Table Of ContentAmplifyingtherandomnessofweaksourcescorrelatedwithdevices
H. Wojewódka,1,2 F. Brandão,3,4 A. Grudka,1,5 M. Horodecki,1,2
K. Horodecki,1,6 P. Horodecki,1,7 M. Pawłowski,1,2 and R. Ramanathan1,2
1 National Quantum Information Centre of Gdan´sk
2 Institute of Theoretical Physics and Astrophysics, Gdan´sk University
3 Quantum Architectures and Computation Group, Microsoft Research, Redmond, WA
4 DepartmentofComputerScience, UniversityCollegeLondonWC1E6BT,UnitedKingdom
5 Faculty of Physics, Adam Mickiewicz University
6 Institute of Informatics, Gdan´sk University
7 Faculty of Applied Physics and Mathematics, Technical University of Gdan´sk
6
(Dated: January26,2016)
1
0
The problem of device-independent randomness amplification against no-signaling ad-
2
versaries has so far been studied under the assumption that the weak source of random-
n
ness is uncorrelated with the (quantum) devices used in the amplification procedure. In
a
J this work, we relax this assumption, and reconsider the original protocol of Colbeck and
Renner [4] on randomness amplification using a Santha-Vazirani (SV) source. To do so,
5
2 we introduce an SV-like condition for devices, namely that any string of SV source bits
remains weakly random conditioned upon any other bit string from the same SV source
] andtheoutputsobtainedwhenthisfurtherstringisinputintothedevices. Assumingthis
h
p condition,weshowthataquantumdeviceusingasingletstatetoviolatethechainedBell
- inequalities leads to full randomness in the asymptotic scenario of a large number of set-
t
n tings,forarestrictedsetofSVsources(with0 ≤ ε < (2(1/12)−1) ≈ 0.0144). Wealsostudy
a 2(2(1/12)+1)
u a device-independent protocol that allows for correlations between the sequence of boxes
q usedintheprotocolandtheSVsourcebitsusedtochoosetheparticularboxfromwhose
[ outputtherandomnessisobtained. AssumingtheSV-likeconditionfordevices,weshow
1 thatthehonestpartiescanachieveamplificationoftheweaksourceagainstthisattackfor
v theparameterrange0 ≤ ε < 0.0132. Weleavethecaseofayetmoregeneralattackonthe
5 amplificationprotocolasaninterestingopenproblem.
5
4
6
Introduction
0
.
1
0 In many applications, like numerical simulations, cryptography or gambling, just to name
6 a few, free randomness is desired due to the fact that a wide range of results is based on it. In
1
practice,however,randomsourcesarerarelyprivateandonlyweakpartiallysourcesofrandom-
:
v ness are available. That is why the problem of randomness amplification became useful and
i
X worthinvestigating. Overall,theideaistousetheinputsfromapartiallyrandomsourceandob-
r tainperfectlyrandomoutputbits. Inclassicalinformationtheory,randomnessamplificationfrom
a
asingleweaksourceisunattainable([16]). However,itbecomespossible,iftheno-signalingprin-
ciple is assumed and quantum-mechanical correlations are used. Such correlations are revealed
operationallythroughtheviolationofBellinequalities.
Asaweaksourcetobeamplified,weconsideranε-SVsource(namedforSanthaandVazirani
[16]), where ε is a parameter which indicates how far we are from full randomness. An ε-SV
sourceisgivenbyaprobabilitydistributionP(ϕ ,...,ϕ ,...)overbitstringssuchthat
1 n
(0.5−ε) ≤ P(ϕ |e) ≤ (0.5+ε),
1
(1)
(0.5−ε) ≤ P(ϕ |ϕ ,...,ϕ ,e) ≤ (0.5+ε) forevery1 ≤ i ≤ n,
i+1 1 i
where the e represents an arbitrary random variable prior to ϕ , which can influence
1
ϕ ,...,ϕ ,.... Note that, when ε = 0, bits are fully random, while they are fully determinis-
1 n
2
tic when ε = 0.5. For brevity, throughout the rest of the paper we will write p for (0.5−ε) and
−
p for(0.5+ε).
+
Intheresearchonrandomnessamplification,thepaperofColbeckandRenner[4]iscertainly
crucial. It is also a starting point for our idea. The authors consider the bipartite scenario of the
chainedBellinequalityandprovethat,undercertainassumptions(discussedlater),itispossible
√
(cid:0) (cid:1)2
to amplify randomness of ε-SV sources, provided ε < 2−1 /2 ≈ 0.086. The result may be
improved, as is done in [12]. There, based on the observation that extremal points of the set of
probability distributions from an ε-SV source are certain permutations of Bernoulli distributions
withparameter(0.5−ε), randomnessamplificationwasobtainedforanyε < 0.0961. Moreover,
theboundwasshowntobetight,whichmeansthatundertheseassumptions,itisnotpossibleto
achieverandomnessamplificationusingthechainedBellinequalityabovethisthreshold.
Gallego et al. [5] show that, given an ε-SV source, with any 0 < ε < 0.5, and assuming no-
signaling, full randomness may be certified using quantum non-local correlations. In this paper,
the Bell scenario of five-party Mermin inequality is considered, however, unlike in the protocol
proposed in [4], the hashing function used to compute the final random bit is not explicitly pro-
videdandalargenumberofspace-likeseparateddevicesisrequired.
Further results were obtained in [6], [8], [7], [9] etc., a wide range of protocols have been pro-
posed, these are summarized and compared in Table I in [7]. The problem has been considered
from different points of view and a lot of obstacles, such as the requirement of an infinite num-
ber of devices or no tolerance for noise, have already been overcome. However, relaxing the
assumptionaboutindependencebetweenasourceandadevicehasnotyetbeenwidelystudied,
especiallyinthecontextofafinitedeviceframeworkagainstano-signalingadversary.
In this paper, we relax this assumption, i.e., do not require a source and a device to be inde-
pendent, while still considering a finite device protocol for amplification against a no-signaling
adversary. Instead, we only limit the correlations between the source and device by one con-
straint, which we call the SV-condition for boxes and specify in detail later. We prove explicitly
that the most malicious correlations (between a source and a device) are not allowed due to the
assumptionthatanε-SVsourceremainsanε-SVsourceevenuponobtainingtheinputsandout-
putsfromboxes(SV-conditionforboxes). Hence,randomnessamplificationisstillpossible. Our
newmethodofproofallowstoanalyzeanattackwhereanadversarysendstothehonestparties
those boxes that are particularly adapted to their measurement settings. We explain the dangers
ofsuchattackswithanexplicitexampleinSection2.
So far, only Chung et al. [8] have tried to weaken the independence assumption, however
their approach to this question explicitly requires the use of a large number of devices which
is a major drawback we desire to avoid. We therefore propose an alternative approach to the
problem. Webelievethattheseresultsgiveanewinsightintotheproblemand,duetotheclarity
of assumptions, will also be significant in the more general task of obtaining secure key bits in
cryptography. Moreover,asweshallsee,inthepresentpaper,wealsoobtainrandomnessunder
weakerassumptionsthanthoseof[8].
The paper is organized as follows. In Section I we introduce some basic notations and def-
initions. A motivation for the paper is described in Section II with a toy example of an attack
strategyfortheadversary. InSectionIIIweformallystatetheassumptionsinthepaperanddis-
cusstheresultsforasingleno-signalingbox. SectionIVisdevotedtotheexplicitexampleofthe
chained Bell inequality, which is interesting because it may be compared with the results of Col-
beck and Renner [4]. In Section V we revisit the Colbeck and Renner protocol for amplification
of randomness using the chained Bell inequality. We then prove, in Section VI, that under the
relaxed assumption, against a general symmetric attack, the protocol allows for amplification in
theparameterrange0 ≤ ε < 0.0132. Thefinalpartofthepaper,inwhichwecertifyrandomness
doesnotfinalizetheproblemyet. Althoughtheintuitionisthatweanalyzethestrongestpossible
3
attack, the symmetry assumption should formally be relaxed. The aim of further research is to
investigate whether stronger attacks than the one proposed in this paper are possible, and if so
whetheraprotocolcanbedevisedtoachieveamplificationagainsttheseaswell.
I. PRELIMINARIES
A. No-signalingboxes
In our study we use a family of probability distributions, usually called a box, denoted by
P(O|I),whereI andOarerandomvariablesdescribingthevectorsofinputsandoutputs,respec-
tively.
To talk about randomness amplification, it is advisable to explain what is meant by the no-
signaling condition. In the simplest case, when there are only two parties: Alice and Bob, the
no-signalingassumptionisthat
(cid:80) P (O = (x,y)|I = (u,v)) = (cid:80) P (O = (x,y)|I = (u,v(cid:48))) foreveryu,v,v(cid:48),x,
y y
(cid:80) P (O = (x,y)|I = (u,v)) = (cid:80) P (O = (x,y)|I = (u(cid:48),v)) foreveryu,u(cid:48),v,y. (2)
x x
B. Bellvaluesobservedinlaboratories
Theoretically,theremayexistno-signalingboxeswhichattainthealgebraicviolationofchosen
Bell inequality. However, as for now, we are able to use in laboratories only these boxes which
violate the inequality up to the value obtained within the rules of quantum mechanics. This
simply means that the Bell value observed in a lab may not be lower (here a larger violation is
characterized by a smaller value for the Bell expression) than the value predicted by quantum
mechanics.
C. Bellinequalitiesusefulforrandomnessamplification
It is well-known that quantum mechanics allows for non-local correlations between spatially
separated systems. Occurrence of such correlations can be verified through the violation of Bell
inequalities. The convex set formed by the correlations described by quantum theory is sand-
wiched between the sets of classical and general no-signaling correlations. Only extremal boxes
(vertices) of the no-signaling polytope are completely uncorrelated with the environment and
hence provide intrinsic certified randomness. It has been recently proven in [15] that non-local
verticesoftheno-signalingpolytopesofcorrelationsadmitnoquantumrealization. Foramplifi-
cation of SV sources, Bell inequalities with the property that the optimal quantum value equals
theoptimalno-signalingvaluearerequired. ForsuchBellinequalities(e.g. GHZparadoxes[11],
pseudo-telepathygames[10]orBellinequalitiesforgraphstates[13])orthosewherethequantum
violationisclosetoalgebraic(suchasthechainedBellinequality[2])thequantumsetreachesthe
correspondingfacetoftheno-signalingpolytope.
In this paper we mainly focus on the chained Bell inequality, which has already been used in
theresearchonrandomnessandprivacyamplification(see[4],[12]or[1]).
4
II. MOTIVATIONANDATOYEXAMPLE
We now exemplify a possible attack that utilizes correlations between a weak source and de-
vice in the simplest scenario of boxes with binary inputs and outputs. Even though these boxes
donotconstitutearesourceforrandomnessamplification,theattackcanalreadybedescribedin
termsofthese.
FIG. 1: Examples of bipartite boxes with binary inputs and outputs denoted by graphs. The Popescu-
Rohrlich box (on the left) and local (deterministic) boxes (on the right).
Imagine that Alice and Bob share a box L which is a mixture of local boxes L where i = 1,3
ij
labelAlice’sinputsandj = 2,4labelBob’sinputs:
1
L = (L +L +L +L ). (3)
12 32 34 14
4
(See Fig. 1 where the PR box and local deterministic boxes are presented and Fig. 2, where the
boxesL aregivenexplicitly). Thebitsfromanε-SVsourceareperfectlycorrelatedtolocalboxes
ij
as
(cid:26)
1, i = k & j = l,
P (L |S = (k,l)) = δ = (4)
ij ik;jl 0, otherwise,
whereS istherandomvariabledescribingbitsfromanε-SVsource.
In the protocols proposed so far such as [4], [12], it is demanded that I and S are perfectly
correlated,i.e.
(cid:26)
1, u = k & v = l,
P(I = (u,v)|S = (k,l)) = δ = (5)
uk;vl 0, otherwise,
whichmeansthatbitsthefromtheε-SVsourceareusedasinputstothebox. Allthecorrelations
areindicatedinFig. 2. Now,weseethatalthoughtheboxLismanifestlylocal,thehonestparties
donotdetectitintheprotocolsproposedsofar. Indeed,correlations(4)and(5)implythatinput
I = (k,l) may only be introduced to box L , adapted exactly to this input, so that L mimics the
kl
action of the PR box on any input. On the other hand, if there was independence between the
ε-SVsourceandtheboxes,thepartieswouldrecognizethattheobjectLislocal.
To conclude, this toy example clearly illustrates that perfect correlation of inputs and devices
excludesanypossibilityofrandomnessamplification. Tocircumventthistypeofattack,weintro-
duce the SV-condition for boxes, which is the weakest assumption (thus far) that still allows for
randomnessamplification.
5
Alice Bob
u=1 v=2 1 1 0 0
= +
S=(1,2)
u=3 v=4 1 1 0 0
u=1 v=2
S=(3,2)
u=3 v=4
u=1 v=2
S=(3,4)
u=3 v=4
u=1 v=2 1 1 0 0
S=(1,4)
= +
u=3 v=4 1 0 0 1
FIG. 2: Bits from an ε-SV source (on the left) are perfectly correlated with local boxes supplied to honest
parties(ontheright). CorrelationsdecribedbyEq. (4)areindicatedbybluearrows. Additionally,bitsfrom
an ε-SV source are perfectly correlated with the inputs to boxes (see Eq. (5)), which is indicated by black
arrows. These correlations allow only for measuring green edges and hence Alice and Bob always observe
an optimal Bell value. If red edges could be measured, the locality of boxes would be detected.
III. RANDOMNESSAMPLIFICATIONFORASINGLENO-SIGNALINGBOX
A. Correlationsbetweenthesourceanddevice: boxesdeterminedbysource
Let S denote a random variable which describes an arbitrary portion of subsequent bits from
anε-SVsource. RecallthatwewriteIandOforvariableswhichdescribetheinputsandoutputsof
thedevice,respectively. Supposethatbitsfromanε-SVsourcearedeliveredandsimultaneously
boxes,thatarepossiblycorrelatedtothem,aresupplied. Hence,ourobjectofstudyis
P(O|I,S). (6)
NotethatS determineshowthedeviceactsinside(seeFig. 3).
Remark 1. Even if conditional distributions of the form P(O = o|I = i,S = s) are equal for arbitrary
o,i,s, joint distributions P(O = o,I = i,S = s) do not have to be the same. This is just a fact which
followsfromconventionalandmeaningfulwayofthinkingaboutanydevices.
B. SV-conditionforboxes
Let us now precisely state the main assumption used in this paper, which we call the SV-
conditionforboxes. RecallthatS isavariablewhichdescribesanarbitraryportionofsubsequent
6
FIG.3: Aprioriweallowarbitrarycorrelationsbetweenasourceandabox(left). Toillustratehowmalicious
these correlations may be, we recall the example described in Section II (right). Bits from an ε-SV source
determine from which box the final output bit is taken. In general, arbitrary input bits may be introduced
to the box. The illustration for other Bell inequalities may be much more complicated, but the idea is the
same.
bitsfromanε-SVsource. Now,letS(cid:48)beavariabledescribingadisjointportionofsubsequentbits
chosen from the same ε-SV source which will be used as the input I to the device. Note that we
donotassumeanytemporalorderingbetweenS andS(cid:48). Letη ,η ∈ (0,1)besomefunctions
min max
ofε > 0and|I|(denotingthenumberofmeasurementsettings). Althoughweaprioriallowfor
arbitrary correlations between the source and device, there is one constraint which we impose,
namelythatifS(cid:48) = s(cid:48) isinputintothedevicewithη ≤ P(S = s|S(cid:48) = s(cid:48)) ≤ η ,thenS cannot
min max
beguessedperfectlyevenafterknowingtheoutputO = o,i.e.,foreveryrealizationo,s,s(cid:48)
η ≤ P(S = s|O = o,S(cid:48) = s(cid:48)) ≤ η forS,S(cid:48) suchthat η ≤ P(S = s|S(cid:48) = s(cid:48)) ≤ η .
min max min max
(7)
Remark 2. The distribution remains unchanged even if conditioned upon a variable e, which represents
some information prior to S(cid:48). To avoid unnecessary notation, we neglect it in the condition, since it is
irrelevantinwhatfollows.
Assuming condition (7), which we henceforth call the SV-condition for boxes, we certainly
assume less than independence between the source and device. Note that the SV-condition for
boxes is clearly violated in the toy example from Section II. Indeed, suppose that there are some
testers who obtain further bits from the SV source denoted by the variable S(cid:48) (so that p ≤
min
P(S(cid:48) = s(cid:48)|S = s) ≤ p and conversely ζ ≤ P(S = s|S(cid:48) = s(cid:48)) ≤ ζ for some ζ ,ζ ∈
max min max min max
(0,1), whose explicit forms are derived in Appendix I) and input them into the box. When they
inputS(cid:48) = sandobserveanoutputthatdoesnotmimicthePRbox,i.e. O (cid:54)= o ,thenduetothe
PR
perfectcorrelationsbetweenS andL theyknowthatS (cid:54)= s,i.e.,wehave
ij
P(S = s|S(cid:48) = s,O (cid:54)= o ) = 0 (8)
PR
whichviolatesEq. (7).
C. Comparisonwithassumptionsinpreviousresults
Let us now describe how the SV-condition for boxes assumption used in this paper differs
from the assumptions in previous results. Firstly, note that as shown by the attack described
7
in Section II, to retain the possibility of randomness amplification, one has to necessarily make
some assumptions on the correlations between the source and the device. The intuition behind
the possible assumptions is the following: the SV source should remain the SV source even if
conditioneduponanypossibleeventintheuniverse. Inparticular,itshouldremainanSVsource
whenconditionedupontheoutputsofanyavailabledevices. Inotherwords,ifweinputaportion
of bits from the SV source into a device, then any other portion of bits should still obey the SV
sourceconditions.
Astrongerassumptionthatonemayconsider,isthatforaninputtothedevicethatisindepen-
dent of the SV source, when conditioned on the output, the source should remain an SV source.
Thisconditionisanalogoustoasimilarconditiononmin-entropysources,whichisderivedfrom
theassumptionbyChung,ShiandWu(CSW)in[8]. Namely,CSWconsideraquantumscenario,
wherethedeviceD andthemin-entropysourceS arecorrelatedasinthecq-stateρ ,
SD
(cid:88)
ρ := P(S = s)|s(cid:105)(cid:104)s|⊗ρD (9)
SD s
s
andtheyassumethatthequantumconditionalmin-entropyH (S|D) ofthesourceconditioned
min ρ
on the device is greater than some constant k. This implies [3] that for any POVM measurement
{M } performed by an agent on the quantum register D, the probability of the agent correctly
s
guessing S, P (S|D) is upper bounded. From no-signaling, it follows that the distribution
guess
P(S = s)isthesameforeverymeasurementinputI = isothatthejointdistributionofvariables
isoftheformP(O = o,I = i,S = s) = P(O = o|I = i,S = s)P(I = i)P(S = s). Theassumption
ofChung,ShiandWuthusimpliesthatforanyinputvariableI independentofthesourceS,the
probabilityP (S|D)obeys
guess
(cid:88)
P (S|D) = P(O = s|I = i)P(S = s|O = s,I = i) ≤ 2−k ∀ . (10)
guess i
s
Theabovecondition(whetherinthescenarioofamin-entropysource,orthatofanSVsource)
hasthedrawbackofeffectivelyintroducinganagentthatisnotcorrelatedwiththeweaksource.
However we know that from two independent partially random sources one can extract perfect
randomness in the classical world. So the operational realization of the originally mathematical
conditionmightrequiretheexistenceofanindependentvariable, implyingthepossibilityofob-
tainingrandomnessrightfromthesourceandtheagent’svariable,ifthelatter’sdistributionwas
notdeterministic.
In this paper, we consider a somewhat intermediate assumption: we assume that the agent
(which we call the "tester") has a variable which describes subsequent bits drawn from the same
SVsource(sothathisvariablewillnotbenecessarilyindependentoftheotherportionoftheSV
source, used as input by the users who want to draw randomness). However, we also assume
that the device is correlated with the tester’s variable only through the users’ variable, i.e. that
for any o,i,s,s(cid:48) we have P(O = o|I = i,S = s,S(cid:48) = s(cid:48)) = P(O = o|I = i,S = s). This is
aclearlyweakerassumptionthantheSV-analogueoftheCSWcondition,sinceifwetakeS(cid:48) tobe
independentofS,weobtaintheCSWcondition,whileinourcasethisconditionneednotbemet,
andthedependencebetweenS(cid:48) andS maybechosenbyanadversary. Inotherwords,intheSV
analogue of the CSW assumption, one requires that for some particular joint distribution (with
independent I and S), P(S|I,O) is still an SV source, irrespective of the protocol, while in our
case, the latter may hold for some other distribution, this time chosen adversarially for any given
protocol.
The threshold for the range of ε for which we will be able to amplify the SV source in the
present paper (obtained in Theorems 11 and 18) is weaker than the one obtained by Colbeck
8
and Renner in [4]. This however is only to be expected as the scenario considered in this paper
is more general than the scenario analyzed in [4], which was based on the assumption that the
sourceandthedeviceareindependent. Whiletheprotocolsof[5],[7]and[9]achieverandomness
amplification for the entire range of ε and the latter two protocols also tolerate noise within a
finite-device framework, they also do so under the assumption of independence between source
anddeviceandarethereforeincomparablewiththeresultsinthispaper.
D. Scenario
Thescenarioisasfollows. Thereare: anε-SVsourceandadevicecorrelatedtosomeportionof
subsequentbitsfromthesource,describedbythevariableS (seeFig. 4). Thehonestpartiesdraw
S = sfromthesourceanduseitasaninputtothebox,whichmeansthatS andI ,therandom
HP
variabledescribingthemeasurementsettingsofthehonestparties,areperfectlycorrelated,i.e.
P(I = i|S = s) = δ foreveryi,s. (11)
HP is
ThehonestpartiesthentestthestatisticsofaboxforsuitableviolationofacertainBellinequality.
PERFECTLY CORRELATED
ARBITRARY
CORRELATIONS DEVICE
FIG. 4: Bits froman ε-SVsourceare usedby honest partiesas inputs. Thecorrelation isgiven by Eq.(11).
E. ThetrueandobservedBellvalue
Inthemostgeneralform,theBellvalueisgivenbytheformula
(cid:88)
δ = P(O = o,I = i)B(i,o), (12)
o,i
whereB isanindicatorvectorfortheBellinequalityandP isanarbitraryjointprobabilitydistri-
bution. Wespecifyitdependingonthecontext.
We are particularly interested in evaluating the true Bell value, as it informs us whether the
boxdeliversrandomnessornot. LetI denoteallthesettingsappearingintheBellexpression. The
9
trueBellvalueδtrue iscalculatedforvariablesI ,uniformlydistributed(P(I = i) = 1/|I|)
indep indep
andindependentfromS. Itisthendefinedasfollows
1 (cid:88)
δtrue = P(O = o|I = i)B(i,o), (13)
|I| indep
o,i
where|I|isthenumberofmeasurementsettings.
Further, we define the observed Bell value, i.e. we write Eq. (12) for I , determined by Eq.
HP
(11),andobtain
(cid:88)
δobs = P(S = s)P(O = o|I = s,S = s)B(s,o). (14)
HP HP
o,s
The aim is to show that the true Bell value is small whenever the observed value is small, i.e.
theratioδobs/δtrue iscontrolled.
HP SV
F. TestingtheSV-conditionforboxes
HonestpartiestestthestatisticsofaboxusingacertainBellinequality. Thereisadangerthat
they may be cheated, as exemplified in Section II. The ε-SV source can be correlated with the
device,asillustratedinFig. 5(ontheleft).
SincethehonestpartiesonlyinputI whichisperfectlycorrelatedtoS,
HP
P(I = i|S = s) = δ , (15)
HP i,s
they are themselves not able to verify whether the SV-condition for boxes (7) is violated or not.
Therefore, we consider testers who have access to part of the ε-SV source (SV ), described by
test
the variable S , which is correlated with the device only through the variable S and does not
test
changethestatisticsofaboxP(O|I,S)(seeFig. 5,ontheright),i.e.
p ≤ P(S = s(cid:48)|S = s) ≤ p foreverys,s(cid:48) (16)
min test max
and
P(O|I,S,S ) = P(O|I,S). (17)
test
WhenhonestpartiestaketheportionofbitsS fromthemainpartofsource(theydonothave
access to SV ), to which the device is possibly correlated, the testers may be asked to perform
test
themeasurementusingtheirbitsS asinput,i.e.
test
P(Itest = i(cid:48)|Stest = s(cid:48)) = δi(cid:48),s(cid:48). (18)
Theoverallpictureisnowthefollowing. WehavetwodifferentjointdistributionsP(O,I,S,S )
test
andP(O,I ,S,S ). Conditionaldistributionsarecorrelatedasfollows:
test test
P(O = o|I = i,S = s,S = s(cid:48)) Eq=.(17) P(O = o|I = i,S = s) (19)
test
Remark1
= P(O = o|I = i,S = s) (20)
test
Eq=.(17) P(O = o|I = i,S = s,S = s(cid:48)) (21)
test test
10
for every o,i,i(cid:48),s,s(cid:48), where the pairs of variables I,S and I ,S are each perfectly correlated.
test test
AsshowninAppendixI,wehavethatEq. (16)implies
ζ ≤ P(S = s|I = s(cid:48)) ≤ ζ , (22)
min test max
whereζ andζ arefunctionsofp ,p and|I|,explicitlygivenbyEq. (89)inAppendixI.
min max min max
DuetotheSV-conditionforboxes(7)thisgivesthat
ζ ≤ P(S = s|I = s(cid:48),O = o) ≤ ζ forevery s,s(cid:48),o. (23)
min test max
FIG. 5: (Left) The main part of the ε-SV source represented by variable S is correlated to the device, so
that S determines the box. (Right) Other bits denoted by variable S from the part of the ε-SV source
test
SV are correlated with the device only through the variable S. If bits are taken from SV and used as
test test
inputs to the device, one can check whether the SV-condition for boxes in Eq.(7) is violated.
Wenowintroduceanintermediatevaluebetweenδobs andδtrue:
HP
(cid:88)
δtrue = P(O = o,I = s(cid:48))B(s(cid:48),o), (24)
SV test
o,s(cid:48)
where I is a random variable satisfying Eq. (16). Note that, according to the observation in
test
Remark1,weobtain
δtrue Eq.=(13) 1 (cid:88)P(S = s)P(O = o|I = i,S = s)B(i,o)
|I| indep
o,i,s
Rem=ark1 1 (cid:88)P(S = s)P(O = o,Itest = i,S = s)B(i,o)
(25)
|I| P(I = i,S = s)
test
o,i,s
1 (cid:88) 1
= P(O = o,I = i,S = s)B(i,o)
|I| P(I = i|S = s) test
test
o,i,s
andhence,accordingtoEq. (16)andthedefinitionofδtrue inEq.(24),wehave
SV
1 1
δtrue ≤ δtrue ≤ δtrue. (26)
p |I| SV p |I| SV
max min
