entropy from $\widehat{I}$. (An exception is Ref. [18] but the minimum number of trials required is worse.) We consider the protocol “PM” of Ref. [3] and the entropy accumulation protocol “EAT” of Ref. [17]. From Thm. 1 of Ref. [3] with κ = 1 and b ↘ 0, we obtain a lower bound

$$n_{\mathrm{PM},0}=-2{\log }_e(ϵ)/{((\widehat{I}-2)/(4+2\sqrt{2}))}^2.$$

For the EAT protocol, we determine an explicit lower bound n_EAT,b in Appendix H. This lower bound applies for b ≥ 0 and ϵ, κ, ∈ (0, 1], and is valid with respect to quantum side information for the trial model consisting of quantum-achievable distributions.

We compare the three protocols over a broad range of $\widehat{I}$ for b ↘ 0, ϵ = 10⁻⁶, and κ = 1. For each family of distributions above, we compute the improvement factors given by $f_{\mathrm{PM}}=n_{\mathrm{PM},0}∕n_{\mathrm{PEF},0}^{\prime }$ and $f_{\mathrm{EAT}}=n_{\mathrm{EAT},0}∕n_{\mathrm{PEF},0}^{\prime }$. For ν_W,p the improvement factors depend weakly on $\widehat{I}:f_{\mathrm{PM}}$ increases from 3.89 at $\widehat{I}=2.008\text{to}4.36$ at $\widehat{I}=2\sqrt{2}$, while f_EAT increases from 84.97 at $\widehat{I}=2.008\text{to}86.35$ at $\widehat{I}=2\sqrt{2}$. For ν_E,θ and ν_P,η, the improvement factors can be much larger and depend strongly on $\widehat{I}$, monotonically decreasing with $\widehat{I}$ as shown in Fig. 2. The improvement is particularly notable at small violations which are typical in current photonic loophole-free Bell tests. We remark that similar comparison results were obtained with other choices of the values for ϵ and κ.

FIG. 2:

Improvement factors as a function of $\widehat{I}$.

The large latency reduction with probability estimation persists for certifying blocks of randomness. For randomness beacons, good reference values are b = 512 and ϵ = 2⁻⁶⁴. We also set κ = 2⁻⁶⁴. Setting κ = ϵ is a common conservative choice, but we remark that soundness for randomness generation can be defined with a better tradeoff between ϵ and κ [28]. We consider the trial model $\mathcal{T}$ of distributions with uniformly random inputs, satisfying both non-signaling conditions [24] and Tsirelson’s bounds [38]. Consider the state-of-the-art photonic loophole-free Bell test reported in Ref. [20]. With probability estimation, the number of trials required for the distribution inferred from the measurement statistics is 4.668 × 10⁷, which would require about 7.78 minutes of running time in the referenced experiment. With entropy accumulation [17], 2.887 × 10¹¹ trials taking 802 hours would be required. For atomic experiments, we can use the distribution inferred from the measurement statistics in Ref. [7], for which probability estimation requires 7.354 × 10⁴ trials, while entropy accumulation [17] requires 5.629 × 10⁶. The experiment of Ref. [7] observed 1 to 2 trials per minute, so probability estimation would have needed at least 612.8 hours of data collection, which while impractical is still less than the 5.35 years required by entropy accumulation [17].

Finally, we briefly discuss the performance of probability estimation on DIRG with published Bell-test experimental data. The first experimental demonstration of conditional min-entropy certification for DIRG is reported in Ref. [10]. The method therein certifies the presence of 42 random bits at error bound ϵ = 10⁻² against classical side information, where the trial model consists of quantum-achievable distributions with uniform inputs. (The lower bound of the protocol success probability κ = 1 was used implicitly in Ref. [10], so κ = 1 in the following comparison.) For the same data but with the less restrictive trial model $\mathcal{T}$, probability estimation certifies the presence of at least nine times more random bits with ϵ = 10⁻². With ϵ = 10⁻⁶ probability estimation can still certify the presence of 80 random bits, while other methods fail to certify any random bits. For the loophole-free Bell-test data reported in Ref. [9] and analyzed in our previous work Ref. [19], the presence of 894 random bits at ϵ = 10⁻³ was certified against classical side information with the trial model $\mathcal{N}$. Further, 256 private random bits within 10⁻³ (in terms of the total-variation distance) of uniform were extracted in Ref. [19]. With probability estimation we can certify the presence of approximately two times more random bits at ϵ = 10⁻³. The presence of four times more bits can be certified if we use the more restrictive trial model $\mathcal{T}$. Furthermore, we can certify randomness even when the input distribution is not precisely known, which was an issue in the experiment of Ref. [9]. Applications to other experimental distributions, complete analyses of the mentioned experiments, and details on handling input choices whose probabilities are not precisely known are in Ref. [28].

In conclusion, probability estimation is a powerful and flexible framework for certifying randomness in data from a finite sequence of experimental trials. Implemented with probability estimation factors, it witnesses optimal asymptotic randomness rates. For practical applications requiring fixed-size blocks of random bits, it can reduce the latencies by orders of magnitude even for high-quality devices. Latency is a notable problem for device-independent quantum key generation (DIQKD). If probability estimation can be extended to accommodate security against quantum side information, the latency reductions may be extendable to DIQKD by means of existing constructions [17].

Finally we remark that if the trial results are explainable by local realism, no device-independent randomness would be certified by probability estimation. The reason is as follows. For simplicity we assume that the input distribution is fixed and known [52]. Consider a generic trial with results CZ and model $\mathcal{C}$. Let ${\mathcal{P}}_{\mathrm{LR}}$ be the set of distributions of CZ explainable by local realism, which is a convex polytope with a finite number of extremal distributions σ_LR,k, k = 1, 2, …, K. Since ${\mathcal{P}}_{\mathrm{LR}}$ is a subset of $\mathcal{C}$, by definition a PEF F with power β satisfies the condition

$$\sum _{cz}F(cz){\sigma }_{\mathrm{LR},k}{(c|z)}^{\beta }{\sigma }_{\mathrm{LR},k}(cz)\le 1,$$ (7)

for each k. For each extremal distribution σ_LR,k in ${\mathcal{P}}_{\mathrm{LR}}$ and each cz, the value of σ_LR,k,(c|z) is either 0 or 1, from which it follows that σ_LR,k(c|z)^β σ_LR,k(cz) = σ_LR,k(cz). Eq. (7) now becomes

$${\mathbb{E}}_{{\sigma }_{\mathrm{LR},k}}(F(CZ))=\sum _{cz}F(cz){\sigma }_{\mathrm{LR},k}(cz)\le 1.$$ (8)

Since any local realistic distribution can be written as a convex mixture of extremal distributions σ_LR,k, k = 1, 2, …, K, Eq. (8) implies that for all distributions $\nu \in {\mathcal{P}}_{\mathrm{LR}}$

$${\mathbb{E}}_{\nu }(F(CZ))\le 1.$$ (9)

By the concavity of the logarithm function and Eq. (9) we get that

$${\mathbb{E}}_{\nu }({\log }_2(F(CZ)))\le {\log }_2({\mathbb{E}}_{\nu }(F(CZ)))\le 0.$$

Hence, the asymptotic entropy rate in Eq. (4) cannot be positive if the distribution of trial results is explainable by local realism. Furthermore, Eq. (9) shows that the PEF F is a test factor for the hypothesis test of local realism [21] (see Appendix B for the formal definition of test factors). So, if a finite sequence of trial results is explainable by local realism and F_i is a PEF with power β for the i’th trial, according to Ref. [21] the success event T_n ≥ 1/(p^β ϵ) with $T_n={\Pi }_{i=1}^n{F}_i$ in Thm. 1 for randomness certification would happen with probability at most p^β ϵ.

Appendix

Appendix A: Notation

Much of this work concerns stochastic sequences, that is, sequences of random variables (RVs). RVs are functions on an underlying probability space. The range of an RV is called its value space and may be thought of as the set of its observable values or realizations. Here, all RVs have countable value spaces. We truncate sequences of RVs so that we only consider finitely many RVs at a time. With this the underlying probability space is countable too. We use upper-case letters such as A, B, …, X, Y, … to denote RVs. The value space of an RV such as X is denoted by Rng(X). The cardinality of the value space of X is |Rng(X)|. Values of RVs are denoted by the corresponding lower-case letters. Thus x is a value of X, often thought of as the particular value realized in an experiment. When using symbols for values of RVs, they are implicitly assumed to be members of the range of the corresponding RV. In many cases, the value space is a set of letters or a set of strings of a given length. We use juxtaposition to denote concatenation of letters and strings. Stochastic sequences are denoted by capital bold-face letters, with the corresponding lower-case bold-face letters for their values. For example, we write $\mathbf{A}={(A_i)}_{i=1}^N$ and ${\mathbf{A}}_{\le m}={(A_i)}_{i=1}^m$. Our conventions for indices are that we generically use N to denote a large upper bound on sequence lengths, n to denote the available length and i,j,k,l,m as running indices. By convention, A_≤0 is the empty sequence of RVs. Its value is constant. When multiple stochastic sequences are in play, we refer to the collection of i’th RVs in the sequences as the data from the i’th trial. We typically imagine the trials as happening in time and being performed by an experimenter. We refer to the data from the trials preceding the upcoming one as the “past”. The past can also include initial conditions and any additional information that may have been obtained. These are normally implicit when referring to or conditioning on the past.

Probabilities are denoted by $\mathbb{P}(\dots )$. If there are multiple probability distributions involved, we disambiguate with a subscript such as in ${\mathbb{P}}_{\nu }(\dots )$ or simply ν(…), where ν is a probability distribution. We generally reserve the symbol μ for the global, implicit probability distribution, and may write μ(…) instead of $\mathbb{P}(\dots )$ or ${\mathbb{P}}_{\mu }(\dots )$. Expectations are similarly denoted by $\mathbb{E}(\dots )$ or ${\mathbb{E}}_{\mu }(\dots )$. If ϕ is a logical expression involving RVs, then {ϕ} denotes the event where ϕ is true for the values realized by the RVs. For example, {f(X) > 0} is the event {x : f(x) > 0} written in full set notation. The brackets {…} are omitted for events inside $\mathbb{P}(\dots )$ or $\mathbb{E}(\dots )$. As is conventional, commas separating logical expressions are interpreted as conjunction. When the capital/lower-case convention can be unambiguously interpreted, we abbreviate “X = x” as “x”. For example, with this convention, $\mathbb{P}(x,y)=\mathbb{P}(X=x,Y=y)$. Furthermore, we omit commas in the abbreviated notation, so $\mathbb{P}(\mathit{xy})=\mathbb{P}(x,y)$. RVs or functions of RVs appearing outside an event but inside $\mathbb{P}(\dots )$ or after the conditioner in $\mathbb{E}(\dots \mid \dots )$ result in an expression that is itself an RV. We can define these without complications because of our assumption that the event space is countable. Here are two examples. $\mathbb{P}(f(X)\mid Y)$ is a function of the RVs X and Y and can be described as the RV whose value is $\mathbb{P}(f(X)=f(x)\mid Y=y)$ whenever the values of X and Y are x and y, respectively. Similarly $\mathbb{E}(X\mid Y)$ is the RV defined as a function of Y, with value $\mathbb{E}(X\mid Y=y)$ whenever Y has value y. Note that X plays a different role before the conditioners in $\mathbb{E}(\dots )$ than it does in $\mathbb{P}(\dots )$, as $\mathbb{E}(X\mid Y)$ is not a function of X, but only of Y. We comment that conditional probabilities with conditioners having probability zero are not well-defined, but in most cases can be defined arbitrarily. Typically, they occur in a context where they are multiplied by the probability of the conditioner and thereby contribute zero regardless. An important context involves expectations, where we use the convention that when expanding an expectation over a set of values as a sum, zero-probability values are omitted. We do so without explicitly adding the constraints to the summation variables. We generally use conditional probabilities without explicitly checking for probability-zero conditioners, but it is necessary to monitor for well-definedness of the expressions obtained.

To denote general probability distributions, usually on the joint value spaces of RVs, we use symbols such as μ, ν, σ, with modifiers as necessary. As mentioned, we reserve the unmodified μ for the distinguished global distribution under consideration, if there is one. Other symbols typically refer to probability distributions defined on the joint range of a subset of the available RVs. We usually just say “distribution” instead of “probability distribution”. The terms “distributions on Rng(X)” and “distributions of X” are synonymous. If ν is a joint distribution of RVs, then we extend the conventions for arguments of $\mathbb{P}(\dots )$ to arguments of ν, as long as all the arguments are determined by the RVs for which ν is defined. For example, if ν is a joint distribution of X, Y, and Z, then ν(x|y) has the expected meaning, as does the RV ν(X|Y) in contexts requiring no other RVs. Further, ν(X) and ν(XY) are the marginal distributions of X and XY, respectively, according to ν.

In our work, probability distributions are constrained by a “model”, which is defined as a set of distributions and denoted by letters such as $\mathcal{H}$ or $\mathcal{C}$. The models for trials to be considered here are usually convex and closed.

The total-variation (TV) distance between ν and ν′ is defined as

$$\mathrm{TV}(\nu ,\nu \prime )=\sum _x(\nu (x)-\nu \prime (x))⟦\nu (x)\ge \nu \prime (x)⟧=\frac{1}{2}\sum _x\left|\nu (x)-\nu \prime (x)\right|,$$ (A1)

where ⟦ϕ⟧ for a logical expression ϕ denotes the {0,1}-valued function evaluating to 1 iff ϕ is true. True to its name, the TV distance satisfies the triangle inequality. Here are three other useful properties: First, if ν and ν′ are joint distributions of X and Y and the marginals satisfy ν(Y) = ν′(Y), then the TV distance between ν and ν′ is the average of the TV distances of the Y-conditional distributions:

$$\mathrm{TV}(v,v\prime )=\sum _{y}v(y)\mathrm{TV}(v(X|y),v\prime (X|y)).$$ (A2)

Second, if for all y, the conditional distributions ν(X|y) = ν′(X|y), then the TV distance between ν and ν′ is given by the TV distance between the marginals on Y:

$$\mathrm{TV}(v,v\prime )=\mathrm{TV}(v(Y),v\prime (Y)).$$ (A3)

Third, the TV distance satisfies the data-processing inequality. That is, for any stochastic process $\mathcal{E}$ on Rng(X) and distributions ν and ν′ of X, $\mathrm{TV}(\mathcal{E}(\nu ),\mathcal{E}({\nu }^{\prime }))\le \mathrm{TV}(\nu ,{\nu }^{\prime })$. We use this property only for functions $\mathcal{E}$, but for general forms of this result, see Ref. [39]. The above properties of TV distances are well known, specific proofs can be found in Refs. [20, 28].

When constructing distributions close to a given one in TV distance, which we need to do for the proof of Thm. 1 in the main text, it is often convenient to work with subprobability distributions. A subprobability distribution of X is a sub-normalized non-negative measure on Rng(X), which in our case is simply a non-negative function $\tilde{\nu }$ on Rng(X) with weight $w(\tilde{\nu })={\Sigma }_x\tilde{\nu }(x)\le 1$. For expressions not involving conditionals, we use the same conventions for subprobability distributions as for probability distributions. When comparing subprobability distributions, $\tilde{\nu }\le {\tilde{\nu }}^{\prime }$ means that for all x, $\tilde{\nu }(x)\le {\tilde{\nu }}^{\prime }(x)$, and we say that ${\tilde{\nu }}^{\prime }$ “dominates” $\tilde{\nu }$.

Lemma 2. Let $\tilde{\nu }$ be a subprobability distribution of X of weight w = 1 − ϵ. Let ν and ν′ be distributions of X satisfying $\tilde{\nu }\le \nu$ and $\tilde{\nu }\le {\nu }^{\prime }$. Then TV(ν, ν′) ≤ ϵ.

Proof. Calculate

$$\begin{gathered} \mathrm{TV}(\nu ,\nu \prime )=\underset{x}{\Sigma }(\nu (x)-\nu \prime (x))⟦\nu (x)\ge \nu \prime (x)⟧ \\ \le \underset{x}{\Sigma }(\nu (x)-\tilde{\nu }(x))⟦\nu (x)\ge \tilde{\nu }(x)⟧ \\ =\underset{x}{\Sigma }(\nu (x)-\tilde{\nu }(x)) \\ =1-w=ϵ. \end{gathered}$$

Lemma 3. Assume that p ≥ 1/|Rng(X)|. Let ν be a distribution of X and $\tilde{\nu }\le \nu$ a subprobability distribution of X with weight w = 1 − ϵ and $\tilde{\nu }\le p$. Then there exists a distribution ν′ of X with ${\nu }^{\prime }\ge \tilde{\nu }$, ν′ ≤ p, and TV(ν, ν′) ≤ ϵ.

Proof. Because p ≥ 1/|Rng(X)|, that is, ∑_x p ≥ 1, and for all x, $\tilde{\nu }(x)\le p$, there exists a distribution ${\nu }^{\prime }\ge \tilde{\nu }$ with $\tilde{\nu }\le p$. Since ν′ and ν are distributions dominating $\tilde{\nu }$ and by Lem. 2, TV(ν, ν′) ≤ ϵ.

Appendix B: Test Supermartingales and Test Factors

Definition 4. A test supermartingale [23] with respect to a stochastic sequence R and model $\mathcal{H}$ is a stochastic sequence $\mathbf{T}={(T_i)}_{i=0}^N$ with the properties that 1) T₀ = 1, 2) for all i T_i ≥ 0, 3) T_i is determined by R_≤i and the governing distribution, and 4) for all distributions in $\mathcal{H}$, $\mathbb{E}(T_{i+1}\mid {\mathbf{R}}_{\le i})\le T_i$. The ratios F_i = T_i/T_i−1 with F_i = 1 if T_i−1 = 0 are called the test factors of T.

Here R captures the relevant information that accumulates in a sequence of trials. It does not need to be accessible to the experimenter. Between trials i and i + 1, the sequence R_≤i is called the past. In the definition, we allow for T_i to depend on the governing distribution μ. With this, for a given μ, T_i is a function of R_≤i Below, when stating that RVs are determined, we implicitly include the possibility of dependence on μ without mention. The μ-dependence can arise through expressions such as ${\mathbb{E}}_{\mu }(G\mid {\mathbf{R}}_{\le i})$ for some G, which is determined by R_≤i given μ. One way to formalize this is to consider μ-parameterized families of RVs. We do not make this explicit and simply allow for our RVs to be implicitly parameterized by μ. We note that the governing distribution in a given experiment or situation is fixed but usually unknown with most of its features inaccessible. As a result, many RVs used in mathematical arguments cannot be observed even in principle. Nevertheless, they play important roles in establishing relationships between observed and inferred quantities.

Defining F_i = 1 when T_i−1 = 0 makes sense because given {T_i−1 = 0}, we have {T_i = 0} with probability 1. The sequence $\mathbf{F}={(F_i)}_{i=1}^N$ satisfies the conditions that for all i, 1) F_i ≥ 0, 2) F_i is determined by R_≤i and 3) for all distributions in $\mathcal{H}$, $\mathbb{E}(F_{i+1}\mid {\mathbf{R}}_{\le i})\le 1$. We can define test supermartingales in terms of such sequences: Let F be a stochastic sequence satisfying the three conditions. Then the stochastic sequence with members T₀ = 1 and T_i = Π_1≤j≤i F_j for i ≥ 1 is a test supermartingale. It suffices to check that $\mathbb{E}(T_{i+1}\mid {\mathbf{R}}_{\le i})\le T_i$. This follows from

$$\mathbb{E}(T_{i+1}|{\mathbf{R}}_{\le i})=\mathbb{E}(F_{i+1}{T}_i|{\mathbf{R}}_{\le i})=\mathbb{E}(F_{i+1}|{\mathbf{R}}_{\le i})T_i\le T_i,$$

where we pulled out the determined quantity T_i from the conditional expectation. In this work, we construct test supermartingales from sequences F with the above properties. We refer to any such sequence as a sequence of test factors, without necessarily making the associated test supermartingale explicit. We extend the terminology by calling an RV F a test factor with respect to $\mathcal{H}$ if F ≥ 0 and $\mathbb{E}(F)\le 1$ for all distributions in $\mathcal{H}$. Note that F = 1 is a valid test factor.

For an overview of test supermartingales and their properties, see Ref. [23]. The notion of test supermartingales and proofs of their basic properties are due to Ville [40] in the same work that introduced the notion of martingales. The name “test supermartingale” appears to have been introduced in Ref. [23]. Test supermartingales play an important theoretical role in proving many results in martingale theory, including that of proving tail bounds for large classes of martingales. They have been studied and applied to Bell tests [21, 41, 42].

The definition implies that for a test supermartingale T, for all n, $\mathbb{E}(T_n)\le 1$. This follows inductively from $\mathbb{E}(T_{i+1})=\mathbb{E}(\mathbb{E}(T_{i+1}\mid {\mathbf{R}}_{\le i}))\le \mathbb{E}(T_i)$ and T₀ = 1. An application of Markov’s inequality shows that for all ϵ > 0,

$$\mathbb{P}(T_n\ge 1/ϵ)\le ϵ.$$ (B1)

Thus, a large final value t = T_n of the test supermartingale is evidence against $\mathcal{H}$ in a hypothesis test with $\mathcal{H}$ as the (composite) null hypothesis. Specifically, the RV 1/T is a p-value bound against $\mathcal{H}$, where in general, the RV U is a p-value bound against $\mathcal{H}$ if for all distributions in $\mathcal{H}$, $\mathbb{P}(U\le ϵ)\le ϵ$.

One can produce a test supermartingale adaptively by determining the test factors F_i+1 to be used at the next trial. If the i’th trial’s data is R_i, including any incidental information obtained, then F_i+1 is expressed as a function of R_≤i and data from the (i + 1)’th trial (a “past-parameterized” function of R_i+1), and constructed to satisfy F_i+1 ≥ 0 and $\mathbb{E}(F_{i+1}\mid {\mathbf{R}}_{\le i})\le 1$ for any distribution in the model $\mathcal{H}$. Note that inbetween trials, we can effectively stop the experiment by assigning all future F_i+1 = 1, which is a valid test factor, conditional on the past. This is equivalent to constructing the stopped process relative to a stopping rule. This argument also shows that the stopped process is still a test supermartingale.

More generally, we use test supermartingales for estimating lower bounds on products of positive stochastic sequences G. Such lower bounds are associated with unbounded-above confidence intervals. We need the following definition:

Definition 5. Let U, V, X be RVs and 1 ≥ ϵ ≥ 0. I = [U, V] is a confidence interval for X at level ϵ with respect to $\mathcal{H}$ if for all distributions in $\mathcal{H}$ we have $\mathbb{P}(U\le X\le V)\ge 1-ϵ$. The quantity $\mathbb{P}(U\le X\le V)$ is called the coverage probability.

As noted above, the RVs U, V and X may be μ-dependent. For textbook examples of confidence intervals such as in Ch. 2.4.3 of Ref [43], X is a parameter determined by μ, and U and V are obtained according to a known distribution for an estimator of X. The quantity e in the definition is a significance level, which corresponds to a confidence level of (1 − ϵ). The following technical lemma will be used in the next section.

Lemma 6. Let F and G be two stochastic sequences with F_i ∈ [0, ∞), G_i ∈ (0, ∞], and F_i and G_i determined by R_≤i. Define T₀ = 1, $T_i={\Pi }_{1\le j\le i}{F}_i$ and U₀ = 1, $U_i={\Pi }_{1\le j\le i}{G}_i$, and suppose that for all $\mu \in \mathcal{H}$, $\mathbb{E}(F_{i+1}∕G_{i+1}\mid {\mathbf{R}}_{\le i})\le 1$. Then [T_nϵ, ∞) is a confidence interval for U_n at level ϵ with respect to $\mathcal{H}$.

Proof. The assumptions imply that the sequence ${(F_i∕G_i)}_{i=1}^N$ forms a sequence of test factors with respect to $\mathcal{H}$ and generate the test supermartingale T/U, where division in this expression is term-by-term. Therefore, by Eq. (B1),

$$\mathbb{P}(T_nϵ\ge U_n)=\mathbb{P}(T_n/U_n\ge 1/ϵ)\le ϵ,$$ (B2)

so [T_nϵ, ∞) is a confidence interval for U_n at level ϵ.

Appendix C: Proof of Main Results

In this section, we show how to perform probability estimation and how to certify smooth conditional min-entropy by probability estimation.

1. Probability Estimation by Test Supermartingales: Proof of Main Text Eq. (1)

We consider the situation where CZ is a time-ordered sequence of n trial results, and the classical side information is represented by an RV E with countable value space. In an experiment, Z and C are the inputs and outputs of the quantum devices, and the side information E is carried by an external classical system E. Before the experiment, the initial state of E may be correlated with the quantum devices. At each trial of the experiment, we allow arbitrary one-way communication from the system E to the devices. For example, E can initialize the state of the quantum devices via a one-way communication channel. We also allow the possibility that the device initialization at a trial by E depends on the past inputs preceding the trial. This implies that the random inputs Z can come from publicrandomness sources, as first pointed out in Ref. [3]. However, at any stage of the experiment the information of the outputs C cannot be leaked to the system E. After the experiment, we observe Z and C, but not the side information E.

A model $\mathcal{H}$ for an experiment is defined as the set of joint probability distributions of CZ that satisfy the known constraints and consists of all achievable probability distributions of CZ conditional on values e of E. Thus we say that a joint distribution μ of CZ and E satisfies the model $\mathcal{H}$ if $\mu (\mathbf{CZ}\mid E=e)\in \mathcal{H}$ for each value e.

We focus on probability estimates with lower bounds on coverage probabilities that do not depend on E. Our specific goal is to prove Eq. (1) in the main text. We will show that the probability bound of U(CZ) = (T_nϵ)^−1/β in Eq. (1) of the main text is an instance of what we call an “ϵ-uniform probability estimator”:

Definition 7. Let 1 ≥ ϵ ≥ 0. The function U : Rng(CZ) → [0, ∞) is a level-ϵ E-uniform probability estimator for $\mathcal{H}$ (ϵ-UPE or with specifics, $ϵ-\mathrm{UPE}(\mathbf{C}\mid \mathbf{Z}E;\mathcal{H})$) if for all e and distributions μ satisfying the model $\mathcal{H}$, we have ${\mathbb{P}}_{\mu }(U(\mathbf{CZ})\ge \mu (\mathbf{C}\mid \mathbf{Z}e)\mid e)\ge 1-ϵ$. We omit specifics such as $\mathcal{H}$ if they are clear from context.

We can obtain ϵ-UPEs by constructing test supermartingales. In order to achieve this goal, we consider models $\mathcal{H}(\mathcal{C})$ of distributions of CZ constructed from a chain of trial models ${\mathcal{C}}_{i+1\mid {\mathbf{c}}_{\le i}{\mathbf{z}}_{\le i}e}$, where the trial model ${\mathcal{C}}_{i+1\mid {\mathbf{c}}_{\le i}{\mathbf{z}}_{\le i}e}$ is defined as the set of all achievable distributions of C_i+1Z_i+1 conditional on both the past results c_≤iz_≤i and the value e of E. The chained model $\mathcal{H}(\mathcal{C})$ consists of all conditional distributions μ(CZ|e) satisfying the following two properties. First, for all i, c_≤iz_≤i, and e, the conditional distributions

$$\mu (C_{i+1}{Z}_{i+1}|{\mathbf{c}}_{{\le }_i\mathbf{z}{\le }_{i}e})\in {\mathcal{C}}_{i+1|{\mathbf{c}}_{\le i}{\mathbf{z}}_{\le i}e}.$$

Second, the joint distribution μ of CZ and E satisfies that Z_i+1 is independent of C_≤i conditionally on both Z_≤i and E. The second condition is needed in order to be able to estimate ZE-conditional probabilities of C and corresponds to the Markov-chain condition in the entropy accumulation framework [17].

In many cases, the trial models ${\mathcal{C}}_{i+1\mid {\mathbf{c}}_{\le i}{\mathbf{z}}_{\le i}e}$ do not depend on the past outputs c_≤i, but probability estimation can take advantage of dependence on the past inputs z_≤i. Such dependence captures the possibility that at the (i + 1)’th trial the device initialization by the external classical system E depends on the past inputs z_≤i. In applications involving Bell-test configurations, the trial models capture constraints on the input distributions and on non-signaling or quantum behavior of the devices. For simplicity, we write ${\mathcal{C}}_{i+1}={\mathcal{C}}_{i+1\mid {\mathbf{c}}_{\le i}{\mathbf{z}}_{\le i}e}$, leaving the conditional parameters implicit. Normally, models for individual trials ${\mathcal{C}}_{i+1}$ are convex and closed. If they are not, we note that our results generally extend to the convex closures of the trial models used.

For chained models $\mathcal{H}(\mathcal{C})$, we can construct ϵ-UPEs from products of “probability estimation factors” according to the following definition, see also the paragraph containing Eq. (1) in the main text.

Definition 8. Let β > 0, and let $\mathcal{C}$ be any model, not necessarily convex. A probability estimation factor (PEF) with power β for $\mathcal{C}$ is a non-negative RV F = F(CZ) such that for all $\sigma \in \mathcal{C}$, ${\mathbb{E}}_{\sigma }(F\sigma {(C\mid Z)}^{\beta })\le 1$.

We emphasize that a PEF is a function of the trial results CZ, but not of the side information E.

Consider the model $\mathcal{H}(\mathcal{C})$ constructed as a chain of trial models ${\mathcal{C}}_i$. Let F_i be PEFs with power β > 0 for ${\mathcal{C}}_i$, past-parameterized by C_≤i and Z_≤i. Define T₀ = 1, $T_i={\Pi }_{1\le j\le i}{F}_j$ for i ≥ 1, and

$$U(\mathbf{CZ})={(T_nϵ)}^{-1/\beta }.$$ (C1)

Then, U(CZ) satisfies the inequality in Eq. (1) of the main text as proven in the following theorem, and is therefore an ϵ-UPE. To simplify notation in the following theorem, we normally write the distribution μ(CZ|e) conditional on e as μ_e(CZ), abbreviated as μ_e.

Theorem 9. Fix β > 0. For each value e of E, each ${\mu }_e\in \mathcal{H}(\mathcal{C})$, and ϵ > 0, the following inequality holds:

$${\mathbb{P}}_{{\mu }_e}({\mu }_e(\mathbf{C}|\mathbf{Z})\ge {(ϵT_n)}^{-1/\beta })\le ϵ.$$ (C2)

Note that β cannot be adapted during the trials. On the other hand, before the i’th trial, we can design the PEFs F_i for the particular constraints relevant to the i’th trial.

Proof. We first observe that for each value e of E,

$$\prod _{j=0}^{i-1}{\mu }_e(C_{j+1}|Z_{j+1}{\mathbf{Z}}_{\le j}{\mathbf{C}}_{\le j})={\mu }_e({\mathbf{C}}_{\le i}|{\mathbf{Z}}_{\le i}).$$ (C3)

This follows by induction with the identity

$$\begin{gathered} {\mu }_e({\mathbf{C}}_{\le j+1}|{\mathbf{Z}}_{\le j+1})={\mu }_e(C_{j+1}|Z_{j+1}{\mathbf{Z}}_{\le j}{\mathbf{C}}_{\le j}){\mu }_e({\mathbf{C}}_{\le j}|Z_{j+1}{\mathbf{Z}}_{\le j}) \\ ={\mu }_e(C_{j+1}|Z_{j+1}{\mathbf{Z}}_{\le j}{\mathbf{C}}_{\le j}){\mu }_e({\mathbf{C}}_{\le j}|{\mathbf{Z}}_{\le j}) \end{gathered}$$

by conditional independence of Z_j+1 on C_≤j given Z_≤j and E = e.

We claim that for each e, F_i+1μ_e(C_i+1|Z_i+1Z_≤iC_≤i)^β is a test factor determined by C_≤i+1Z≤_i+1. To prove this claim, for all c_≤iz_≤i, the distributions $\nu ={\mu }_e(C_{i+1}{Z}_{i+1}\mid {\mathbf{c}}_{\le i}{\mathbf{z}}_{\le i})\in {\mathcal{C}}_{i+1}$. With F_i+1 = F_i+1(C_i+1Z_i+1; c_≤iz_≤i), we obtain the bound

$$\begin{gathered} \mathbb{E}(F_{i+1}{\mu }_e{(C_{i+1}|Z_{i+1}{\mathbf{z}}_{\le i}{\mathbf{c}}_{\le i})}^{\beta }|{\mathbf{c}}_{\le i}{\mathbf{z}}_{\le i})={\mathbb{E}}_{\nu }(F_{i+1}\nu {(C_{i+1}|Z_{i+1})}^{\beta }) \\ \le 1, \end{gathered}$$

where we invoked the assumption that F_i+1 is a PEF with power β for ${\mathcal{C}}_{i+1}$. By arbitrariness of c_≤iz_≤i, and because the factors F_i+1μ_e(C_i+1|Z_≤iC_≤i)^β are determined by C_≤i+1Z_≤i+1, the claim follows. The product of these test factors is

$$\begin{gathered} \prod _{j=0}^{i-1}{F}_{j+1}{\mu }_e{(C_{j+1}|Z_{j+1}{\mathbf{Z}}_{\le j}{\mathbf{C}}_{\le j})}^{\beta }=T_i\prod _{j=0}^{i-1}{\mu }_e{(C_{j+1}|Z_{j+1}{\mathbf{Z}}_{\le j}{\mathbf{C}}_{\le j})}^{\beta } \\ =T_i{\mu }_e{({\mathbf{C}}_{\le i}|{\mathbf{Z}}_{\le i})}^{\beta }, \end{gathered}$$ (C4)

with $T_i={\prod }_{j=1}^i{F}_j$. To obtain the last equality above, we used Eq. (C3). Thus, for each e, the sequence Q₀ = 1 and Q_i = T_iμ_e(C_≤i|Z_≤i)^β for i > 0 satisfies the supermartingale property ${\mathbb{E}}_{{\mu }_e}(Q_{i+1}\mid {\mathbf{C}}_{\le i}{\mathbf{Z}}_{\le i})\le Q_i$. We remark that as a consequence, ${\mathbb{E}}_{{\mu }_e}(Q_{i+1})={\mathbb{E}}_{{\mu }_e}(Q_{i+1}\mid {\mathbf{C}}_{\le i}{\mathbf{Z}}_{\le i}))\le {\mathbb{E}}_{{\mu }_e}(Q_i)$. By induction this gives ${\mathbb{E}}_{{\mu }_e}(Q_n)={\mathbb{E}}_{{\mu }_e}(T_n{\mu }_e{(\mathbf{C}\mid \mathbf{Z})}^{\beta })\le 1$. Thus, considering that $T_n={\prod }_{i=1}^n{F}_i\ge 0$, T_n is a PEF with power β for $\mathcal{H}(\mathcal{C})$, that is, chaining PEFs yields PEFs for chained models.

In Lem. 6, if we replace T_i and U_i there by T_i and μ_e(C_≤i|Z_≤i)^−β here, then from Eq. (B2) and manipulating the inequality inside $\mathbb{P}(\cdot )$, we get the inequality in Eq. (C2).

That F_i+1 can be parameterized in terms of the past as F_i+1 = F_i+1 (C_i+1Z_i+1; C_≤iZ_≤i) allows for adapting the PEFs based on CZ, but no other information can be used. To adapt the PEF F_i+1 based on other past information besides C_≤iZ_≤i, we need a “soft” generalization of probability estimation as detailed in Ref. [28].

2. Smooth Min-Entropy by Probability Estimation: Proof of Main Text Thm. 1

We want to generate bits that are near-uniform conditional on E and often other variables such as Z. For our analyses, E is not particularly an issue because our results hold uniformly for all values of E, that is, conditionally on {E = e} for each e. However this is not the case for Z. For this subsection, it is not necessary to structure the RVs as stochastic sequences, so below we use C and Z in place of C and Z.

Definition 10. The distribution μ of CZE has ϵ-smooth average ZE-conditional maximum probability p if there exists a distribution ν of CZE with TV(ν, μ) ≤ ϵ and ∑_ze max_c(ν(c|ze))ν(ze) ≤ p. The minimum p for which μ has ϵ-smooth average ZE-conditional maximum probability p is denoted by $P_{\max ,\mu }^{ϵ}(C\mid \mathit{ZE})$. The quantity $H_{\min ,\mu }^{ϵ}(C\mid \mathit{ZE})=-{\log }_2(P_{\max ,\mu }^{ϵ}(C\mid \mathit{ZE}))$ is the (classical) ϵ-smooth ZE-conditional min-entropy.

We denote the ϵ-smooth ZE-conditional min-entropy evaluated conditional on an event {ϕ} by $H_{\min }^{ϵ}(C\mid \mathit{ZE};\varphi )$. We refer to the smoothness parameters as “error bounds”. Observe that the definitions are monotonic in the error bound. For example, if $P_{\max ,\mu }^{ϵ}\le p$ and ϵ′ ≥ ϵ, then $P_{\max ,\mu }^{{ϵ}^{\prime }}\le p$. The quantity ∑_ze max_c(ν(c|ze))ν(ze) in the definition of $P_{\max ,\mu }^{ϵ}$ can be recognized as the (average) maximum guessing probability of C given Z and E (with respect to ν), whose negative logarithm is the guessing entropy defined, for example, in Ref. [44].

A summary of the relationships between smooth conditional min-entropies and randomness extraction with respect to quantum side information is given in Ref. [22] and can be specialized to classical side information. When so specialized, the definition of the smooth conditional min-entropy in, for example, Ref. [22] differs from the one above in that Ref. [22] uses one of the fidelity-related distances. One such distance reduces to the Hellinger distance h for probability distributions for which $h^2\le \mathrm{TV}\le \sqrt{2}h$.

The Z-conditional maximum probabilities with respect to E = e can be lifted to the ZE-conditional maximum probabilities, as formalized by the next lemma.

Lemma 11. Suppose that for all e, $P_{\max ,\mu (\mathit{CZ}\mid e)}^{{ϵ}_e}(C\mid Z)\le p_e$, and let $\stackrel{‒}{ϵ}={\Sigma }_e{ϵ}_e\mu (e)$ and $\stackrel{‒}{p}={\Sigma }_e{p}_e{\mu }_e$. Then $P_{\max ,\mu (\mathit{CZE})}^{\stackrel{‒}{ϵ}}(C\mid \mathit{ZE})\le \stackrel{‒}{p}$.

Proof. For each e, let ν_e witness $P_{\max ,\mu (\mathit{CZ}\mid e)}^{{ϵ}_e}(C\mid Z)\le p_e$. Then TV(ν_e,μ(CZ|e)) ≤ ϵ_e and ∑_z max_c(ν_e(c|z))ν_e(z) ≤ p_e. Define ν by ν(cze) = ν_e(cz)μ(e). Then the marginals ν(E) = μ(E), so we can apply Eq. (A2) for

$$\mathrm{TV}(\nu ,\mu )=\sum _e\mathrm{TV}({\nu }_e,\mu (CZ|e))\mu (e)\le \sum _e{ϵ}_e\mu (e)=\overline{ϵ}.$$

Furthermore,

$$\begin{gathered} \sum _{ze}\underset{c}{\max }(\nu (c|ze))\nu (ze)=\sum _e\mu (e)\sum _z\underset{c}{\max }({\nu }_e(c|z)){\nu }_e(z) \\ \le \sum _e\mu (e)p_e=\overline{p}, \end{gathered}$$

as required for the conclusion. □

The level of a probability estimator relates to the smoothness parameter for smooth min-entropy via the relationships established below.

Theorem 12. Suppose that U is an $ϵ-\mathrm{UPE}(C\mid \mathit{ZE};\mathcal{H})$ and that the distribution μ of CZE satisfies the model $\mathcal{H}$. Let p ≥ 1/|Rng(C)| and κ = μ(U ≤ p). Then $P_{\max ,\mu (\mathit{CZE}\mid U\le p)}^{ϵ∕\kappa }(C\mid \mathit{ZE})\le p∕\kappa$.

Proof. Let κ_e = μ(U ≤ p|e). Below we show that for all values e of E, $P_{\max ,\mu (\mathit{CZ}\mid e,U\le p)}^{ϵ∕{\kappa }_e}(C\mid \mathit{Z})\le p∕{\kappa }_e$. Once this is shown, we can use

$$\sum _e\frac{1}{{\kappa }_e}\mu (e|U\le p)=\sum _e\frac{1}{\mu (U\le p|e)}\mu (e|U\le p)=\sum _e\frac{\mu (e)}{\mu (U\le p)}=1/\kappa ,$$ (C5)

and Lem. 11 to complete the proof. For the remainder of the proof, e is fixed, so we simplify the notation by universally conditioning on {E = e} and omitting the explicit condition. Further, we omit e from suffixes. Thus κ = κ_e from here on.

Let κ_z = μ(U ≤ p|z). We have ∑_z κ_zμ(z) = κ and

$${\kappa }_z=\mu (z|U\le p)\kappa /\mu (z).$$ (C6)

Define the subprobability distribution $\tilde{\mu }$ by $\tilde{\mu }(\mathit{cz})[U(\mathit{cz})\ge \mu (c\mid z)]$. By the definition of ϵ-UPEs, we get that the weight of $\tilde{\mu }$ satisfies

$$\begin{gathered} w(\tilde{\mu })=\sum _{cz}\mu (cz)⟦U(cz)\ge \mu (c|z)⟧ \\ =\mu (U(CZ)\ge \mu (C|Z)) \\ \ge 1-ϵ. \end{gathered}$$ (C7)

Define $\tilde{\nu }(\mathit{cz})=\tilde{\mu }(\mathit{cz})[U(\mathit{cz})\le p]∕\kappa$. The weight of $\tilde{\nu }$ satisfies

$$\begin{gathered} w(\tilde{\nu })=\sum _{cz}\tilde{\mu }(cz)⟦U(cz)\le p⟧/\kappa \\ \le \sum _{cz}\mu (cz)⟦U(cz)\le p⟧/\kappa \\ =\mu (U\le p)/\kappa =1, \end{gathered}$$ (C8)

$$\begin{gathered} w(\tilde{\nu })=\sum _{cz}\mu (cz)⟦U(cz)\le p⟧/\kappa -\sum _{cz}(\mu (cz)-\tilde{\mu }(cz))⟦U(cz)\le p⟧/\kappa \\ =1-\sum _{cz}(\mu (cz)-\tilde{\mu }(cz))⟦U(cz)\le p⟧/\kappa \\ \ge 1-\sum _{cz}(\mu (cz)-\tilde{\mu }(cz))/\kappa =1-(1-w(\tilde{\mu }))/\kappa \\ \ge 1-(1-(1-ϵ))/\kappa =1-ϵ/\kappa . \end{gathered}$$ (C9)

To obtain the last inequality above, we used Eq. (C7). Thus $\tilde{\nu }$ is a subprobability distribution of weight at least 1 − ϵ/κ. We use $\tilde{\nu }$ to construct the distribution ν witnessing the conclusion of the theorem. For each cz we bound

$$\begin{gathered} \tilde{\nu }(cz)/\mu (z|U\le p)=\mu (cz)⟦U(cz)\ge \mu (c|z)⟧⟦U(cz)\le p⟧/(\kappa \mu (z|U\le p)) \\ =\mu (c|z)⟦U(cz)\ge \mu (c|z)⟧⟦U(cz)\le p⟧/{\kappa }_z \\ \le p/{\kappa }_z, \end{gathered}$$ (C10)

where in the second step we used Eq. (C6). Define $\tilde{\nu }(C\mid z)$ by $\tilde{\nu }(c\mid z)=\tilde{\nu }(\mathit{cz})∕\mu (z\mid U\le p)$, with $\tilde{\nu }(c\mid z)=0$ if μ(z|U ≤ p) = 0, and let $w_z=w(\tilde{\nu }(C\mid z))$. We show below that w_z ≤ 1, and so the definition of $\tilde{\nu }(C\mid z)$ extends the conditional probability notation to the subprobability distribution $\tilde{\nu }$ with the understanding that the conditionals are with respect to μ given {U ≤ p}. Applying the first two steps of Eq. (C10) and continuing from there, we have

$$\begin{gathered} \tilde{\nu }(c|z)=\mu (c|z)⟦U(cz)\ge \mu (c|z)⟧⟦U(cz)\le p⟧/{\kappa }_z \\ \le \mu (c|z)⟦U(cz)\le p⟧/{\kappa }_z \\ =\mu (c,U\le p|z)/\mu (U\le p|z)=\mu (c|z,U\le p). \end{gathered}$$ (C11)

Since μ(C|z, U ≤ p) is a normalized distribution, the above equation implies that w_z ≤ 1. For each z, we have that $\tilde{\nu }(C\mid z)\le p∕{\kappa }_z$ (Eq. (C10)), p/κ_z ≥ p ≥ 1/|Rng(C)|, and μ(C|z, U ≤ p) dominates $\tilde{\nu }(C\mid z)$ (Eq. (C11)). Hence, we can apply Lem. 3 to obtain distributions ν_z of C such that ${\nu }_z\ge \tilde{\nu }(C\mid z)$, ν_z ≤ p/κ_z, and TV(ν_z, μ(C|z, U ≤ p)) ≤ 1 − w_z. Now we can define the distribution ν of CZ by ν(cz) = ν_z(c)μ(z|U ≤ p). By Eq. (A2), we get

$$\begin{gathered} \mathrm{TV}(\nu ,\mu (CZ|U\le p))=\sum _z\mathrm{TV}({\nu }_z\mu (C|z,U\le p))\mu (z|U\le p) \\ \le \sum _z(1-w_z)\mu (z|U\le p) \\ =1-\sum _{z}w(\tilde{\nu }(C|z))\mu (z|U\le p) \\ =1-\sum _z\sum _c(\tilde{v}(cz))/\mu (z|U\le p)\mu (z|U\le p) \\ =1-w(\tilde{v}\le ϵ/\kappa ,) \end{gathered}$$ (C12)

where in the last step we used Eq. (C9). For the average maximum probability of ν, we get

$$\begin{gathered} \sum _z\underset{c}{\max }\nu (c|z)\nu (z)=\sum _z\underset{c}{\max }{\nu }_z(c)\mu (z|U\le p) \\ \le p\sum _z\mu (z|U\le p)/{\kappa }_z \\ =p\sum _z\mu (z)/\kappa =p/\kappa , \end{gathered}$$ (C13)

where to obtain the last line we used Eq. (C6). The above two equations show that for an arbitrary value e of E, $P_{\max ,\mu (\mathit{CZ}\mid e,U\le p)}^{ϵ∕{\kappa }_e}(C\mid Z)\le p∕{\kappa }_e$, which together with the argument at the beginning of the proof establishes the theorem. □

The above theorem implies Thm. 1 in the main text as a corollary.

Corollary 13. Suppose that the distribution μ of CZE satisfies the chained model $\mathcal{H}(\mathcal{C})$. Let 1 ≥ p ≥ 1/|Rng(C)| and 1 ≥ κ′, ϵ > 0. Define {ϕ} to be the event that U ≤ p, where U is given in Eq. (C1). Let ${\kappa }^{\prime }\le \kappa ={\mathbb{P}}_{\mu }(\varphi )$. Then the smooth conditional min-entropy satisfies

$$H_{\min }^{ϵ}(C|ZE;\varphi )\ge -{\log }_2(p/\kappa {\prime }^{1+1/\beta }).$$

Proof. We observe that the event that U ≤ p is the same as the event that U′ ≤ p/κ^1/β, where U′ = (T_nϵκ)^−1/β and T_n is defined as above Eq. (C1). By Thm. 9, U′ is an ϵκ-UPE. In Thm. 12, if we replace U and p there by U′ and p/κ^1/β here, then we obtain $P_{\max ,\mu (\mathit{CZE}\mid \varphi )}^{ϵ}(C\mid \mathit{ZE})\le p∕{\kappa }^{1+1∕\beta }$. Since κ′ ≤ κ, we also have $P_{\max ,\mu (\mathit{CZE}\mid \varphi )}^{ϵ}(C\mid \mathit{ZE})\le p∕{\kappa }^{\prime 1+1∕\beta }$. According to the definition of the smooth conditional min-entropy in Def. 10, we get the lower bound in the corollary. □

We remark that, to obtain uniformly random bits, Cor. 13 can be composed directly with “classical-proof” strong extractors in a complete protocol for randomness generation. The error bounds from the corollary and those of the extractor compose additively [28]. Efficient randomness extractors requiring few seed bits exist, see Refs. [45, 46]. Specific instructions for ways to apply them for randomness generation can be found in Refs. [19, 20, 28].

Appendix D: Properties of PEFs

Here we prove the monotonicity of the functions g(β) and β_g(β): As β increases, the rate g(β) as defined in Eq. (4) of the main text is monotonically non-increasing, and β_g(β) is monotonically non-decreasing. These are the consequence of the following lemma:

Lemma 14. If F is a PEF with power β for the trial model $\mathcal{D}$, then for any 0 < γ ≤ 1, F is a PEF with power β/γ for $\mathcal{C}$, and F^γ is a PEF with poiver γβ for $\mathcal{C}$.

Proof. For an arbitrary distribution $\sigma \in \mathcal{C}$, we have 0 ≤ σ(c|z) ≤ 1 for all cz. By the monotonic property of the exponential function x ↦ a^x with 0 ≤ a ≤ 1, we get that σ(c|z)^β/γ ≤ σ(c|z)^β for all cz. Therefore, if a non-negative RV F satisfies that

$$\sum _{cz}F(cz)\sigma {(c|z)}^{\beta }\sigma (cz)\le 1,$$

then

$$\sum _{cz}F(cz)\sigma {(c|z)}^{\beta /\gamma }\sigma (cz)\le \sum _{cz}F(cz)\sigma {(c|z)}^{\beta }\sigma (cz)\le 1.$$

Hence, if F is a PEF with power β for $\mathcal{C}$, then F is a PEF with power β/γ for $\mathcal{C}$.

On the other hand, by the concavity of the function x ↦ x^γ with 0 < γ ≤ 1, we can apply Jensen’s inequality to get

$$\begin{gathered} {\mathbb{E}}_{\sigma }(F{(CZ)}^{\gamma }\sigma {(C|Z)}^{\gamma \beta })={\mathbb{E}}_{\sigma }\left({(F(CZ)\sigma {(C|Z)}^{\beta })}^{\gamma }\right) \\ \le {({\mathbb{E}}_{\sigma }(F(CZ)\sigma {(C|Z)}^{\beta }))}^{\gamma } \\ \le 1, \end{gathered}$$

for all distributions $\sigma \in \mathcal{C}$. Hence F^γ is a PEF with power γβ for $\mathcal{C}$.

The property that β_g(β) is monotonically non-decreasing in β follows directly from Lem. 14 and the definition of g(β) in Eq. (4) of the main text. On the other hand, to prove that g(β) is monotonically non-increasing in β, we also need to use the equality that

$${\mathbb{E}}_{\sigma }({\log }_2(F^{\gamma }(CZ))/(\gamma \beta ))={\mathbb{E}}_{\sigma }({\log }_2(F(CZ))/\beta ).$$

The monotonicity of the function g(β) (or β_g(β)) helps to determine the maximum asymptotic randomness rate g₀ = sup_{β>0 g}(β) (or the maximum certificate rate γ_PEF = sup_β>0 β_g(β)), as one can analyze the PEFs with powers β only in the limit where β goes to 0 (or where β goes to the infinity).

Appendix E: Numerical Optimization of PEFs

We provide more details here on how to perform the optimizations (such as the optimization in Eq. (3) of the main text) required to determine the power β and the PEFs F_i to be used at the i’th trial. We claim that to verify that the PEF F satisfies the first constraint in Eq. (3) of the main text for all $\sigma \in \mathcal{C}$, it suffices to check this constraint on the extremal members of the convex closure of $\mathcal{C}$. The claim follows from the next lemma, Carathéodory’s theorem, and induction on the number of terms in a finite convex combination.

Lemma 15. Let F ≥ 0 and β > 0. Suppose that the distribution σ can be expressed as a convex combination of two distributions: For all cz, σ(cz) = λσ₁(cz) + (1 − λ)σ₂(cz) with λ ∈ [0, 1]. If the distributions σ₁ and σ₂ satisfy ∑_cz F(cz)σ_i(c|z)^β σ_i(cz) ≤ 1, then σ satisfies ∑_cz F(cz)σ(c|z)^βσ(cz) ≤ 1.

Proof. We start by proving that for every cz, the following inequality holds:

$$\sigma {(c|z)}^{\beta }\sigma (cz)\le \lambda {\sigma }_1{(c|z)}^{\beta }{\sigma }_1(cz)+(1-\lambda ){\sigma }_2{(c|z)}^{\beta }{\sigma }_2(cz).$$ (E1)

If σ₁(z) = σ₂(z) = 0, we recall our convention that probabilities conditional on z are zero, and so for every c, σ₁(c|z) = σ₂(c|z) = σ(c|z) = 0. Hence, Eq. (E1) holds immediately (as an equality). If σ₁(z) = 0 < σ₂(z), then for every c, σ₁(c|z) = 0 and σ(cz) = (1 − λ)σ₂(cz). In this case, one can verify that Eq. (E1) holds. By symmetry, Eq. (E1) also holds in the case that σ₂(z) = 0 < σ₁(z). Now consider the case that σ₁(z) > 0 and σ₂(z) > 0. Let x_i = σ_i(cz) and y_i = σ_i(z), and consider the function

$$f(\lambda )={(\lambda x_1+(1-\lambda )x_2)}^{1+\beta }{(\lambda y_1+(1-\lambda )y_2)}^{-\beta },$$

so f(0) = σ₂(c|z)^βσ₂(cz), f(1) = σ₁(c|z)^βσ₁(cz), and f(λ) = σ(c|z)^βσ(c|z). If we can show that f(λ) is convex in λ on the interval [0,1], Eq. (E1) will follow. Since f(λ) is continuous for λ ∈ [0,1] and smooth for λ ∈ (0,1), it suffices to show that f″(λ) ≥ 0 as follows:

$$\begin{gathered} f\prime (\lambda )={(\lambda x_1+(1-\lambda )x_2)}^{\beta }{(\lambda y_1+(1-\lambda )y_2)}^{-\beta -1}\times \left((1+\beta )(x_1-x_2)(\lambda y_1+(1-\lambda )y_2)+(-\beta )(\lambda x_1+(1-\lambda )x_2)(y_1-y_2)\right) \\ f″(\lambda )={(\lambda x_1+(1-\lambda )x_2)}^{\beta -1}{(\lambda y_1+(1-\lambda )y_2)}^{-\beta -2}\times \left(\beta (1+\beta ){(x_1-x_2)}^2{(\lambda y_1+(1-\lambda )y_2)}^2+2(-\beta )(1+\beta )(x_1-x_2)(y_1-y_2)(\lambda x_1+(1-\lambda )x_2)(\lambda y_1+(1-\lambda )y_2)+(-\beta )(-1-\beta ){(y_1-y_2)}^2{(\lambda x_1+(1-\lambda )x_2)}^2\right) \\ ={(\lambda x_1+(1-\lambda )x_2)}^{\beta -1}{(\lambda y_1+(1-\lambda )y_2)}^{-\beta -2}\times \beta (1+\beta ){\left((x_1-x_2)(\lambda y_1+(1-\lambda )y_2)-(y_1-y_2)(\lambda x_1+(1-\lambda )x_2)\right)}^2, \end{gathered}$$

which is a non-negative multiple of a square. Having demonstrated Eq. (E1), we can complete the proof of the lemma as follows:

$$\begin{gathered} \sum _{cz}F(cz)\sigma {(c|z)}^{\beta }\sigma (cz)\le \sum _{cz}F(cz)[\lambda {\sigma }_1{(c|z)}^{\beta }{\sigma }_1(cz)+(1-\lambda ){\sigma }_2{(c|z)}^{\beta }{\sigma }_2(cz)] \\ =\lambda \sum _{cz}F(cz){\sigma }_1{(c|z)}^{\beta }{\sigma }_1(cz)+(1-\lambda )\sum _{cz}F(cz){\sigma }_2{(c|z)}^{\beta }{\sigma }_2(cz) \\ \le \lambda \times 1+(1-\lambda )\times 1 \\ =1. \end{gathered}$$

Suppose that the trial model $\mathcal{C}$ is a convex polytope with a finite number of extremal distributions σ_k(CZ), k = 1,2, …, K. In view of the claim before Lem. 15, the optimization problem in Eq. (3) of the main text is equivalent to

$$\begin{gathered} \mathrm{Max}:n{\mathbb{E}}_{\nu }{\log }_2(F(CZ))/\beta +{\log }_2(ϵ)/\beta \\ \text{With}:{\sum }_{cz}F(cz){\sigma }_k{(c|z)}^{\beta }{\sigma }_k(cz)\le 1,k=1,2,\dots ,K, \\ F(cz)\ge 0,\forall cz. \end{gathered}$$ (E2)

Given the values of n, β, ϵ, ν, and σ_k with k = 1, 2, …, K, the objective function in Eq. (E2) is a concave function of F(CZ), and each constraint on F(CZ) is linear. Hence, the above optimization problem can be solved by any algorithm capable of optimizing nonlinear functions with linear constraints on the arguments. In our implementation, we use sequential quadratic programming. Due to numerical imprecision, it is possible that the returned numerical solution does not satisfy the first constraint in Eq. (E2) and the corresponding PEF is not valid. In this case, we can multiply the returned numerical solution by a positive factor smaller than 1, whose value is given by the reciprocal of the largest left-hand side of the above first constraint at the extremal distributions σ_k(CZ), k = 1, 2, …, K. Then, the re-scaled solution is a valid PEF. We remark that if the trial model $\mathcal{C}$ is not a convex polytope but there exists a good approximation $\mathcal{C}\subseteq \mathcal{D}$ with $\mathcal{D}$ a convex polytope, then we can enlarge the model to $\mathcal{D}$ for an effective method to determine good PEFs.

Consider device-independent randomness generation (DIRG) in the CHSH Bell-test configuration [30] with inputs Z = XY and outputs C = AB, where A, B, X, Y ∈ {0,1}. If the input distribution $\mathbb{P}(\mathit{XY})$ is fixed with $\mathbb{P}(\mathit{xy})>0$ for all xy, then we need to characterize the set of input-conditional output distributions $\mathbb{P}(\mathit{AB}\mid \mathit{XY})$. If we consider all distributions $\mathbb{P}(\mathit{AB}\mid \mathit{XY})$ satisfying non-signaling conditions [24], then the associated trial model $\mathcal{C}$ is the nonsignaling polytope, which is convex and has 24 extreme points [25]. If we consider only the distributions $\mathbb{P}(\mathit{AB}\mid \mathit{XY})$ achievable by quantum mechanics, then the associated trial model is a proper convex subset of the above non-signaling polytope. The quantum set has an infinite number of extreme points. In our analysis of the Bell-test results reported in Refs. [9, 10], we simplified the problem by considering instead the set of distributions $\mathbb{P}(\mathit{AB}\mid \mathit{XY})$ satisfying nonsignaling conditions [24] and Tsirelson’s bounds [38], which includes all the distributions $\mathbb{P}(\mathit{AB}\mid \mathit{XY})$ achievable by quantum mechanics. For a fixed input distribution $\mathbb{P}(\mathit{XY})$ with $\mathbb{P}(\mathit{xy})>0$ for all xy, the associated trial model $\mathcal{C}$ is a convex polytope with 80 extreme points [28]. If the input distribution $\mathbb{P}(\mathit{XY})$ is not fixed but is contained in a convex polytope, the associated trial model $\mathcal{C}$ is still a convex polytope (see Ref. [28] for more details). Therefore, for DIRG based on the CHSH Bell test [30], the optimizations for determining the power β and the PEFs F_i can be expressed in the form in Eq. (E2) and hence solved effectively.

Appendix F: Relationship between Certificate Rate and Statistical Strength

We prove that for DIRG in the CHSH Bell-test configuration, the maximum certificate rate γ_PEF witnessed by PEFs at a distribution ν of trial results is equal to the statistical strength of ν for rejecting local realism as studied in Refs. [35–37]. To prove this, we first simplify the optimization problem for determining γ_PEF. Then, we show that the simplified optimization problem is the same as that for determining the statistical strength. The argument generalizes to any convex-polytope model whose extreme points are divided into the following two classes: 1) classical deterministic distributions satisfying that given the inputs, the outputs are deterministic (here we require that for every cz there exists a distribution in the model where the outcome is c given z), and 2) distributions that are completely non-deterministic in the sense that for no input is the output deterministic. The argument further generalizes to models contained in such a model, provided it includes all of the classical deterministic distributions of the outer model.

In order to determine γ_PEF = sup_β>0 β_g(β), considering the monotonicity of the function β_g(β) proved in Sect. D and the definition of g(β) in Eq. (4) of the main text, we need to solve the following optimization problem at arbitrarily large powers β:

$$\begin{gathered} \mathrm{Max}:{\mathbb{E}}_{\nu }({\log }_2(F(CZ))) \\ \text{With}:{\sum }_{cz}F(cz)\sigma {(c|z)}^{\beta }\sigma (cz)\le 1\text{for all}\sigma \in \mathcal{C}, \\ F(cz)\ge 0,\text{for all}\mathit{cz}. \end{gathered}$$ (F1)

To simplify this optimization, we first consider the case that the trial model $\mathcal{C}$ is the set of non-signaling distributions with a fixed input distribution $\mathbb{P}(Z)$ where $\mathbb{P}(z)>0$ for all z. The model $\mathcal{C}$ is a convex polytope and has 24 extremal distributions [25], among which there are 16 deterministic local realistic distributions, denoted by σ_LR, i = 1, 2, …, 16, and 8 variations of the Popescu-Rohrlich (PR) box [24], denoted by σ_PRj, j = 1, 2, …, 8. According to the discussion in Sect. E, the optimization problem in Eq. (F1) is equivalent to

$$\begin{gathered} \mathrm{Max}:{\mathbb{E}}_{\nu }({\log }_2(F(CZ))) \\ \text{With}:{\sum }_{cz}F(cz){\sigma }_{{\mathrm{LR}}_i}(cz)\le 1,\forall i, \\ {\sum }_{cz}F(cz){\sigma }_{{\mathrm{PR}}_j}{(c|z)}^{\beta }{\sigma }_{{\mathrm{PR}}_j}(cz)\le 1,\forall j, \\ F(cz)\ge 0,\text{for all}\mathit{cz}, \end{gathered}$$ (F2)

where we used the fact that σ_LRi(c|z) is either 0 or 1. Only the second constraint in Eq. (F2) depends on the power β. The distributions σ_PRj satisfy that σ_PRj(c|z) < 1 for all cz. Hence σ_PRj)^β → 0 for all cz as β → ∞. Because there are finitely many constraints and values of cz, the second constraint becomes irrelevant for sufficiently large β. Let ${\beta }_{\mathrm{th}}^{\mathrm{NS}}$ be the minimum β for which the second constraint is implied by the first. The threshold ${\beta }_{\mathrm{th}}^{\mathrm{NS}}$ is independent of the specific input distribution. To see this, the last factors in the sums on the left-hand sides of the constraints in Eq. (F2) are of the form σ(cz), which can be written as σ(c|z)σ(z) with a fixed σ(z). We can define $\tilde{F}(\mathit{cz})=F(\mathit{cz})\sigma (z)$ and optimize over $\tilde{F}$ instead, thus eliminating the fixed input distribution from the problem. Then the first constraint on $\tilde{F}$ implies that ${\Sigma }_{\mathit{cz}}\tilde{F}(\mathit{cz}){\Sigma }_i{\sigma }_{{\mathrm{LR}}_i}(c\mid z)\le 16$. Since ∑_i σ_LRi(c|z) ≥ 4 for each cz, this constraint implies the second provided that σ_PRj(c|z)^1+β ≤ 1/4, which holds for each j and cz for sufficiently large β. Particularly, since σ_PRj(c|z) is either 0 or 1/2 [25], we obtain that ${\beta }_{\mathrm{th}}^{\mathrm{NS}}\le 1$. Furthermore, by numerical optimization for a sample of large-enough β we find that ${\beta }_{\mathrm{th}}^{\mathrm{NS}}\approx 0.4151$. Therefore, when $\beta \ge {\beta }_{\mathrm{th}}^{\mathrm{NS}}$ the optimization problem in Eq. (F2) is independent of β and becomes

$$\begin{gathered} \mathrm{Max}:{\mathbb{E}}_{\nu }({\log }_2(F(CZ))) \\ \text{With}:{\sum }_{cz}F(cz){\sigma }_{{\mathrm{LR}}_i}(cz)\le 1,\forall i, \\ F(cz)\ge 0,\text{for all}\mathit{cz}. \end{gathered}$$ (F3)

This optimization problem is identical to the one for designing the optimal test factors for the hypothesis test of local realism [21, 41, 47]. In Ref. [21] it is proven that the optimal value of the optimization problem in Eq. (F3) is equal to the statistical strength for rejecting local realism [35–37], which is defined as

$$s=\underset{{\sigma }_{\mathrm{LR}}}{\min }{D}_{\mathrm{KL}}(\nu |{\sigma }_{\mathrm{LR}}).$$

Here, σ_LR is an arbitrary local realistic distribution and D_KL(ν|σ_LR) is the Kullback-Leibler divergence from σ_LR to ν [48]. Therefore, when $\beta \ge {\beta }_{\mathrm{th}}^{\mathrm{NS}}$ we have β_g(β) = s. Considering that the function β_g(β) is monotonically non-decreasing in β, we have shown that

$${\gamma }_{\mathrm{PEF}}=\underset{\beta >0}{\sup }\beta g(\beta )=s.$$

Now we consider the case where the trial model $\mathcal{C}$ is the set of quantum-achievable distributions with a fixed input distribution $\mathbb{P}(Z)$ where $\mathbb{P}(z)>0$ for all z. Since the set of quantum-achievable distributions is a proper subset of the non-signaling polytope, the constraints on F(CZ) imposed by quantum-achievable distributions are a subset of the constraints imposed by non-signaling distributions. Moreover, the set of quantum-achievable distributions contains all local realistic distributions. Therefore, in the quantum case, when $\beta \ge {\beta }_{\mathrm{th}}^{\mathrm{NS}}$, the constraints on F(CZ) are also implied by the constraints associated with the local realistic distributions. Consequently the maximum certificate rate γ_PEF is also equal to the statistical strength s. We remark that as a consequence, if we set ${\beta }_{\mathrm{th}}^{\mathrm{QM}}$ to be the threshold such that when $\beta \ge {\beta }_{\mathrm{th}}^{\mathrm{QM}}$ all quantum constraints on F(CZ) are implied by those imposed by the local realistic distributions, then ${\beta }_{\mathrm{th}}^{\mathrm{QM}}\le {\beta }_{\mathrm{th}}^{\mathrm{NS}}$.

We remark that β₀ = inf[β|β_g(β) = s} is typically strictly less than ${\beta }_{\mathrm{th}}^{\mathrm{NS}}$ and depends on both the distribution ν as well as the trial model $\mathcal{C}$. One way to understand this behavior is as follows: When $\beta <{\beta }_{\mathrm{th}}^{\mathrm{NS}}$, the second constraint in Eq. (F2) is relevant; however, if β is still large enough, it is possible that the constraint does not affect the optimal solution of the optimization problem (F2). By numerical optimization, we find that for the CHSH Bell-test configuration β₀ is typically less than 0.2 when the trial model $\mathcal{C}$ includes all non-signaling distributions with the uniform distribution for inputs.

Appendix G: Analytic Expressions for Asymptotic Randomness Rates

In this section we derive the asymptotic randomness rates for the trial model consisting of non-signaling distributions according to two different methods for DIRG protocol based on the CHSH Bell test [30]. We first consider the maximum asymptotic rate g₀ witnessed by PEFs. Then, we derive the single-trial conditional min-entropy for comparison.

Suppose that the distribution of each trial’s inputs XY and outputs AB is $\nu (\mathit{ABXY})\in \mathcal{C}$, where $\mathcal{C}$ is the model for each trial. The maximum asymptotic rate g₀ is equal to the worst-case conditional entropy that is consistent with the distribution ν(ABXY) [28]. That is, the rate g₀ is given by the following minimization:

$$g_0=\underset{\sigma }{\min }\{H_{\sigma }(AB|XYE):\sigma (ABXY)=\nu (ABXY)\},$$ (G1)

where σ is the joint distribution of A, B, X, Y and E, and σ(ABXY) is its marginal. By the assumption that the value space of E is countable, we can also express the above minimization as

$$g_0=\underset{w_e,{\sigma }_e}{\min }\{\sum _e{\omega }_e{H}_{{\sigma }_e}(AB|XY,E=e):\forall e,{\sigma }_e\in \mathcal{C}\text{and}{\omega }_e\ge 0,\sum _e{\omega }_e=1,\sum _e{\omega }_e{\sigma }_e=\nu \},$$ (G2)

where σ_e is the distribution of A, B, X and Y conditional on E = e according to σ, and ω_e is the probability of the event E = e. By the concavity of the conditional entropy, if any of the σ_e contributing to the sum in Eq. (G2) is not extremal in $\mathcal{C}$, we can replace it by a convex combination of extremal distributions to decrease the value of the sum. Thus, we only have to consider extremal distributions in the above minimization.

For the rest of this section we let $\mathcal{C}$ consist of non-signaling distributions for the CHSH Bell-test configuration with a fixed input distribution $\mathbb{P}(\mathit{XY})$ where $\mathbb{P}(\mathit{xy})>0$ for all xy. As explained in the previous section, $\mathcal{C}$ is a convex polytope with 24 extreme points. Considering the argument below Eq. (G2), the number of terms in the sum of Eq. (G2) is at most 24. As in the previous section, we can divide the 24 extreme points into the two classes consisting of the 16 deterministic local realistic distributions σ_LRi, i = 1, 2, …, 16, and the 8 variations of the PR box σ_PRj, j = 1, 2, …, 8. Because the σ_LRi are deterministic conditional on the inputs, if σ_e = σ_LRi then the conditional entropy satisfies H_σLRi (AB|XY, E = e) = 0. For each PR box σ_PRj, the conditional probabilities σ_PRj (AB|XY) are either 0 or 1/2 [25]. Thus, if σ_e = σ_PRj, the conditional entropy satisfies H_σPRj (AB|XY, E = e) = 1. Hence, the minimization problem in Eq. (G2) becomes

$$\begin{gathered} g_0=\mathrm{Min}:{\sum }_j{\omega }_{{\mathrm{PR}}_j} \\ \text{With}:{\omega }_{{\mathrm{LR}}_i},{\omega }_{{\mathrm{PR}}_j}\ge 0,\forall i,j, \\ {\sum }_i{\omega }_{{\mathrm{LR}}_i}+{\sum }_j{\omega }_{{\mathrm{PR}}_j}=1, \\ {\sum }_i{\omega }_{{\mathrm{LR}}_i}{\sigma }_{{\mathrm{LR}}_i}+{\sum }_j{\omega }_{{\mathrm{PR}}_j}{\sigma }_{{\mathrm{PR}}_j}=\nu . \end{gathered}$$ (G3)

We need to find the minimum total probability of PR boxes in a representation of the distribution ν as a convex combination of the 16 local realistic distributions and the 8 PR boxes. To help solve this problem, we consider the violation of the CHSH Bell inequality [30]. Recall that there is only one PR box that can violate a particular CHSH Bell inequality $\mathbb{E}(I_{\mathrm{CHSH}})\le 2$ [25], where I_CHSH is the CHSH Bell function

$$I_{\mathrm{CHSH}}(ABXY)=(1-2XY){(-1)}^{A+B}/\mathbb{P}(XY),$$ (G4)

and A, B, X, Y ∈ {0,1}. Let σ_PR1 be the violating PR box. The expectation of I_CHSH according to σ_PR1 is maximal, that is, ${\mathbb{E}}_{{\sigma }_{{\mathrm{PR}}_1}}(I_{\mathrm{CHSH}})=4$. Without loss of generality, $\widehat{I}={\mathbb{E}}_{\nu }(I_{\mathrm{CHSH}})>2$. The probability ω_PR1 in the convex decomposition of ν satisfies the inequality $4{\omega }_{{\mathrm{PR}}_1}+(1-{\omega }_{{\mathrm{PR}}_1})2\ge \widehat{I}$, or equivalently, ${\omega }_{{\mathrm{PR}}_1}\ge (\widehat{I}-2)∕2$. Hence, according to Eq. (G3), we have $g_0\ge (\widehat{I}-2)∕2$.

We next show that $g_0\le (\widehat{I}-2)∕2$. For this, we directly use the result of Ref. [49]. According to Ref. [49], for any non-signaling distribution σ(ABXY), if ${\mathbb{E}}_{\sigma }(I_{\mathrm{CHSH}})>2$, then the distribution σ(ABXY) can be decomposed as σ(ABXY) = ω_PR1 σ_PR1 + ∑_iω_LRiσ_LRi, where ${\omega }_{{\mathrm{PR}}_1}=({\mathbb{E}}_{\sigma }(I_{\mathrm{CHSH}})-2)∕2$, ω_LRi ≥ 0, and ∑_iω_LRi = 1 − ω_PR1. Specializing to the distribution ν(ABXY), we get that $g_0\le (\widehat{I}-2)∕2$ for $\widehat{I}>2$.

FIG. 3:

Asymptotic randomness rates as a function of $\widehat{I}$. Results according to both our method (the solid curve) and Refs. [3, 10, 12, 18, 31–33] (the dashed curve) are shown. Our method witnesses the maximum asymptotic rate H(AB|XY E), which is the worst-case conditional entropy.

The arguments above show that given $\widehat{I}>2$, the maximum asymptotic randomness rate witnessed by PEFs is

$$g_0=(\widehat{I}-2)/2,$$ (G5)

independent of the particular distribution ν realizing $\widehat{I}$.

We also numerically evaluated the maximum asymptotic rate according to g₀ = sup_β>0 g(β) with g(β) given by Eq. (4) of the main text. The numerical results are presented in Fig. 3, which are consistent with the analytic expression in Eq. (G5).

Next, we consider the quantification of the asymptotic randomness rate by the single-trial conditional min-entropy H_min(AB|XY E), which is a lower bound and is studied in Refs. [3, 10, 12, 18, 31–33]. The single-trial conditional min-entropy is defined by

$$H_{\min }(AB|XYE)=-{\log }_2(P_{\mathrm{guess}}(AB|XYE)),$$ (G6)

where P_guess(AB|XYE) is the average guessing probability of the output AB given the input XY and the side information E, as defined in Ref. [33]. According to Refs. [32, 33], the guessing probability at xy is given by the following maximization:

$$P_{\mathrm{guess}}(AB|xyE)=\underset{{\omega }_e,{\sigma }_e}{\max }\left\{\sum _e{\omega }_e\underset{ab}{\max }{\sigma }_e(ab|xy):\forall e,{\sigma }_e\in \mathcal{C}\text{and}{\omega }_e\ge 0,\sum _e{\omega }_e=1,\sum _e{\omega }_e{\sigma }_e=\nu \right\}.$$ (G7)

If a σ_e contributing to the sum in Eq. (G7) is not extremal in the set $\mathcal{C}$, we can replace it by a convex combination of extremal distributions to increase the value of the sum. Thus, we only have to consider extremal distributions σ_e in the above maximization. Applying the argument that led from Eq. (G2) to Eq. (G3), we obtain

$$\begin{gathered} P_{\mathrm{guess}}(AB|xyE)=\text{Max:}{\sum }_i{\omega }_{{\mathrm{LR}}_i}+\frac{1}{2}{\sum }_j{\omega }_{{\mathrm{PR}}_j} \\ \mathrm{With}:{\omega }_{{\mathrm{LR}}_i},{\omega }_{{\mathrm{PR}}_j}\ge 0,\forall i,j, \\ {\sum }_i{\omega }_{{\mathrm{LR}}_i}+{\sum }_j{\omega }_{{\mathrm{PR}}_j}=1, \\ {\sum }_i{\omega }_{{\mathrm{LR}}_i}{\sigma }_{{\mathrm{LR}}_i}+{\sum }_j{\omega }_{{\mathrm{PR}}_j}{\sigma }_{{\mathrm{PR}}_j}=\nu . \end{gathered}$$ (G8)

Since ${\Sigma }_i{\omega }_{{\mathrm{LR}}_i}+\frac{1}{2}{\Sigma }_j{\omega }_{{\mathrm{PR}}_j}=1-\frac{1}{2}{\Sigma }_j{\omega }_{{\mathrm{PR}}_j}$ only need to minimize the total probability of PR boxes ∑_jω_PRj in the convex decomposition of the distribution ν. Prom the derivation of g₀ that gave Eq. (G5), we conclude that $\min \left({\Sigma }_j{\omega }_{{\mathrm{PR}}_j}\right)=(\widehat{I}-2)∕2$ for $\widehat{I}>2$. Therefore $P_{\text{guess}}(\mathit{AB}\mid \mathit{xyE})=(6-\widehat{I})∕4$ regardless of the particular input xy. Furthermore, the specific convex decomposition over E that achieves the maximum in Eq. (G8) is the same for all the possible inputs. Hence we also have $P_{\text{guess}}(\mathit{AB}\mid \mathit{XY}E)=(6-\widehat{I})∕4$ independent of the input distribution. Therefore the single-trial conditional min-entropy is

$$H_{\min }(AB|XYE)=-{\log }_2((6-\widehat{I})/4),$$ (G9)

which is plotted in Fig. 3.

The results of this section are summarized in the following theorem:

Theorem 16. Suppose that the trial model $\mathcal{C}$ consists of non-signaling distributions with a fixed input distribution $\mathbb{P}(\mathit{XY})$ where $\mathbb{P}(\mathit{xy})>0$ for all xy. For any $\nu \in \mathcal{C}$, both the maximum asymptotic randomness rate g₀ witnessed by PEFs and the single-trial conditional min-entropy H_min(AB|XY E) depend only on $\widehat{I}={\mathbb{E}}_{\nu }(I_{\mathrm{CHSH}})>2$ and are given by $g_0=(\widehat{I}-2)∕2$ and $H_{\min }(\mathit{AB}\mid \mathit{XY}E)=-{\log }_2((6-\widehat{I})∕4)$.

Appendix H: Entropy Accumulation

Consider DIRG in the CHSH Bell-test configuration. In this section, the input distribution $\mathbb{P}(\mathit{XY})$ at each trial is assumed to be uniform. Define the winning probability at a trial by $\widehat{\omega }=1∕2+\widehat{I}∕8$ where $\widehat{I}={\mathbb{E}}_{\nu }(I_{\mathrm{CHSH}})$ with ν the distribution of trial results. Entropy accumulation [17] is a framework for estimating (quantum) conditional min-entropy with respect to quantum side information and can be applied to the CHSH Bell-test configuration. The following theorem from Ref. [17] implements the framework:

Theorem 17. Let $(2+\sqrt{2})∕4\ge {\omega }_{\exp },p_t\ge 3∕4$, and 1 ≥ κ, ϵ > 0. Suppose that after n trials the joint quantum state of the inputs XY, the outputs AB and the quantum side information E is ρ. Define {ϕ} to be the event that the experimentally observed winning probability is higher than or equal to ω_exp, and suppose that $\kappa \le {\mathbb{P}}_{\rho }(\varphi )$. Denote the joint quantum state conditional on {ϕ} by ρ_|ϕ. Then the (quantum) smooth conditional min-entropy evaluated at ρ_|ϕ satisfies

$$H_{\min }^{ϵ}{(\mathbf{AB}|\mathbf{XY}E)}_{\rho |\varphi }>n\eta (p_t,w_{\exp },n,ϵ,\kappa ),$$

where η is defined by

$$\begin{gathered} g(p)=\{\begin{array}{cc}1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{16p(p-1)+3}\right)\hfill & p\in [3/4,(2+\sqrt{2})/4]\hfill \\ 1\hfill & p\in [(2+\sqrt{2})/4,1],\hfill \end{array} \\ {f}_{\min }(p_t,p)=\{\begin{array}{cc}g(p)\hfill & p\le p_t\hfill \\ \frac{\mathrm{d}}{\mathrm{d}p}{g(p)|}_{p_t}p+\left(g(p_t)-\frac{\mathrm{d}}{\mathrm{d}p}{g(p)|}_{p_t}{p}_t\right)\hfill & p>p_t,\hfill \end{array} \\ v(p_t,ϵ,\kappa )=2\left({\log }_{2}13+\frac{\mathrm{d}}{\mathrm{d}p}{g(p)|}_{p_t}\right)\sqrt{1-2{\log }_2(ϵ\kappa )}, \\ \eta (p_t,p,n,ϵ,\kappa )=f_{\min }(p_t,p)-\frac{1}{\sqrt{n}}v(p_t,ϵ,\kappa ), \end{gathered}$$

with h(x) = −x log₂(x) − (1 − x) log₂ (1 − x) be the binary entropy function.

The function f_min in the theorem is referred to as a min-tradeoff function. The parameter p_t in the theorem is free, and can be optimized over its range before running the protocol based on the chosen parameters n, ω_exp, ϵ and κ. So the optimal entropy rate is η_opt(ω_exp, n, ϵ, κ) = max_pt η(p_t, ω_exp, n, ϵ, κ).

According to Thm. 17, in order to certify b bits of entropy given ω_exp, ϵ and κ, we need that ηη(p_t, ω_exp, n, ϵ, κ) ≥ b. Equivalently, n ≥ n_EAT,b(p_t) where

$$n_{\mathrm{EAT},b}(p_t)={\left(\frac{\nu (p_t,ϵ,\kappa )+\sqrt{\nu {(p_t,ϵ,\kappa )}^2+4b{f}_{\min }(p_t,{\omega }_{\exp })}}{2f_{\min }(p_t,{\omega }_{\exp })}\right)}^2.$$ (H1)

Including the optimization over p_t gives the minimum number of identical trials required:

$$n_{\mathrm{EAT},b}=\underset{3/4\le p_t\le (2+\sqrt{2})/4}{\min }{n}_{\mathrm{EAT},b}(p_t).$$ (H2)

To compute n_EAT,b, we set the parameter ω_exp to the winning probability $\widehat{\omega }$ according to the distribution ν of trial results in a stable experiment.

We finish with several remarks on the comparison between entropy accumulation and probability estimation. First, Thm. 17 based on entropy accumulation holds with respect to quantum side information, while Cor. 13 (Thm. 1 in the main text) based on probability estimation holds with respect to classical side information. Second, in principle both entropy accumulation and probability estimation can witness asymptotically tight bounds on the smooth conditional min-entropies with respect to the assumed side information. Entropy accumulation can witness the maximum asymptotic entropy rate with respect to quantum side information, if an optimal min-tradeoff function is available. However, it is unknown how to obtain such min-tradeoff functions. In particular, the min-tradeoff function f_min (p, p_t) is not optimal for the CHSH Bell-test configuration considered here. A min-tradeoff function is required to be a bound on the single-trial conditional von Neumann entropy H(AB|XY E). That f_min (p, p_t) is not optimal is due to the following: 1) f_min (p, p_t) is designed according to a bound on the single-trial conditional von Neumann entropy H(A|XY E) derived in Refs. [50, 51]. A tight bound on H(A|XY E) is generally not a tight bound on H(AB|XY E). 2) The bound on H(A|XY E) derived in Refs. [50, 51] is tight if the only information available is the winning probability. However, in practice one can access the full measurement statistics rather than just the winning probability. In contrast to entropy accumulation, probability estimation is an effective method for approaching the maximum asymptotic entropy rate (with respect to classical side information) considering the full measurement statistics and the model constraints. In general, the maximum rate with respect to quantum side information is lower than that with respect to classical side information, as accessing quantum side information corresponds to a more powerful attack. Third and as demonstrated in the main text, probability estimation performs significantly better with finite data.