Device-Independent Randomness Amplification

• Device-independent randomness amplification is the process of converting weak, biased random sources into nearly perfect, private random bits using untrusted quantum devices through Bell test violations.
• Protocols employ various source models such as Santha-Vazirani and min-entropy, leveraging GHZ, Mermin, and Hardy paradox correlations to certify intrinsic randomness.
• Advances focus on reducing device counts, enhancing noise tolerance, and establishing security against quantum and no-signaling adversaries with experimental validations.

Searching arXiv for recent and foundational papers on device-independent randomness amplification. Device-independent randomness amplification is the task of transforming a weak random source into nearly perfect, and in several protocols private, random bits by using untrusted quantum devices and certifying their output only from observed nonlocal statistics. In this setting, amplification is impossible classically for a single weak source, but becomes possible when Bell-inequality-violating correlations are available and the relevant device components are prevented from signaling to one another. The subject spans Santha-Vazirani sources, general min-entropy sources, public and private weak sources, and security models ranging from quantum to general no-signaling adversaries; it also includes protocols for amplification, extraction, and privatization, as well as recent loophole-free experimental demonstrations (Bouda et al., 2014, Kulikov et al., 2024).

1. Source models and the amplification problem

A central distinction in the literature is between weak-source models. For a Santha-Vazirani source, each bit satisfies

$$\frac{1}{2} - \varepsilon \leq P(X_{i+1}=0 \mid X_i,\ldots,X_1) \leq \frac{1}{2} + \varepsilon,$$

so every bit is bounded away from determinism, although arbitrary correlations with the past are allowed. By contrast, min-entropy sources guarantee only total entropy, for example

$$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$

or, in block form,

$H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$

This distinction is operationally decisive: several early device-independent protocols were tailored to SV sources, whereas extraction from general min-entropy sources initially required substantially more separated devices (Bouda et al., 2014, Ramanathan, 2023).

The literature also distinguishes private and public weak sources. Public weak sources arise when the source bits are broadcast once generated, as in the case of a public randomness beacon; the problem of device-independent extraction from weak public sources against no-signaling adversaries remained open until finite-device protocols for public SV sources were given (Ramanathan et al., 2021). Other works explicitly address a single public SV source and aim not only at amplification but also at privatization, so that the final output is close to uniform even given the adversary’s side information (Kessler et al., 2017).

A further axis is whether the weak source is a single block, a reusable block source, or a one-shot min-entropy source. One protocol extracts random bits with arbitrarily low bias from a single arbitrarily weak min-entropy source in a device independent setting, works with single-use or block min-entropy sources, and for block sources uses a number of devices that scales polynomially in the sequence length $n$ (Bouda et al., 2014). Later work reduces the device count for general min-entropy sources by treating a two-block source with only two spatially separated device components and proving security against general quantum adversaries (Ramanathan, 2023).

2. Nonlocality as a randomness witness

Device independence means that randomness is certified solely by the observed violation of Bell inequalities, without trusting the internal workings of the devices. In this sense, Bell or steering violations serve as entropy witnesses: if the observed statistics cannot be explained by local realistic or local-hidden-state models, then the outputs must contain intrinsic randomness, possibly even against adversaries holding side information (Shalm et al., 2019, Sarkar, 2023).

One major family of protocols uses GHZ- or Mermin-type correlations. In the tripartite Mermin setting, each box takes a single-bit input and outputs a single bit, with allowed inputs $\{111,100,010,001\}$ and parity test

$A\oplus B\oplus C = X\cdot Y\cdot Z.$

For uniform inputs, any classical device satisfies $v_u \leq \frac34$, while entangled devices can reach $v_u=1$ using a GHZ state. In these protocols, a super-classical violation directly bounds the output bias: the larger the Mermin violation, the closer the output is to uniform (Bouda et al., 2014). Closely related single-device protocols repeatedly reuse one device decomposable into three non-communicating parts and use GHZ correlations to force locally unpredictable outputs in sufficiently many rounds (Plesch et al., 2013).

A second family is based on measurement-dependent-locality and Hardy-type paradoxes. These constructions are designed for settings in which the input randomness itself is weak. For binary inputs and outputs, one representative MDL inequality is

$$S_\mu \equiv \mu_{\min} P_{ABXY}(0000) - \mu_{\max} \big( P_{ABXY}(0101) + P_{ABXY}(1010) + P_{ABXY}(0011) \big),$$

with classical bound $S_\mu \le 0$. Any positive value witnesses nonclassicality even for biased inputs (Kessler et al., 2017, Kulikov et al., 2024). Tilted Hardy paradoxes sharpen this approach: they self-test general pure two-qubit entangled states, certify up to $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$0 bit of local randomness, improve randomness amplification rates for arbitrarily biased SV sources, and in higher-dimensional constructions are proposed as candidates for certifying up to $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$1 bits of global randomness (Zhao et al., 2022).

The literature also contains certification schemes outside the fully device-independent Bell-input paradigm. A one-sided device-independent protocol with no measurement inputs uses a quantum network with two independent sources, a trusted Alice, and an untrusted Bob. Maximal violation of a swap-steering inequality self-tests maximally entangled states and Bob’s Bell-basis measurement, and yields a local guessing probability $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$2, hence $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$3, without any initial seed randomness (Sarkar, 2023). This is not full device independence, but it shows that the usual seed-randomness requirement can be removed in a 1SDI setting.

3. Protocol constructions

The main protocol architectures differ by source model, number of devices, and extractor strategy. Representative examples are summarized below.

Setting	Representative result	Papers
Single weak SV source, single reused device	Perfect randomness if $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$4	(Plesch et al., 2013)
Arbitrarily weak min-entropy source	Arbitrarily low bias from a single source; polynomial scaling for block sources	(Bouda et al., 2014)
Any non-deterministic SV source, constant devices	Four-device and eight-device protocols with constant noise tolerance	(Brandao et al., 2013)
Two no-signaling components	Full amplification from any $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$5 SV source using partial tomography	(Ramanathan et al., 2015)
Public SV source with privatization	Two-component protocol with non-vanishing extraction rate and maximal noise tolerance	(Kessler et al., 2017)
Two-block min-entropy source, quantum adversary	Two-device finite protocol using Trevisan pre-processing, MDL-Hardy testing, and Raz extraction	(Ramanathan, 2023)

For SV sources, early robust constructions used several groups of non-signaling boxes, selected and tested using SV bits, and combined the resulting weakly random outputs with a simple XOR hash. One such protocol uses a four-party Bell inequality, tolerates a constant rate of noise, depends only on no-signaling, and proves a new de Finetti theorem in which the subsystems are selected from an SV source (Ramanathan et al., 2013). A subsequent advance reduced the device count to a constant: four devices suffice for a non-explicit extractor protocol, while an explicit version uses eight devices, amplifies any non-deterministic source into a fully random source, tolerates a constant rate of error, and bases correctness solely on no-signaling (Brandao et al., 2013).

Two-component protocols are particularly important because they approach the minimal Bell architecture. One no-signaling-proof protocol shows that it is enough for a two-party Bell test to certify only partial randomness, namely a single input-output pair $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$6 such that $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$7 is bounded away from $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$8. The protocol adds a partial tomographic procedure on the empirical statistics to ensure that the outputs form a linear min-entropy source and then uses a two-source extractor (Ramanathan et al., 2015). A later protocol for a single public SV source combines a family of MDL Bell inequalities, a single-round entropy lower bound, the entropy accumulation theorem, and quantum-proof multi-source extractors in the Markov model. It is the first protocol to combine amplification and privatization of a public SV source with arbitrary bias, only two components, non-vanishing extraction rate, and maximal noise tolerance (Kessler et al., 2017).

For general min-entropy sources, the constructions are different. A polynomial-size family of hash functions can be used so that, for any possible weak-randomness block, at least one Mermin device receives perfectly uniform inputs. In the single-round version, the output bit is the XOR of one designated output from all devices; for block sources, the protocol is repeated over many rounds, and the final bit is the XOR across rounds. This achieves arbitrarily small bias with failure probability exponentially small in the number of rounds, while one-shot arbitrarily weak sources remain possible at the cost of much larger device counts (Bouda et al., 2014). More recently, a finite-device protocol for a two-block min-entropy source first enumerates all seeds of a Trevisan extractor to create a quantum-somewhere-random source, then runs an MDL-Hardy Bell test sequentially, and finally applies Raz’s two-source extractor to the device outputs and the second entropy block (Ramanathan, 2023).

4. Security notions and adversarial models

The strongest security model in this area is against general no-signaling adversaries. Several SV-source amplification protocols are proved secure under no-signaling alone, including robust four-party schemes, constant-device schemes, two-component protocols, and public-source protocols (Ramanathan et al., 2013, Brandao et al., 2013, Ramanathan et al., 2015, Ramanathan et al., 2021). In these works, device components may be completely uncharacterized, and only relativistic no-signaling between components is assumed.

Other works target quantum adversaries and composable security with quantum side information. The two-component public-source protocol with privatization proves that, except with abort probability, the output is $$H_{\infty}(X\vert E) = -\log_2 \max_{x,e} P(X=x\vert E=e),$$9-close to uniform with respect to all of Eve’s information; its security relies on entropy accumulation and quantum-proof extractors in the Markov model (Kessler et al., 2017). The two-block min-entropy protocol also gives composable security against quantum side information, under a Markov assumption relating the source, devices, and adversary (Ramanathan, 2023). The recent experimental superconducting-circuit realization states privacy in trace distance as

$H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$0

with $H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$1 in the reported demonstration (Kulikov et al., 2024).

A recurring issue is source-device correlation. Many early analyses assumed that the weak source is independent of the devices. This was later relaxed by introducing an SV-like condition for devices: any string of SV source bits must remain weakly random conditioned upon another string from the same source and the outputs obtained when that further string is input into the devices. Under this condition, a chained-Bell-inequality protocol achieves amplification for $H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$2 asymptotically, and composable security against a class of attacks for $H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$3 (Wojewodka et al., 2016).

A more recent generalization shifts the independence requirement from outputs to processes. Instead of assuming that extracted variables are conditionally independent given adversarial information, it is enough to assume causal independence of the channels that generate them, modeled as a tensor product of channels. Because channel independence can be enforced by spacelike separation, this removes the earlier restriction that the adversary only has access to classical side information about the source in device-independent randomness amplification (Sandfuchs et al., 6 Oct 2025). This suggests a physically more justifiable route to quantum-side-information security.

Seed randomness is another central issue. Traditional device-independent and semi-device-independent schemes require an initial random seed to choose measurement settings. In contrast, the 1SDI network protocol with no inputs certifies two bits of randomness without any initial seed randomness, at the price of assuming a trusted party and classical independence of two sources (Sarkar, 2023). In the fully device-independent setting, the bootstrap problem is still usually handled by weak-source assumptions rather than eliminated outright.

5. Resource trade-offs, robustness, and limitations

Resource scaling is a defining difficulty of randomness amplification. For arbitrarily weak min-entropy sources, block-source protocols can achieve polynomial scaling in the source length $H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$4, with the number of devices

$H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$5

where $H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$6 is the block min-entropy and $H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$7 is the failure parameter. But for one-shot arbitrarily weak sources, the device count grows doubly-exponentially in the min-entropy rate $H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$8 and in the bias parameter (Bouda et al., 2014). This sharp contrast between block and one-shot settings remains one of the most important structural limitations.

Threshold phenomena also appear. The single-device GHZ protocol produces perfect random bits if and only if the source’s min-entropy rate satisfies

$H_{\infty}(X_i \mid X_{i-1},\ldots,X_1,E)\geq k.$9

If $n$0, a cheating device can deterministically fix the output without risk of detection; if $n$1 is above threshold, the bias of the final output decays exponentially with the number of rounds (Plesch et al., 2013). This explicitly quantifies the cost of reusing one device rather than distributing the task across many separated devices.

Noise tolerance has progressed from a major weakness to a standard design objective. Robust SV-source protocols tolerate a constant rate of noise or error per operation, and in some cases as high as $n$2 for an $n$3-SV source (Ramanathan et al., 2013, Brandao et al., 2013). The public-source privatization protocol claims maximal noise tolerance in the sense that, asymptotically, any observed violation of the relevant Bell inequality suffices to extract some randomness (Kessler et al., 2017). By contrast, the earlier single-device GHZ protocol is explicitly not fault tolerant and aborts on any failed test (Plesch et al., 2013).

Implementation assumptions remain stringent. Fully device-independent protocols require non-signaling between device components, typically enforced by spatial or spacelike separation. Some analyses further require source-device independence or a Markov condition, while others demand that source bits used during the protocol are generated only after the adversary has supplied the devices (Kessler et al., 2017, Ramanathan, 2023). A separate line of work argues that, for randomness generation in the same laboratory, the assumption of perfect isolation can be relaxed to weak cross-talk quantified by a parameter $n$4, with certified randomness degrading gracefully as $n$5 increases (Silman et al., 2012). This is directly relevant to implementation, although it is formulated for device-independent randomness generation rather than amplification specifically.

6. Experiments and adjacent developments

For several years, randomness amplification was primarily theoretical. A practical no-signaling-proof protocol based on Hardy paradoxes and implemented with polarized photons demonstrated the experimental feasibility of the approach under the fair-sampling assumption. In that experiment, up to $n$6 bits of randomness were realized in $n$7 hours of data collection from an initial private source of randomness $n$8 away from uniform, using $n$9 photon pairs and Raz’s extractor (Ramanathan et al., 2018).

The first experimental demonstration of fully device-independent randomness amplification in a loophole-free setting was reported with superconducting circuits. The protocol uses two spatially separated and untrusted devices, public biased SV inputs, and an MDL Bell inequality robust to imperfect input randomness. It amplified $\{111,100,010,001\}$0 biased SV bits, with up to $\{111,100,010,001\}$1, into $\{111,100,010,001\}$2 almost-perfect private random bits with $\{111,100,010,001\}$3; the experiment ran over $\{111,100,010,001\}$4 rounds, used two superconducting transmon qubits separated by $\{111,100,010,001\}$5 meters, and reported a CHSH $\{111,100,010,001\}$6-value of $\{111,100,010,001\}$7 (Kulikov et al., 2024). This marks the first experimental realization of DIRA rather than only device-independent randomness generation or expansion.

Closely adjacent work on randomness expansion has also influenced amplification practice. A loophole-free photonic spot-checking experiment produced $\{111,100,010,001\}$8 certified output bits while consuming $\{111,100,010,001\}$9 input bits, with soundness error $A\oplus B\oplus C = X\cdot Y\cdot Z.$0, by using probability estimation factors and a block-wise protocol (Shalm et al., 2019). Although expansion assumes uniform seed randomness rather than weak-source amplification, its statistical tools, photonic engineering, and certification methodology are directly relevant to the broader device-independent randomness program.

Finally, a substantial neighboring literature studies semi-device-independent alternatives. Energy-bounded prepare-and-measure protocols can amplify any public SV source without entanglement and with security against quantum adversaries (Senno et al., 2021), and a recent integrated silicon-photonic implementation reported the first on-chip demonstration of SDI randomness amplification with a throughput rate of $A\oplus B\oplus C = X\cdot Y\cdot Z.$1 Mbps (Li et al., 10 Jun 2026). These schemes are not device-independent in the strict Bell sense, but they indicate a pragmatic trajectory: fully device-independent amplification remains the highest-security benchmark, while SDI constructions offer more accessible implementations when a small number of physical assumptions is acceptable.