Generation of quantum-certified random numbers using on-chip path-entangled single photons from an LED

Nicolò Leone; Stefano Azzini; Sonia Mazzucchi; Valter Moretti; Matteo Sanna; Massimo Borghi; Gioele Piccoli; Martino Bernard; Mher Ghulinyan; Lorenzo Pavesi

doi:10.1364/PRJ.488875

Abstract

Single-photon entanglement is a peculiar type of entanglement in which two or more degrees of freedom of a single photon are correlated quantum-mechanically. Here, we demonstrate a photonic integrated chip able to generate and manipulate single-photon path-entangled states, using a commercial red LED as light source. A Bell test, in the Clauser, Horne, Shimony, and Holt (CHSH) form, is performed to confirm the presence of entanglement, resulting in a maximum value of the CHSH correlation parameter equal to

2.605 \pm 0.004

. This allows us to use it as an integrated semi-device independent quantum random number generator able to produce certified random numbers. The certification scheme is based on a Bell’s inequality violation and on a partial characterization of the experimental setup, without the need of introducing any further assumptions either on the input state or on the particular form of the measurement observables. In the end a min-entropy of 33% is demonstrated.

1. INTRODUCTION

Entanglement is one of the most striking features of quantum physics. The non-classical correlations that entanglement induces in quantum states have been debated since 1935, when Einstein, Podolski, and Rosen pointed out what would have been named the EPR paradox after them [1]. It was only several years later that a way out of the impasse was proposed by John Bell. Its famous inequality [2] provides indeed a quantitative solution to effectively demonstrate that correlations induced by entanglement cannot be explained classically using any realistic local-hidden variable. Today entanglement represents a resource in many quantum applications, especially in quantum computing and communications [3 –8]. However, its exploitation is mainly limited to research laboratories only, still far from being used in real-life devices. This is mainly due to technological complexities related to its generation and management.

In photonics, entangled photons pairs are typically obtained exploiting non-linear optical processes such as spontaneous parametric downconversion [9] or four-wave mixing [10], using suitable laser sources. On the contrary, single-photon entanglement (SPE) [11] can be more easily generated using only linear optical components and cheap light sources, such as LEDs [12]. SPE corresponds to quantum correlations between two or more degrees of freedom (DoFs) of a single photon. Examples of the possible DoFs used are momentum and polarization [12 –15]. From the mathematical point of view, SPE is totally analogous to the entanglement of two photons, or inter-photon entanglement. In both cases, the Hilbert space is determined by the tensor product of two independent Hilbert spaces: in the case of SPE, these are the spaces associated with the two independent DoFs chosen, while, in the case of the inter-photon entanglement, the two spaces are each one associated with one of the two photons. Here, it is important to stress that there is a whole literature on the non-locality of a single photon [16,17] and on single-photon entanglement where the qubit is the occupation state of an optical mode [18,19]. This is a form of inter-photon entanglement. Therefore, it is physically different from what we name here as SPE [13,14]. In SPE, the qubit is not the state of a mode of the electromagnetic field (i.e., no use of photon number or Fock states) but a degree of freedom (i.e., momentum, polarization, path, or others) of a single photon [11]. And indeed, it is from the physical point of view that the differences are more remarkable. Inter-photon entanglement exhibits a non-local phenomenology, while SPE concerns contextual, but local, observations. The meaning of the violation of the Bell inequality is also different in the two scenarios. In the case of inter-photon entanglement, it means that no realistic local hidden variable theory is able to explain the experiment’s results, while, in the case of SPE, it means that no realistic non-contextual hidden variable theory is capable of predicting the results [11]. The fact that SPE is a local phenomenon implies that it cannot be used as a substitute for inter-photon entanglement in many quantum applications. However, there can be specific cases in which, thanks to the easier generation and management aspects, it can be exploited for developing entanglement-based applications with potentially larger diffusion. One of them concerns random number generation.

Random numbers are fundamental resources in many different applications, such as gambling and gaming, lotteries, computer simulation, and cryptography. In cryptography, in particular, the unpredictability of the random sequence ensures the reliability of the encryption protocols. To generate random numbers, random number generators (RNGs) are usually exploited. Among all RNGs, quantum random number generators (QRNGs) [20,21] are the only ones that can generate truly random numbers. Indeed, pseudo-random number generators [22] and true-random number generators [23,24] exploit algorithms and noisy/chaotic processes, respectively, to generate random sequences. While the first ones are not truly random by definition, the second ones involve complex physical processes making randomness certification quite hard to obtain. On the contrary, for QRNGs such a certification is usually easier and can be done even considering malicious and error-prone implementation or an eavesdropper that is attacking the generator. Considering the level of security, QRNGs can be divided into three categories: device-dependent QRNGs (DD-QRNGs), device-independent QRNGs (DI-QRNGs) [8], and semi-device-independent QRNGs (SDI-QRNGs) [20]. DD-QRNGs are less secure, as their randomness certification scheme is based on the perfect characterization of their physical implementation. In perfect conditions, these QRNGs work quite well, but they are unable to cope with any change in their performances, which can possibly alter the produced randomness. DI-QRNGs are instead the most secure QRNGs, since their a priori randomness certification is independent by the actual characterization of the physical system involved. However, their physical implementations are still particularly complex and challenging, strongly limiting so far their exploitation to research labs only. The SDI-QRNGs represent a trade-off between the easiness of implementation of the DD-QRNGs and the security of the DI-QRNGs: only limited parts of the physical implementation are characterized, treating the others as black boxes.

Sign up for Photonics Research TOC. Get the latest issue of Photonics Research delivered right to you！Sign up now

In this work we propose a photonic integrated circuit (PIC) able to generate and manipulate single-photon path-entangled states by using typical integrated photonic devices such as multi-mode interferometers (MMIs), thermal phase shifters (PSs), Mach–Zehnder interferometers (MZIs), and crossings (CRs) [25]. The qubit encoding is done using four waveguides: depending on which waveguide the photon is injected, a certain state is codified [26,27]. The presence of entanglement is validated by performing a Bell test [28]. SPE and Bell inequality violation are used to lower-bound the conditional min-entropy of the generated sequence of measurement outcomes. The min-entropy represents the figure of merit to quantify true quantum randomness [29], and its correct estimation is fundamental for each RNG to obtain, from the raw sequence of generated bits, a sequence of uniform random digits using the randomness extraction procedure [30]. In particular, conditional min-entropy can quantify the level of unpredictability, i.e., the security, of the produced sequence of raw bits independently of classical noise sources and of any information potentially accessible to an eavesdropper. In this context, statistical tests such as NIST or Diehard are of secondary importance since they can only check particular statistical properties of the produced random sequence but cannot assess its level of security. The reported PIC implements an SDI-QRNG. The necessary assumptions on which it is based are the use of trusted and characterized detectors and the not-maliciousness of the experimental setup used, which can be, however, considered error-prone. With respect to a previous work from a few of us [15], the SDI-QRNG here proposed is a PIC exploiting an external commercial red LED as a light source and achieving a high value of min-entropy in the most general and secure scenario one can envision, thus making a significant step toward real-world applications.

The paper is organized as follows. In Section 2, we introduce SPE in the case of path entanglement and we detail the structure of the PIC. Then, in Section 3, all the non-idealities of the experiment are considered and their effect on the Bell inequality is taken into account. In Section 5, we present the experimental data that certify the generation of path-entangled states. In Section 6, we present the experimental data demonstrating our SDI-QRNG based on SPE states of path. Finally, in Section 7 we draw the conclusion, and in Section 4 we report the experimental methods.

2. SINGLE-PHOTON PATH-ENTANGLED STATES ON A PIC

Single-photon entangled states are those states in which at least two DoFs of a single photon are quantum correlated. Here we generate single-photon path-entangled states by considering four waveguides and two effective DoFs, namely the absolute ( $| U ⟩, | D ⟩$ ) and the relative ( $| F ⟩, | N ⟩$ ) positions of each waveguide with respect to the symmetry axis of the system (dashed white line in Fig. 1). According to the scheme of Fig. 1, such a Hilbert space can be seen as $H = C^{2} \otimes C^{2}$ .

Qubit encoding. Two qubits describe the system and are encoded according to the absolute and relative positions of the waveguide in which the photon is injected with respect to the dashed white line. The values of the two qubits are fixed using the following bases: absolute position (up |U⟩ and down |D⟩) and relative position (far |F⟩ and near |N⟩).

Figure 1.Qubit encoding. Two qubits describe the system and are encoded according to the absolute and relative positions of the waveguide in which the photon is injected with respect to the dashed white line. The values of the two qubits are fixed using the following bases: absolute position (up $| U ⟩$ and down $| D ⟩$ ) and relative position (far $| F ⟩$ and near $| N ⟩$ ).

The four states of the Bell basis in such qubit encoding are $| ϕ^{\pm} ⟩ = \frac{1}{\sqrt{2}} (| U F ⟩ \pm | D N ⟩),$ (1) $| ψ^{\pm} ⟩ = \frac{1}{\sqrt{2}} (| U N ⟩ \pm | D F ⟩) .$ (2)

In this work, we focus on the state $| ϕ^{+} ⟩$ . To generate such state, we have designed and fabricated a PIC (a scheme is reported in Fig. 2) based on silicon oxynitride ( ${SiO}_{x} N_{y}$ ) material, a low-index contrast photonic platform [31]. The structure of the PIC is simple and composed only of linear integrated optical elements: MMIs, PSs, MZIs, and CRs [32,33]. The first part of the PIC (yellow box in Fig. 2) is responsible for generating the SPE state $| ϕ^{+} ⟩$ by exploiting a 50:50 MMI and two PSs setting the relative phase $ξ$ of the entangled state, that, apart from a global non-influent phase, can be written as $| ψ ⟩ = \frac{1}{\sqrt{2}} (| U F ⟩ + i e^{i ξ} | D N ⟩),$ (3)with $ξ = ξ_{1} - ξ_{2}$ , where $ξ_{1 (2)}$ is the phase induced by the phase shifter applied to $| U F ⟩ (| D N ⟩)$ in the generation stage. By tuning $ξ$ , it is eventually possible to precisely obtain the Bell state $| ϕ^{+} ⟩$ .

Figure 2.Schematic representation of the PIC used for random number generation based on SPE. In cyan, the optical waveguides; in blue, the oxide cladding. A red LED is used as a light source. Light coupling in and out of the PIC is performed using tapered optical fibers (transparent cones in the drawing). The PIC can be divided into three parts: generation, relative-position rotation, and absolute-position rotation. The generation stage is enclosed by the yellow rectangle on the left side. Here, the entangled state is created. The relative-position rotation corresponds to the first green rectangle from the left: here two MZIs rotate the qubit of relative position by an angle $ϕ$ . The absolute-position rotation stage is found in the large green rectangle on the right side: here two MZIs rotate the qubit of absolute position by an angle $θ$ . At the output, the rotated state is projected onto one of the four states composing the basis of the four-dimensional Hilbert space: $| U F ⟩, | U N ⟩, | D F ⟩$ , and $| D N ⟩$ . List of abbreviations: MMI, multi-mode interferometer; PS, phase shifter; MZI, Mach–Zehnder interferometer; CR, crossing; SPADs, single-photon avalanche diodes.

To demonstrate the presence of entanglement, a Bell test [34] in the Clauser, Horne, Shimony, and Holt (CHSH) form [35] is operated. Its aim is to quantify the presence of correlations between suitable measurements performed on the two qubits considered. To run a Bell test, it is necessary to define four measurement operations to be performed on the entangled state and connected to two observables, ${A (x)}_{x = 0,1}$ and ${B (y)}_{y = 0,1}$ , each one dependent on a binary variable, $x$ and $y$ , respectively. Such measurements must have binary outputs, $a$ and $b$ , which can then assume values ${\pm 1}$ . In particular, $A (x)$ is an observable that has to be measured only on one qubit, while $B (y)$ only on the other. By defining the correlation coefficient $E (x, y)$ as $E (x, y) = P (a = b | x, y) - P (a \neq b | x, y),$ (4)where $P (a = b | x, y)$ is the conditional probability of observing $a = b$ and $P (a \neq b | x, y)$ is the conditional probability of observing $a \neq b$ , it is possible to define the correlation function $χ$ as $χ = \sum {(- 1)}^{x y} E (x, y) .$ (5)

If $| χ | > 2$ , then we are dealing with an entangled state. More precisely, entanglement is a necessary but non-sufficient condition for a state to satisfy such an inequality, while separable states always result in $| χ | < 2$ [35]. In the PIC, the Bell test is performed by using the other two stages. The two measurement operations ${A (x)}_{x = 0,1}$ and ${B (y)}_{y = 0,1}$ are implemented by a combination of four MZIs with the help of two CRs and four single-photon avalanche diodes (SPADs) that are off-chip. In particular, two MZIs work in parallel to rotate the relative-position qubit by an angle $ϕ$ (green box at the center of Fig. 2), while two cascaded MZIs, separated by a pair of CRs, rotate the absolute-position qubit by an angle $θ$ (green box on the right side of Fig. 2), where $ϕ$ and $θ$ correspond to $y$ and $x$ in Eq. (4), respectively. A fair implementation of such rotations requires that the same rotation angle is set for both the MZIs relative to the same qubit. Then, the rotated SPE state is projected over the four states $| U F ⟩, | U N ⟩, | D F ⟩$ , and $| D N ⟩$ composing the Hilbert space, by means of four waveguides coupled to four off-chip SPADs. According to this, the observable can be constructed in the following way: $A (θ) = U_{1}^{†} (θ) σ_{z} U_{1} (θ),$ (6) $B (ϕ) = U_{2}^{†} (ϕ) σ_{z} U_{2} (ϕ),$ (7)where $U_{1}$ is the action of the MZIs that rotate the absolute-position qubit, $U_{2}$ represents the action of the MZIs that rotate the relative-position qubit, and $σ_{z}$ is the $z$ -Pauli matrix. In our PIC, $σ_{z}$ is represented by the projection on the computational basis $| U F ⟩, | U N ⟩, | D F ⟩$ , and $| D N ⟩$ . In particular, we recall that the states $| U ⟩$ and $| F ⟩$ are eigenstates of the operator $σ_{z}$ with eigenvalue $+ 1$ , while $| D ⟩$ and $| N ⟩$ are eigenstates of the operator $σ_{z}$ with eigenvalue $- 1$ . Consequently, the case $a = b$ is obtained every time the wave function collapses on the state $| U F ⟩ (a = b = + 1)$ or $| D N ⟩ (a = b = - 1)$ . In contrast, the situation $a \neq b$ is obtained when the other states are detected, i.e., $| U N ⟩ (a = + 1, b = - 1), | D F ⟩ (a = - 1, b = + 1)$ . Thus, $P (a = b | x, y) = P (| U F ⟩ | ϕ, θ) + P (| D N ⟩ | ϕ, θ),$ (8) $P (a \neq b | x, y) = P (| U N ⟩ | ϕ, θ) + P (| D F ⟩ | ϕ, θ),$ (9)where $P (| μ ν ⟩ | ϕ, θ)$ is the probability of observing the state $| μ ν ⟩$ given the pair of angles $(ϕ, θ)$ . Such probability can be written as $P (| μ ν ⟩ | ϕ, θ) = Tr [U (ϕ, θ) ρ U {(ϕ, θ)}^{†} P_{μ} \otimes P_{ν}],$ (10)where $U (ϕ, θ) = U_{1} (θ) \otimes U_{2} (ϕ)$ is the action of the MZIs in the PIC, $P_{μ} \otimes P_{ν}$ is the projection operation on the state, and $ρ$ is the density matrix of the state written in the generation stage. Therefore, Eq. (4) becomes $E (ϕ, θ) = P (| U F ⟩ | ϕ, θ) + P (| D N ⟩ | ϕ, θ) - P (| U N ⟩ | ϕ, θ) - P (| D F ⟩ | ϕ, θ) .$ (11)

The theoretical form of the correlation coefficient $E$ and correlation function $χ$ can be calculated introducing the matrix representation of the MZIs. In particular, an MZI is composed of two 50:50 beam splitters, implemented on-chip using MMI devices, separated by two optical waveguides, each one having a PS. In the ideal case, the 50:50 MMI and the PS matrix representations are $U_{MMI} = \frac{1}{\sqrt{2}} (\begin{matrix} 1 & i \\ i & 1 \end{matrix}), U_{PS (ζ_{1}, ζ_{2})} = (\begin{matrix} e^{2 i ζ_{1}} & 0 \\ 0 & e^{2 i ζ_{2}} \end{matrix}) .$ (12)

Consequently, according to standard transfer matrix formalism, the matrix representation of the MZI is $U_{MZI} (ζ_{1}, ζ_{2}) = i e^{i (ζ_{1} + ζ_{2})} (\begin{matrix} \sin (ζ_{1} - ζ_{2}) & \cos (ζ_{1} - ζ_{2}) \\ \cos (ζ_{1} - ζ_{2}) & - \sin (ζ_{1} - ζ_{2}) \end{matrix}) = i e^{i Z} (\begin{matrix} \sin (ζ) & \cos (ζ) \\ \cos (ζ) & - \sin (ζ) \end{matrix}) .$ (13)

Essentially, each MZI implements a rotation of an angle $ζ = ζ_{1} - ζ_{2}$ , with a global phase shift of $Z + π / 2$ , with $Z = ζ_{1} + ζ_{2}$ . Considering the four MZIs represented in Fig. 2, $ζ_{1} = ϕ_{1}, ζ_{2} = ϕ_{2}$ for the two MZIs that rotate the relative-position qubit (first green box from the left in Fig. 2), while $ζ_{1} = θ_{1}, ζ_{2} = θ_{2}$ for the two MZIs that rotate the absolute-position qubit (second green box from the left in Fig. 2). By implementing two rotations of angles $ϕ$ and $θ$ , respectively, for the relative- and absolute-position qubits, the theoretical form of the correlation coefficient $E (ϕ, θ)$ becomes $E (ϕ, θ) = \cos (2 (ϕ - θ)),$ (14)and the correlation function $χ (ϕ, ϕ^{'}, θ, θ^{'})$ results to be $χ (ϕ, ϕ^{'}, θ, θ^{'}) = \cos (2 (ϕ - θ)) - \cos (2 (ϕ - θ^{'})) + \cos (2 (ϕ^{'} - θ)) + \cos (2 (ϕ^{'} - θ^{'})) .$ (15)

By introducing the parameter $α$ , such that $2 (ϕ - θ) = 2 (ϕ^{'} - θ^{'}) = - 2 (ϕ^{'} - θ) = α$ , the correlation function can be rewritten as $χ (α) = 3 \cos (α) - \cos (3 α) .$ (16)

As shown in Fig. 2, to generate SPE states we use an LED. As explained in detail in Ref. [12], the statistics of the photon source does not affect the estimate of the correlation function $χ$ and the corresponding verification of Bell inequality violation since •the photon flux is weak enough to yield a fairly low probability of having more than one photon in the time bin of observation;•only linear optical operations are performed, i.e., any transformation is applied to single photons; and•the observation is performed by single-photon detectors that are both trusted and can fairly sample the outcome probability distributions.

3. NON-IDEALITIES IN THE EXPERIMENTAL ESTIMATION OF $χ (ϕ, ϕ^{'}, θ, θ^{'})$

Our experimental implementation is affected by a few non-idealities, that in principle could result in a wrong estimation of $χ (ϕ, ϕ^{'}, θ, θ^{'})$ . A first aspect to be considered is the broadband spectrum of emission of the LED. Indeed, the PIC has been designed for $λ = 730 nm$ , so that its performances are optimized at that wavelength. However, the used LED source has a broadband spectrum ( $λ = 730 \pm 10 nm$ ), so that the wavelength-dependent behavior of the integrated optical elements has to be taken into account. For example, the matrix representation of the MMIs becomes $U_{MMI} (λ) = (\begin{matrix} t (λ) & i r (λ) \\ i r (λ) & t (λ) \end{matrix}),$ (17)and consequently, the matrix representation of the MZIs is correctly described by $U_{MZI} (λ, ζ_{1}, ζ_{2}) = (\begin{matrix} t {(λ)}^{2} e^{2 i ζ_{1} (λ)} - r {(λ)}^{2} e^{2 i ζ_{2} (λ)} & i r (λ) t (λ) (e^{2 i ζ_{1} (λ)} + e^{2 i ζ_{2} (λ)}) \\ i r (λ) t (λ) (e^{2 i ζ_{1} (λ)} + e^{2 i ζ_{2} (λ)}) & t {(λ)}^{2} e^{2 i ζ_{2} (λ)} - r {(λ)}^{2} e^{2 i ζ_{1} (λ)} \end{matrix}) .$ (18)

A second aspect concerns losses. Waveguide propagation losses have to be considered. Moreover, MMIs can have insertion losses, meaning that $t^{2} (λ) + r^{2} (λ) \leq 1$ . Finally, a third non-negligible aspect is represented by current instabilities of the electronics controlling the PSs of the PIC. Indeed, a key feature that must be ensured when a Bell test is performed is that each qubit must be rotated independently by the other [28]. More formally, the observables that are considered in a Bell test must be written in product form $A (θ) \otimes B (ϕ)$ . This is ensured by imposing the same rotation angle on the two MZIs rotating each qubit. To justify the above requirement, let us consider the situation in which all the MZIs are set with different rotation phases (see Fig. 3): $U (ϕ_{1}, ϕ_{2}, ϕ_{3}, ϕ_{4}) = P_{1} \otimes U_{MZI} (ϕ_{1}, ϕ_{2}) + P_{2} \otimes U_{MZI} (ϕ_{3}, ϕ_{4}); U (θ_{1}, θ_{2}, θ_{3}, θ_{4}) = U_{MZI} (θ_{1}, θ_{2}) \otimes P_{1} + U_{MZI} (θ_{3}, θ_{4}) \otimes P_{2}; P_{1} = (\begin{matrix} 1 & 0 \\ 0 & 0 \end{matrix}), P_{2} = (\begin{matrix} 0 & 0 \\ 0 & 1 \end{matrix}) .$ (19)

Figure 3.Schematic representation of the different phases (green) associated with each MZI with the relative phase errors (white). Each green rectangle highlights the rotation operation performed by the considered MZI according to its phases.

The $P_{1}$ and $P_{2}$ matrices consider that each MZI rotates a particular part of the SPE state that is generated: considering the upper MZI in the first green box of Fig. 2, it rotates the far and near components of the up part of the state. Consequently, in order to have the equalities $U (ϕ_{1}, ϕ_{2}, ϕ_{3}, ϕ_{4}) = I \otimes U_{MZI} (ϕ_{1}, ϕ_{2}),$ (20) $U (θ_{1}, θ_{2}, θ_{3}, θ_{4}) = U_{MZI} (θ_{1}, θ_{2}) \otimes I,$ (21)in such a way that the overall rotation operator takes the form $U (ϕ, θ) = U (ϕ) \otimes U (θ)$ , with $ϕ = ϕ_{1} - ϕ_{2}$ and $θ = θ_{1} - θ_{2}$ , the necessary requirements on the angles are $ϕ_{3} = ϕ_{1}$ , $ϕ_{4} = ϕ_{2}$ and $θ_{3} = θ_{1}$ , $θ_{4} = θ_{2}$ . However, current instabilities cannot ensure such necessary product form to be implemented. Please note that even thermal cross talk between different PSs of the different MZIs could spoil the required product form. However, this phenomenon has not been observed, so it will be neglected in the following discussion (see Section 4 for further details).

A. Broadband Light Source

Here, we consider the wavelength dependence of the transmission and reflection coefficients of the MMIs ( $t$ , $r$ ), as well as of the rotation angles $ζ_{1 (2)}$ set via the MZIs. Without any loss of generality, we can represent the state $ρ$ of the incoming photons as a convex superposition of the following form: $ρ = \int ρ_{ω} d μ (ω),$ (22)for a suitable probability measure $μ$ over the set of possible frequencies $ω$ , while $ρ_{ω}$ represents the state of a monochromatic photon. Since the different elements of the PIC have a response which depends explicitly on the frequency $ω$ of the incoming photons, the overall action of the rotation stage can be described by a family of unitary operators $U {(ϕ, θ)}_{ω}$ , in such a way that each component $ρ_{ω}$ appearing in the decomposition Eq. (22) evolves under the action of the operator $U {(ϕ, θ)}_{ω}$ : $ρ_{ω} \mapsto U {(ϕ, θ)}_{ω} ρ_{ω} U {(ϕ, θ)}_{ω}^{†},$ (23)and by linearity, the transformation of the general state Eq. (22) is given by $ρ \mapsto \int U {(ϕ, θ)}_{ω} ρ_{ω} U {(ϕ, θ)}_{ω}^{†} d μ (ω) .$ (24)

The corresponding quantum probabilities are a convex superposition of the following form: $P (a, b | ϕ, θ) = \int P {(a, b | ϕ, θ)}_{ω} d μ (ω),$ (25)where $P {(a, b | ϕ, θ)}_{ω} = Tr [U {(ϕ, θ)}_{ω} ρ_{ω} U {(ϕ, θ)}_{ω}^{†} P_{a} \otimes P_{b}] .$ (26)

This is equivalent to saying that each monochromatic component $ρ_{ω}$ of the generic state Eq. (22) is subject to the measurement of a different pair of observables, $A {(ϕ)}_{ω} \otimes B {(θ)}_{ω}$ , associated with specific projection-valued measures (PVMs) ${P_{a}^{θ, ω} \otimes P_{b}^{ϕ, ω}}_{a, b}$ : $P {(a, b | ϕ, θ)}_{ω} = Tr [ρ_{ω} P_{a}^{θ, ω} \otimes P_{b}^{ϕ, ω}] = Tr [U {(ϕ, θ)}_{ω} ρ_{ω} U {(ϕ, θ)}_{ω}^{†} P_{a} \otimes P_{b}] .$ (27)

Analogously, the Bell parameter $χ$ is given by the convex superposition $χ = \int χ_{ω} d μ (ω),$ (28)with $χ_{ω} = E_{ω} (ϕ, θ) - E_{ω} (ϕ, θ^{'}) + E_{ω} (ϕ^{'}, θ) + E_{ω} (ϕ^{'}, θ^{'}),$ (29)where $E_{ω} (ϕ, θ) = P {(a = b | ϕ, θ)}_{ω} - P {(a \neq b | ϕ, θ)}_{ω} .$ (30)

This means that using a broadband light source results in a correlation function which is a spectrally weighted average. It is important to point out that this fact does not affect the entropy certification protocol (see Section 6 and Appendix C).

Moreover, we want to stress that here the fact that our light source is non-monochromatic does not require the use of a narrowband optical filter for the actual integrated setup as it is the case for the bulk one reported in Ref. [12]. Indeed, thanks to the fact that the phase delay of MZIs is varied by slightly changing the refractive index of the waveguides all the rotation operations naturally occur within the coherence time.

B. Losses

We can consider two types of losses affecting the PIC: •waveguide propagation losses, that can be viewed as a common factor $e^{- α l}$ , where $α$ is the attenuation coefficient and $l$ is the length of the path (waveguide) taken by photons; and•optical losses specific of each device, due to its insertion in the PIC.

Thanks to the homogeneity of the discrete components and to the symmetry of the PIC, in particular to the nominally equal lengths of the paths corresponding to the four different outputs (detection channels), the overall impact of losses can be modeled by a diagonal operator of the form $L = γ I \otimes I$ , with $γ \in (0,1]$ , hence commuting with any operator acting on the 2-qubits Hilbert space. Therefore, the probability of photon detection per channel is given by $P (a, b | ϕ, θ) = \frac{Tr [U (ϕ, θ) L ρ L^{†} U {(ϕ, θ)}^{†} P_{a} \otimes P_{b}]}{Tr [U (ϕ, θ) L ρ L^{†} U {(ϕ, θ)}^{†}]},$ (31)which can be actually cast in the equivalent form $P (a, b | ϕ, θ) = Tr [U (ϕ, θ) ρ^{'} U {(ϕ, θ)}^{†} P_{x} \otimes P_{y}],$ (32)with a different density operator $ρ^{'} ≔ \frac{L ρ L^{†}}{Tr [L ρ L^{†}]}$ . In addition, it is even possible to consider the case in which the loss effect depends explicitly on the photons’ frequency $ω$ , according to the discussion of the previous subsection. However, as Eq. (32) is of the same form as Eq. (10), we can conclude that this issue does not directly affect the estimate of the correlation function $χ$ .

C. Current Instabilities

In all cases in which electrical currents applied to PSs do not precisely correspond to the desired nominal values, an error $(δ ζ)$ is introduced for each PS. As a general consequence, the matrices representing the rotation operators implemented by the MZIs are no longer in product form, but they have to be written as follows: $U_{real} (ϕ_{1}, ϕ_{2}, δ ϕ_{1}, δ ϕ_{2}, δ ϕ_{3}, δ ϕ_{4}) = P_{1} \otimes U_{MZI} (ϕ_{1} + δ ϕ_{1}, ϕ_{2} + δ ϕ_{2}) + P_{2} \otimes U_{MZI} (ϕ_{1} + δ ϕ_{3}, ϕ_{2} + δ ϕ_{4}); U_{real} (θ_{1}, θ_{2}, δ θ_{1}, δ θ_{2}, δ θ_{3}, δ θ_{4}) = U_{MZI} (θ_{1} + δ θ_{1}, θ_{2} + δ θ_{2}) \otimes P_{1} + U_{MZI} (θ_{1} + δ θ_{3}, θ_{2} + δ θ_{4}) \otimes P_{2} .$ (33)

Note that, with respect to Fig. 3, we have already introduced the conditions $ϕ_{3} = ϕ_{1}$ , $ϕ_{4} = ϕ_{2}$ and $θ_{3} = θ_{1}$ , $θ_{4} = θ_{2}$ . The terms $δ ϕ_{1}, δ ϕ_{2}, δ ϕ_{3}, δ ϕ_{4}, δ θ_{1}, δ θ_{2}, δ θ_{3}, δ θ_{4}$ are all different and appear both in the rotation angles $ϕ = ϕ_{1} - ϕ_{2}$ and $θ = θ_{1} - θ_{2}$ , as well as in the global phase terms imposed by the MZIs $Φ = ϕ_{1} + ϕ_{2}$ and $Θ = θ_{1} + θ_{2}$ . $P_{1}$ and $P_{2}$ are defined in Eq. (19). In this situation the matrix $U_{PS}$ is influenced by the experimental error as $U_{PS (ζ_{1}, ζ_{2})}^{real} = (\begin{matrix} e^{2 i (ζ_{1} + δ ζ_{1})} & 0 \\ 0 & e^{2 i (ζ_{2} + δ ζ_{2})} \end{matrix}) .$ (34)

In general, due to these current instabilities, the effective angle of rotation is different for each PS of each MZI. For clarity, we focus our discussion on the rotation angle $ϕ$ , for which $δ ζ_{1} = δ ϕ_{1}, δ ζ_{2} = δ ϕ_{2}, δ ζ_{3} = δ ϕ_{3}, δ ζ_{4} = δ ϕ_{4}$ . Then, the same arguments can be applied to current-related non-idealities affecting the other rotation angle $θ$ . We start by representing the real operator describing the rotation of the related qubit in the following form: $U^{real} (ϕ_{1}, ϕ_{2}, δ ϕ_{1}, δ ϕ_{2}, δ ϕ_{3}, δ ϕ_{4}) = P_{1} \otimes U_{MMI} U_{PS (ϕ_{1}, ϕ_{2}, δ ϕ_{1}, δ ϕ_{2})}^{real} U_{MMI} + P_{2} \otimes U_{MMI} U_{PS (ϕ_{1}, ϕ_{2}, δ ϕ_{3}, δ ϕ_{4})}^{real} U_{MMI} .$ (35)

This problem is addressed by using the same techniques reported in [15,36]: we look for an ideal operator that can be written as $I \otimes U^{ideal}$ whose distance from $U^{real}$ is the smallest possible, i.e., an operator minimizing the distance from $U^{real} (ϕ_{1}, ϕ_{2}, δ ϕ_{1}, δ ϕ_{2}, δ ϕ_{3}, δ ϕ_{4})$ according to the Hilbert–Schmidt norm. Without loss of generality, we can represent $U^{ideal}$ as the product $U^{ideal} = U_{MMI} W^{ideal} U_{MMI}$ , for a suitable unitary operator $W^{ideal}$ . In the general case, the real operator describing the rotation of one qubit by an angle $ϕ$ can be represented as $U^{real} (ϕ_{1}, ϕ_{2}, δ ϕ_{1}, δ ϕ_{2}, δ ϕ_{3}, δ ϕ_{4}) = (I \otimes U_{MMI}) (I \otimes U_{PS}^{ideal} (ϕ_{1}, ϕ_{2})) D (δ ϕ_{1}, δ ϕ_{2}, δ ϕ_{3}, δ ϕ_{4}) (I \otimes U_{MMI}),$ (36)where $D (δ ϕ_{1}, δ ϕ_{2}, δ ϕ_{3}, δ ϕ_{4}) = (\begin{matrix} e^{2 i δ ϕ_{1}} & 0 & 0 & 0 \\ 0 & e^{2 i δ ϕ_{2}} & 0 & 0 \\ 0 & 0 & e^{2 i δ ϕ_{3}} & 0 \\ 0 & 0 & 0 & e^{2 i δ ϕ_{4}} \end{matrix}) .$ (37)

Similarly, we can rewrite the factorized unitary operator $U^{ideal}$ , which minimizes the Hilbert–Schmidt distance from $U^{real}$ , as $U^{ideal} = I \otimes (U_{MMI} U_{PS} (ϕ_{1}, ϕ_{2}) V^{ideal} U_{MMI})$ (38)for a suitable unitary operator $V^{ideal}$ , where $W^{ideal} = U_{PS} (ϕ_{1}, ϕ_{2}) V^{ideal}$ . By exploiting the representation of a generic element of SU(2) as the exponential of a Pauli vector, the generic unitary operator $V^{ideal}$ will be written in the form $V^{ideal} = e^{i φ} e^{i ϑ \hat{n} \cdot σ} = e^{i φ} (\cos ϑ I + i \sin ϑ \hat{n} \cdot σ),$ (39)for some $φ, ϑ \in [0,2 π)$ , and $\hat{n} \in R^{3}$ , $‖ \hat{n} ‖ = 1$ . It can be proven (see Appendix B) that for $\hat{n} = (0,0,1), φ = \frac{δ ϕ_{1} + δ ϕ_{3} + δ ϕ_{2} + δ ϕ_{4}}{2}, ϑ = \frac{δ ϕ_{1} + δ ϕ_{3} - δ ϕ_{2} - δ ϕ_{4}}{2},$ (40)the Hilbert–Schmidt distance from $U^{real}$ is minimum. We remark that the same reasoning can be applied also for current instabilities affecting the angle $θ$ .

Consequently, it is necessary to evaluate $e_{χ} = \max_{{ϕ, ϕ^{'}, θ, θ^{'}, ρ}} | χ^{ideal} (ϕ, ϕ^{'}, θ, θ^{'}) - χ^{real} (ϕ, ϕ^{'}, θ, θ^{'}) |,$ (41)which represents a correction term that has to be applied to the experimental correlation function $χ^{real}$ . It takes into account the fact that with $U^{real}$ we are not exactly applying a factorized operator to the state $ρ$ and so we are making the error $e_{χ}$ . To estimate such a correction term, we use the numerical approach detailed in Ref. [15]. Note that in the construction of $χ (ϕ, ϕ^{'}, θ, θ^{'})$ four correlation coefficients ${E_{i}}_{i = 1, \dots, 4}$ are considered, each of them having different values of the errors ${{δ ϕ_{i, j}, δ θ_{i, k}}_{j, k = 1, \dots, 4}}_{i = 1, \dots, 4}$ . To simplify the evaluation, we evaluate ${e_{χ, ξ}}_{ξ = 1, \dots, 4}$ considering that the four ${E_{i}}_{i = 1, \dots, 4}$ in $χ$ have the same errors ${δ ϕ_{ξ, j}, δ θ_{ξ, k}}_{j, k = 1, \dots, 4}$ of the correlation coefficient $E_{x i}$ .

D. Other Sources of Non-Idealities

Other non-idealities in our experimental setup come from the detectors (dead-time, after-pulsing, and dark counts), especially because no randomization of the input sequence of measurement operations necessary to estimate the probabilities ${P (a, b | ϕ, θ)}_{ϕ, θ, a, b}$ is performed. In this particular implementation we neglect such non-idealities because in Ref. [15] it has been observed that, for a photon flux of $≃ 200 kHz$ , the corrections to the probabilities are negligible. As a lower flux of photons $≃ 120 kHz$ is here used (mainly because of LED-to-fiber low coupling efficiency), we can safely neglect such a correction factor.

4. METHODS

The PIC has been fabricated in the cleanroom of Fondazione Bruno Kessler. The waveguide core (300 nm thick and 700 nm wide) is made of silicon oxynitride ( ${SiO}_{x} N_{y}$ ) and the bottom and top claddings are made, respectively, of thermally grown silicon oxide ( ${SiO}_{2}$ ) and borophosphosilicate glass. The design wavelength of the integrated components is 730 nm and the mode polarization is transverse electric (TE). The linear characterization of the building-blocks of the PIC, namely MMIs and CRs, has been carried out using a spectrally filtered supercontinuum laser emitting from 300 to 2000 nm, and details about their performances can be found in Appendix A. The measured insertion loss of a 1 cm long straight waveguide is 27 dB for TE polarization.

Our experiment is performed using an attenuated commercial LED at $730 \pm 10 nm$ . The light coming from the LED is collimated using an objective and polarized using a Glan–Thompson polarizer. A fiber port is used to couple light inside an optical fiber, where light is attenuated by means of a variable optical attenuator and polarization is controlled and set to be TE at the output. The input–output coupling is performed using a standard fiber array. A power supply is used to control the different phase shifters present on the PIC.

Prior to our measurements, a mandatory calibration of integrated MZIs has been performed using a Ti:sapphire laser tuned at 730 nm. In particular, the phase-power relation $ϕ = ϕ (W)$ of the different MZIs is retrieved by fitting operations of the transmitted optical power using the following equations: $I_{out 1} = a \cos {(b W + d)}^{2} + c,$ (42) $I_{out 2} = a \sin {(b W + d)}^{2} + c,$ (43)corresponding to the two output ports of an MZI, where $a, b, c, d$ are fitting parameters. This allows reconstruction of the relation $ϕ = ϕ (W)$ for each MZI by means of the linear function $ϕ (W) = b W + d$ . Please note that, to eliminate the thermal cross talk between different MZIs, each PS is encapsulated between trenches (areas in which the core and cladding materials are removed) to limit the heat propagation inside the PIC. This and the low thermal conductivity of the silicon oxide strongly limit the thermal cross talk, making it negligible during the experiment.

The phase $ξ = ξ_{1} - ξ_{2}$ of the generation stage is obtained by another fitting operation, applying the correct calibration to each MZI. Here an issue is due to the absence of additional compensation phase shifters after the MZIs rotating the relative-position qubit. In this situation, the value of $ξ$ to fix the phase difference between the $| N ⟩$ components of the state basis is different with respect to the one for the $| F ⟩$ components. For this reason, the following strategy is introduced. First, we set the value of $ξ$ necessary to have the expected phase relation between the $| F ⟩$ components, and only counts from channels $| U F ⟩$ and $| D F ⟩$ are acquired. Second, the experiment is repeated acquiring only counts from channels $| U N ⟩$ and $| D N ⟩$ , by changing $ξ$ to the value that adjusts the phase relation of the $| N ⟩$ components too.

Finally, the measurements to demonstrate our certified QRNG integrated device are performed using four SPADs (Excelitas), whose efficiencies have been equalized using fiber-coupled variable optical attenuators, and whose electrical outputs are sent to a time-tagging electronics (Swabian Instruments) connected to a PC in order to count single-photon detection events for each channel over time. The following procedure has been followed. First, an angle of rotation $θ$ of the absolute-position qubit is fixed and a sweep over $ϕ$ angles of relative position is performed. For each pair $(θ, ϕ)$ of angles, a 1 s time window is acquired with a time bin set at 1 μs for the time tagger. Then, the angle $θ$ is changed and a sweep of the other angle $ϕ$ is again performed. Time bins with no detection events are discarded, while whenever multiple photon detection events are registered at different SPADs within the same time bin, one single event is randomly assigned to one of the four two-qubit states by means of a pseudo-random number generator.

5. EXPERIMENTAL DEMONSTRATION OF THE PRESENCE OF ENTANGLEMENT

The experimental demonstration of the presence of entanglement is performed by fixing the angle $θ \in [- 2,0] rad$ and performing a sweep of the rotation angle $ϕ \in [- 2,2] rad$ . An acquisition 1 s long with a time bin of 1 μs is performed for each $(ϕ, θ)$ . The average photons flux is $≃ 120 kHZ$ . In this way, we estimate the conditional probabilities $P (| μ ν ⟩ | ϕ, θ)$ as the empirical frequencies of the counts: $P (| μ ν ⟩ | ϕ, θ) = \frac{N_{| μ ν ⟩}}{\sum N_{| μ ν ⟩}},$ (44)where $N_{| μ ν ⟩}$ is the number of detected photons in the state $| μ ν ⟩$ and $\sum N_{| μ ν ⟩}$ is the total number of detected photons. Note that no-detection events are eliminated from the detection sequence, while multiple-detection events are randomly assigned to only one of the detection channels using a pseudo-random number generator. The experimental correlation coefficients $E (ϕ, θ)$ are reported in Fig. 4 as data points. The colored surface reported in Fig. 4 represents the theoretical correlation coefficient $E (ϕ, θ)$ in the case of non-ideal 50:50 beam splitters with transmission and reflection power coefficients of $T = 40 %$ and $R = 60 %$ , respectively (see Appendix A for the results of our experimental characterization). This results in $E (ϕ, θ) = η (5 + (- 48) \sqrt{6} + (- 24) (5 + 2 \sqrt{6}) \cos (2 ϕ) + (- 24) (5 + 2 \sqrt{6}) \cos (2 θ) + 48 (30 + (- 13) \sqrt{6}) \cos (2 (ϕ + θ)) + 288 (5 + 2 \sqrt{6}) \cos (2 (ϕ - θ)),$ (45)where $η = \frac{1}{3125} ≃ 3.2 \times 10^{- 4}$ . Instead, by a fit of the experimental data, we obtain $η = (3.01 \pm 0.04) \times 10^{- 4}$ . The difference between the theoretical and the fitted $η$ values could be explained by the broadband spectrum of the LED source, since for $λ \neq 730 nm$ the parameters of the MMI are slightly different.

Figure 4.Experimental correlation coefficients $E (ϕ, θ)$ ) (blue dots) with the related fit (colored surface), according to Eq. (45). $ϕ$ is the rotation angle of the relative-position qubit, while $θ$ is the rotation angle of the absolute-position qubit. Color bar refers to the value of $E$ .

Figure 5.Experimental demonstration of the violation of the Bell inequality. Data points (red dots) with their error bars (smaller than the size of the data points) and the theoretical curve (blue line) of the $χ$ correlation function, both with respect to the parameter $α$ . In cyan, the areas corresponding to violation of the Bell inequality. Due to a failure of the wire bonding of one PS of one MZI, it was possible to acquire only data points in a limited range of $α$ .

6. FROM ENTANGLEMENT TO QUANTUM-CERTIFIED RANDOM NUMBERS

Recently, a few of us demonstrated that it is possible to obtain a semi-device-independent randomness certification scheme starting from SPE states of momentum and polarization using a bulky experimental implementation [15,36]. Therefore, here we use the PIC reported in Fig. 2 as an SDI-QRNG, certified by the evaluation of the correlation function $χ$ .

Using SPE states, the methods of generating quantum-certified random numbers can be schematized in the following way [Fig. 6(a)]: first, a set of angles ${(ϕ_{i}, θ_{j})}_{i, j = 0,1}$ is selected to evaluate the Bell correlation function $χ (ϕ_{0}, ϕ_{1}, θ_{0}, θ_{1})$ . Then, the actual protocol starts. A single-photon path-entangled state is generated. The two qubits that compose the state are rotated by the operation $U (ϕ_{i}, θ_{j})$ . The rotated state is projected over the four states $| U F ⟩, | U N ⟩, | D F ⟩$ , and $| D N ⟩ .$ Depending on the outcome of the measurement operation, or equivalently, on the collapsed state, a random digit is obtained according to the following encoding: $| U F ⟩ \to 00, | U N ⟩ \to 01, | D F ⟩ \to 10, | D N ⟩ \to 11$ . Then, the raw random sequence is generated by repeating this procedure many times for each pair of angles. An example of the raw sequence obtained is reported in Fig. 6(b). Note that the pair of angles $(ϕ_{i}, θ_{j})$ can be kept fixed during a long acquisition of detection events. Then the angles could be changed, and a new acquisition would start. This methodology does not require any input randomness and enables the application of an entropy certification protocol similar to the one reported in Refs. [15,36].

Figure 6.(a) Method to generate a random number: (1) an SPE state is generated (yellow box); (2) the relative- and absolute-position qubits of the SPE state are rotated respectively by the angles $ϕ_{i}$ (first green box) and $θ_{j}$ (second green box) by the different MZIs; (3) the rotated SPE state is measured by state projection on one of the four basis states ( $| U F ⟩, | U N ⟩, | D F ⟩, | D N ⟩$ ) and the clicking SPAD determines the raw number. These steps are repeated many times to generate a raw sequence of random numbers. (b) Example of the random number sequence obtained using the encoding $| U F ⟩ \to 00, | U N ⟩ \to 01, | D F ⟩ \to 10, | D N ⟩ \to 11$ given a certain pair ( $ϕ_{i}$ , $θ_{j}$ ). The outcome of multiple detection events is randomized (slots with $*$ in the figure), while time bins with no detection are discarded.

First of all, we recall the hypotheses over which our certification scheme is based: 1.SPADs are characterized.2.A characterization of all the MZIs present on the PIC is available.3.The power supply that drives the currents to the PSs is error-prone and it is not controlled by an adversary.4.The generation and measurement parameters must be stable during the acquisition time.

Hypothesis 1 means that the used SPADs are trustworthy and not controlled by an adversary. Moreover, their non-idealities, such as the limited efficiency, the probability of after-pulsing, and the dead time, are known. Such a hypothesis is necessary to fairly reconstruct the probabilities $P (a, b | ϕ_{i}, θ_{j})$ . Indeed, as soon as the pair of angles $(ϕ_{i}, θ_{j})$ is not randomized for every round of the experiment, an adversary could induce detector clicks in a deterministic way to mimic the violation of a Bell inequality. Hypotheses 2 and 3, instead, are necessary to set the same angles $ϕ$ and $θ$ on the different MZIs pairs. In particular, hypothesis 2 is required to take into account the fact that the starting phase of each MZI is not exactly 0, while hypothesis 3 is necessary to set the correct currents at the phase shifters. These hypotheses mean that for each MZI in the PIC, the relation between the rotation angle $ξ$ and the applied power $W$ , $ξ (W) = b W + d$ is known. Moreover, the power supply used is trustworthy and not maliciously controlled by an adversary. However, it can be error-prone, so it can set a power $W^{'}$ , slightly different from the selected one, $W$ . Hypothesis 4 is necessary to rule out any possible measurement basis-dependent change of the input state [15]. In practice, this means that when the pair of angles $(ϕ_{i}, θ_{j})$ is fixed and the measurement is performed, the entangled state and the rotations do not change with time, i.e., the phases set by the different PSs do not change. Such a requirement is ensured by selecting a total measurement time short enough that no instabilities are observed and by letting the PIC thermalize between different measurements to eliminate any thermal cross talk. Our certification protocol is independent of the particular form of the input state $ρ$ . In particular, for the four sequences of detection events corresponding to the angles ${(ϕ_{i}, θ_{j})}_{i, j = 0,1}$ , the related conditional guessing probability can be bounded by using [15,36] $P_{guess} (a, b | ϕ_{i}, θ_{j}) \leq \frac{1}{2} + \frac{1}{2} \sqrt{2 - {(| χ_{real} | - e_{χ})}^{2} / 4} + e_{P},$ (46)where $χ_{real}$ is the correlation function in the CHSH form estimated from the experimental data. $e_{χ}$ represents the correction term previously introduced in Section 3. We stress that the maximization procedure for $e_{χ}$ is run over every possible combination of angles ${ϕ, ϕ^{'}, θ, θ^{'}}$ , in such a way to map every possible operator $U^{real}$ , and over every possible state $ρ$ . $e_{P}$ is another numerical correction term, which has the same meaning as $e_{χ}$ but for probabilities instead: it represents an upper bound for the difference between the ideal probabilities obtained by measuring factorized observables and the estimated probabilities obtained in the presence of the non-idealities here considered. $e_{P}$ is estimated in the same way as $e_{χ}$ by using the numerical methods described in Ref. [15]. We remind the reader that, with respect to the result reported in Ref. [15], here we are neglecting the Markovian correction to the guessing probability $P_{guess}$ , introduced to take into account memory effects due to detectors non-idealities, such as after-pulsing and dead time. Indeed, as this work is interested by a lower flux compared to the one reported in that work, the effect of that correction is actually negligible. Note that Eq. (46) is valid even considering the broadband spectrum of our LED source (see the demonstration in Appendix C).

To experimentally demonstrate the generation of certified random numbers we select the time trace of the detection events giving the maximum and minimum violations of the Bell inequality, as reported in Section 5. These are $χ^{+} = 2.697 \pm 0.004$ for $(ϕ_{0} = - 0.576 \pm 0.002, ϕ_{1} = - 1.445 \pm 0.002, θ_{0} = - 1.11 \pm 0.02, θ_{1} = - 1.87 \pm 0.02)$ and $χ^{-} = - 2.668 \pm 0.004$ for $(ϕ_{0} = - 1.589 \pm 0.002, ϕ_{1} = 0.863 \pm 0.002, θ_{0} = - 0.35 \pm 0.02, θ_{1} = - 1.27 \pm 0.02)$ . The time traces of the estimated probabilities used for computing the correlation functions $χ^{+}$ and $χ^{-}$ are reported in Figs. 7(a) and 8(a). These are obtained as 50 ms long averages. As can be observed, the probabilities are quite stable during the entire acquisition time. The values of $χ$ corresponding to these time intervals are then reported in Fig. 7(b) for $χ^{+}$ and Fig. 8(b) for $χ^{-}$ , together with their mean value and related 99% confidence interval (blue shaded region).

Figure 7.(a) Probabilities of each measurement outcome as a function of time (blue $| D F ⟩$ , red $| D N ⟩$ , yellow $| U N ⟩$ , and purple $| U F ⟩$ ) for the four pairs of angles $(ϕ_{0}, θ_{0})$ , $(ϕ_{1}, θ_{0})$ , $(ϕ_{0}, θ_{1})$ , $(ϕ_{1}, θ_{1})$ of $χ^{+}$ . The estimates have been done considering time intervals of 50 ms. (b) Dots: corresponding values of $χ^{+}$ as a function of time. Solid line: mean value of $χ^{+}$ . Dashed region: 99% confidence interval.

Figure 8.(a) Probabilities of each measurement outcome as a function of time (blue $| D F ⟩$ , red $| D N ⟩$ , yellow $| U N ⟩$ , and purple $| U F ⟩$ ) for the four pairs of angles $(ϕ_{0}, θ_{0})$ , $(ϕ_{1}, θ_{0})$ , $(ϕ_{0}, θ_{1})$ , $(ϕ_{1}, θ_{1})$ of $χ^{-}$ . The estimates have been done considering time intervals of 50 ms. (b) Dots: corresponding values of $χ^{-}$ as a function of time. Solid line: mean value of $χ^{-}$ . Dashed region: 99% confidence interval.

Considering these values of violation of Bell inequality and the corresponding values of $e_{χ}, e_{P}$ [ $e_{χ^{+}} = 0.092, e_{P} (χ^{+}) = 0.02$ and $e_{χ^{-}} = 0.077, e_{P} (χ^{-}) = 0.014$ ], we obtain the following guessing probabilities: $P_{guess} (a, b | ϕ_{x}, θ_{y}) = 0.796 \pm 0.002 for χ^{+}, P_{guess} (a, b | ϕ_{x}, θ_{y}) = 0.798 \pm 0.002 for χ^{-} .$

Note that the upper bound to $P_{guess} (a, b | ϕ_{x}, θ_{y})$ given by Eq. (46) represents the best estimate for the marginal guessing probability, e.g., $P_{guess} (b | θ_{y}) = \max \sum_{a} P_{guess} (a, b | ϕ_{x}, θ_{y})$ , where the marginal refers to a single qubit. Therefore, from an operative point of view, in order to refer $H_{\min}$ to a single qubit, we write as bit 0 each photon detected as $| F ⟩$ state independently of its absolute position, and as bit 1 each photon detected as $| N ⟩$ state independently of its absolute position (i.e., $00,10 \to 0$ ; $01,11 \to 1$ ). By applying the formula [29] $H_{\min} = - \log_{2} (P_{guess} (a, b | ϕ_{x}, θ_{y})),$ (47)we get $H_{\min} = (33.0 \pm 0.4) % for χ^{+}, H_{\min} = (32.6 \pm 0.4) % for χ^{-} .$

Having used an average rate of 120 kHz for each acquisition, the final rate of our quantum-certified SDI-QRNG is given by $(120 \times H_{\min})$ kHz which, in the best case (namely $χ^{+}$ ), gives a generation rate of $≃ 40 kHz$ . This rate does not consider the randomness extraction procedure [30]. We remind the reader that, in this work, we focus on the estimation of $H_{\min}$ and the extraction procedure is not performed. However, by applying a quantum-safe randomness extractor, e.g., Toeplitz-hashing extractor [37] or Trevisan’s extractor [38,39], it is mathematically proven that it is possible to obtain a final sequence of independent and uniformly distributed bits up to a given level of accuracy.

7. CONCLUSION

Single-photon path entanglement has been demonstrated in a PIC by measuring the Bell inequality violation in the CHSH formulation. Photons are generated in an off-chip LED, are manipulated in a PIC fabricated in a silicon foundry, and are detected by using off-chip silicon SPADs. The PIC is based on simple and well-known optical components, i.e., MMIs, PSs based on the thermo-optic effect, MZIs, and CRs. Experimental data are well fitted by a theoretical model which considers the non-idealities of our setup, mainly related to unbalanced beam splitters (MMIs). A large violation of the CHSH inequality is reported ( $2.605 \pm 0.004$ ) by recursively trying each possible combination of the acquired correlation coefficients.

These SPE states are used to demonstrate a certified QRNG working accordingly to a semi-device-independent certification protocol similar to the one in Refs. [15,36]. Since in Refs. [15,36] discrete optical components and different degrees of freedom were used, a few assumptions are here different. Specifically, our present approach is based on the knowledge of the single-photon detectors as well as of the integrated MZIs. In addition, the power supply controlling the heaters in the MZIs must be trusted, even if error-prone, as well as the set phase delays must be stable during the acquisition time. No hypothesis is needed on the input state. Under these assumptions, we are able to certify a maximum value of the quantum min-entropy $H_{\min} = (33.0 \pm 0.4) %$ , which is 1 order of magnitude larger than that obtained with a bulk setup [15]. This large improvement is due to the smaller correction terms $e_{χ}$ and $e_{P}$ of the integrated QRNG because of the smaller non-idealities in the integrated photonic components with respect to the discrete optical components. To compare the proposed SDI-QRNG to the existing literature, three parameters will be discussed: security, speed, and integration. Concerning security, the proposed QRNG can be compared to source-independent QRNGs, in which the source is left uncharacterized while the measurement operations are fully characterized. Our system is more secure because the performed measurements are only partially characterized. The only requirements are that the measured observables must be in product form, i.e., the measurement performed on one qubit does not influence the other, and they do not change during the experiment. Apart from these assumptions, the particular form of the chosen operator is unimportant. Concerning speed, the achieved generation rate is low compared to the ones reported in the literature. However, this work has focused on demonstrating the generation of certified quantum random numbers using an integrated PIC without optimizing the generation rate. The measured QRNG generation rate ( $≃ 40 kHz$ ) is strongly limited by the actual coupling efficiency of the LED to the optical fiber and to the PIC, decreasing the photon flux in the PIC. In future experiments, a better coupling scheme based on, e.g., optimized grating couplers or direct LED bonding could significantly improve the coupling efficiency. Then, the saturation rate of the SPAD detectors will give the other limit. Considering working at the linearity limit of SPADs, i.e., 1 MHz rate, the achievable certified random bit rate is of the order of 330 kHz. To further increase such a value, it is necessary to use engineered detectors, e.g., multiplexing more SPADs in a single detector. The use of silicon photomultipliers (SiPMs), which are arrays of SPADs, could be a viable solution. For example, having four SiPMs composed by 16 SPADs with a linearity limit of 1 MHz, as the one reported in Ref. [40], it is possible to reach a generation rate of $≃ 5 MHz$ . By using SiPMs with bigger arrays of SPADs, it is possible to increase the rate further. Another solution relies on the multiplexing of N circuits in the same PIC, using the same light source and dividing it by using an initial $1 \times N$ MMI. Such a solution will require less attenuation of the LED. Moreover, all the circuits act as independent SDI-QRNGs, improving the rate by a factor of $N$ . Last but not least, integration. The proposed QRNG is particularly interesting concerning potential applications. Many works in the literature are based on laser sources which can be fully integrated as well. However, our QRNG uses an LED, which is potentially cheaper to integrate than a laser. This, together with the possibility of co-integration of the SPADs [41,42], enables its use for applications that necessitate low production costs, such as Internet of Things devices.

To conclude, a PIC able to generate quantum certified random numbers using single-photon path-entangled states represents a further step to move semi-device-independent QRNGs from the lab to real-world applications.

Acknowledgment

Acknowledgment. This project has been supported by PAT via Q@TN, the joint lab between University of Trento, FBK-Fondazione Bruno Kessler, INFN-National Institute for Nuclear Physics and CNR-National Research Council.

APPENDIX A: CHARACTERIZATION OF THE INTEGRATED OPTICAL DEVICES