### Generation of quantum-certified random numbers using on-chip path-entangled single photons from an LED

## 1. INTRODUCTION

Entanglement is one of the most striking features of quantum physics. The non-classical correlations that entanglement induces in quantum states have been debated since 1935, when Einstein, Podolski, and Rosen pointed out what would have been named the EPR paradox after them [1]. It was only several years later that a way out of the impasse was proposed by John Bell. Its famous inequality [2] provides indeed a quantitative solution to effectively demonstrate that correlations induced by entanglement cannot be explained classically using any realistic local-hidden variable. Today entanglement represents a resource in many quantum applications, especially in quantum computing and communications [3–8]. However, its exploitation is mainly limited to research laboratories only, still far from being used in real-life devices. This is mainly due to technological complexities related to its generation and management.

In photonics, entangled photons pairs are typically obtained exploiting non-linear optical processes such as spontaneous parametric downconversion [9] or four-wave mixing [10], using suitable laser sources. On the contrary, single-photon entanglement (SPE) [11] can be more easily generated using only linear optical components and cheap light sources, such as LEDs [12]. SPE corresponds to quantum correlations between two or more degrees of freedom (DoFs) of a single photon. Examples of the possible DoFs used are momentum and polarization [12–15]. From the mathematical point of view, SPE is totally analogous to the entanglement of two photons, or inter-photon entanglement. In both cases, the Hilbert space is determined by the tensor product of two independent Hilbert spaces: in the case of SPE, these are the spaces associated with the two independent DoFs chosen, while, in the case of the inter-photon entanglement, the two spaces are each one associated with one of the two photons. Here, it is important to stress that there is a whole literature on the non-locality of a single photon [16,17] and on single-photon entanglement where the qubit is the occupation state of an optical mode [18,19]. This is a form of inter-photon entanglement. Therefore, it is physically different from what we name here as SPE [13,14]. In SPE, the qubit is not the state of a mode of the electromagnetic field (i.e., no use of photon number or Fock states) but a degree of freedom (i.e., momentum, polarization, path, or others) of a single photon [11]. And indeed, it is from the physical point of view that the differences are more remarkable. Inter-photon entanglement exhibits a non-local phenomenology, while SPE concerns contextual, but local, observations. The meaning of the violation of the Bell inequality is also different in the two scenarios. In the case of inter-photon entanglement, it means that no realistic local hidden variable theory is able to explain the experiment’s results, while, in the case of SPE, it means that no realistic non-contextual hidden variable theory is capable of predicting the results [11]. The fact that SPE is a local phenomenon implies that it cannot be used as a substitute for inter-photon entanglement in many quantum applications. However, there can be specific cases in which, thanks to the easier generation and management aspects, it can be exploited for developing entanglement-based applications with potentially larger diffusion. One of them concerns random number generation.

Random numbers are fundamental resources in many different applications, such as gambling and gaming, lotteries, computer simulation, and cryptography. In cryptography, in particular, the unpredictability of the random sequence ensures the reliability of the encryption protocols. To generate random numbers, random number generators (RNGs) are usually exploited. Among all RNGs, quantum random number generators (QRNGs) [20,21] are the only ones that can generate truly random numbers. Indeed, pseudo-random number generators [22] and true-random number generators [23,24] exploit algorithms and noisy/chaotic processes, respectively, to generate random sequences. While the first ones are not truly random by definition, the second ones involve complex physical processes making randomness certification quite hard to obtain. On the contrary, for QRNGs such a certification is usually easier and can be done even considering malicious and error-prone implementation or an eavesdropper that is attacking the generator. Considering the level of security, QRNGs can be divided into three categories: device-dependent QRNGs (DD-QRNGs), device-independent QRNGs (DI-QRNGs) [8], and semi-device-independent QRNGs (SDI-QRNGs) [20]. DD-QRNGs are less secure, as their randomness certification scheme is based on the perfect characterization of their physical implementation. In perfect conditions, these QRNGs work quite well, but they are unable to cope with any change in their performances, which can possibly alter the produced randomness. DI-QRNGs are instead the most secure QRNGs, since their

In this work we propose a photonic integrated circuit (PIC) able to generate and manipulate single-photon path-entangled states by using typical integrated photonic devices such as multi-mode interferometers (MMIs), thermal phase shifters (PSs), Mach–Zehnder interferometers (MZIs), and crossings (CRs) [25]. The qubit encoding is done using four waveguides: depending on which waveguide the photon is injected, a certain state is codified [26,27]. The presence of entanglement is validated by performing a Bell test [28]. SPE and Bell inequality violation are used to lower-bound the conditional min-entropy of the generated sequence of measurement outcomes. The min-entropy represents the figure of merit to quantify true quantum randomness [29], and its correct estimation is fundamental for each RNG to obtain, from the raw sequence of generated bits, a sequence of uniform random digits using the randomness extraction procedure [30]. In particular, conditional min-entropy can quantify the level of unpredictability, i.e., the security, of the produced sequence of raw bits independently of classical noise sources and of any information potentially accessible to an eavesdropper. In this context, statistical tests such as NIST or Diehard are of secondary importance since they can only check particular statistical properties of the produced random sequence but cannot assess its level of security. The reported PIC implements an SDI-QRNG. The necessary assumptions on which it is based are the use of trusted and characterized detectors and the not-maliciousness of the experimental setup used, which can be, however, considered error-prone. With respect to a previous work from a few of us [15], the SDI-QRNG here proposed is a PIC exploiting an external commercial red LED as a light source and achieving a high value of min-entropy in the most general and secure scenario one can envision, thus making a significant step toward real-world applications.

The paper is organized as follows. In Section 2, we introduce SPE in the case of path entanglement and we detail the structure of the PIC. Then, in Section 3, all the non-idealities of the experiment are considered and their effect on the Bell inequality is taken into account. In Section 5, we present the experimental data that certify the generation of path-entangled states. In Section 6, we present the experimental data demonstrating our SDI-QRNG based on SPE states of path. Finally, in Section 7 we draw the conclusion, and in Section 4 we report the experimental methods.

## 2. SINGLE-PHOTON PATH-ENTANGLED STATES ON A PIC

Single-photon entangled states are those states in which at least two DoFs of a single photon are quantum correlated. Here we generate single-photon path-entangled states by considering four waveguides and two effective DoFs, namely the absolute ($|U\u27e9,|D\u27e9$) and the relative ($|F\u27e9,|N\u27e9$) positions of each waveguide with respect to the symmetry axis of the system (dashed white line in Fig. 1). According to the scheme of Fig. 1, such a Hilbert space can be seen as $\mathcal{H}={\mathbb{C}}^{2}\otimes {\mathbb{C}}^{2}$.

#### Fig. 1. Qubit encoding. Two qubits describe the system and are encoded according to the absolute and relative positions of the waveguide in which the photon is injected with respect to the dashed white line. The values of the two qubits are fixed using the following bases: absolute position (up $|U\u27e9$ and down $|D\u27e9$ ) and relative position (far $|F\u27e9$ and near $|N\u27e9$ ).

The four states of the Bell basis in such qubit encoding are

In this work, we focus on the state $|{\varphi}^{+}\u27e9$. To generate such state, we have designed and fabricated a PIC (a scheme is reported in Fig. 2) based on silicon oxynitride (${\mathrm{SiO}}_{x}{\mathrm{N}}_{y}$) material, a low-index contrast photonic platform [31]. The structure of the PIC is simple and composed only of linear integrated optical elements: MMIs, PSs, MZIs, and CRs [32,33]. The first part of the PIC (yellow box in Fig. 2) is responsible for generating the SPE state $|{\varphi}^{+}\u27e9$ by exploiting a 50:50 MMI and two PSs setting the relative phase $\xi $ of the entangled state, that, apart from a global non-influent phase, can be written as

#### Fig. 2. Schematic representation of the PIC used for random number generation based on SPE. In cyan, the optical waveguides; in blue, the oxide cladding. A red LED is used as a light source. Light coupling in and out of the PIC is performed using tapered optical fibers (transparent cones in the drawing). The PIC can be divided into three parts: generation, relative-position rotation, and absolute-position rotation. The generation stage is enclosed by the yellow rectangle on the left side. Here, the entangled state is created. The relative-position rotation corresponds to the first green rectangle from the left: here two MZIs rotate the qubit of relative position by an angle $\varphi $ . The absolute-position rotation stage is found in the large green rectangle on the right side: here two MZIs rotate the qubit of absolute position by an angle $\theta $ . At the output, the rotated state is projected onto one of the four states composing the basis of the four-dimensional Hilbert space: $|UF\u27e9,|UN\u27e9,|DF\u27e9$ , and $|DN\u27e9$ . List of abbreviations: MMI, multi-mode interferometer; PS, phase shifter; MZI, Mach–Zehnder interferometer; CR, crossing; SPADs, single-photon avalanche diodes.

To demonstrate the presence of entanglement, a Bell test [34] in the Clauser, Horne, Shimony, and Holt (CHSH) form [35] is operated. Its aim is to quantify the presence of correlations between suitable measurements performed on the two qubits considered. To run a Bell test, it is necessary to define four measurement operations to be performed on the entangled state and connected to two observables, ${\{A(x)\}}_{x=\mathrm{0,1}}$ and ${\{B(y)\}}_{y=\mathrm{0,1}}$, each one dependent on a binary variable, $x$ and $y$, respectively. Such measurements must have binary outputs, $a$ and $b$, which can then assume values $\{\pm 1\}$. In particular, $A(x)$ is an observable that has to be measured only on one qubit, while $B(y)$ only on the other. By defining the correlation coefficient $\mathbb{E}(x,y)$ as

If $|\chi |>2$, then we are dealing with an entangled state. More precisely, entanglement is a necessary but non-sufficient condition for a state to satisfy such an inequality, while separable states always result in $|\chi |<2$ [35]. In the PIC, the Bell test is performed by using the other two stages. The two measurement operations ${\{A(x)\}}_{x=\mathrm{0,1}}$ and ${\{B(y)\}}_{y=\mathrm{0,1}}$ are implemented by a combination of four MZIs with the help of two CRs and four single-photon avalanche diodes (SPADs) that are off-chip. In particular, two MZIs work in parallel to rotate the relative-position qubit by an angle $\varphi $ (green box at the center of Fig. 2), while two cascaded MZIs, separated by a pair of CRs, rotate the absolute-position qubit by an angle $\theta $ (green box on the right side of Fig. 2), where $\varphi $ and $\theta $ correspond to $y$ and $x$ in Eq. (4), respectively. A fair implementation of such rotations requires that the same rotation angle is set for both the MZIs relative to the same qubit. Then, the rotated SPE state is projected over the four states $|UF\u27e9,|UN\u27e9,|DF\u27e9$, and $|DN\u27e9$ composing the Hilbert space, by means of four waveguides coupled to four off-chip SPADs. According to this, the observable can be constructed in the following way:

The theoretical form of the correlation coefficient $\mathbb{E}$ and correlation function $\chi $ can be calculated introducing the matrix representation of the MZIs. In particular, an MZI is composed of two 50:50 beam splitters, implemented on-chip using MMI devices, separated by two optical waveguides, each one having a PS. In the ideal case, the 50:50 MMI and the PS matrix representations are

Consequently, according to standard transfer matrix formalism, the matrix representation of the MZI is

Essentially, each MZI implements a rotation of an angle $\zeta ={\zeta}_{1}-{\zeta}_{2}$, with a global phase shift of $Z+\pi /2$, with $Z={\zeta}_{1}+{\zeta}_{2}$. Considering the four MZIs represented in Fig. 2, ${\zeta}_{1}={\varphi}_{1},{\zeta}_{2}={\varphi}_{2}$ for the two MZIs that rotate the relative-position qubit (first green box from the left in Fig. 2), while ${\zeta}_{1}={\theta}_{1},{\zeta}_{2}={\theta}_{2}$ for the two MZIs that rotate the absolute-position qubit (second green box from the left in Fig. 2). By implementing two rotations of angles $\varphi $ and $\theta $, respectively, for the relative- and absolute-position qubits, the theoretical form of the correlation coefficient $\mathbb{E}(\varphi ,\theta )$ becomes

By introducing the parameter $\alpha $, such that $2(\varphi -\theta )=2({\varphi}^{\prime}-{\theta}^{\prime})=-2({\varphi}^{\prime}-\theta )=\alpha $, the correlation function can be rewritten as

As shown in Fig. 2, to generate SPE states we use an LED. As explained in detail in Ref. [12], the statistics of the photon source does not affect the estimate of the correlation function $\chi $ and the corresponding verification of Bell inequality violation since

## 3. NON-IDEALITIES IN THE EXPERIMENTAL ESTIMATION OF $\chi (\varphi ,{\varphi}^{\prime},\theta ,{\theta}^{\prime})$

Our experimental implementation is affected by a few non-idealities, that in principle could result in a wrong estimation of $\chi (\varphi ,{\varphi}^{\prime},\theta ,{\theta}^{\prime})$. A first aspect to be considered is the broadband spectrum of emission of the LED. Indeed, the PIC has been designed for $\lambda =730\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{nm}$, so that its performances are optimized at that wavelength. However, the used LED source has a broadband spectrum ($\lambda =730\pm 10\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{nm}$), so that the wavelength-dependent behavior of the integrated optical elements has to be taken into account. For example, the matrix representation of the MMIs becomes

A second aspect concerns losses. Waveguide propagation losses have to be considered. Moreover, MMIs can have insertion losses, meaning that ${t}^{2}(\lambda )+{r}^{2}(\lambda )\le 1$. Finally, a third non-negligible aspect is represented by current instabilities of the electronics controlling the PSs of the PIC. Indeed, a key feature that must be ensured when a Bell test is performed is that each qubit must be rotated independently by the other [28]. More formally, the observables that are considered in a Bell test must be written in product form $A(\theta )\otimes B(\varphi )$. This is ensured by imposing the same rotation angle on the two MZIs rotating each qubit. To justify the above requirement, let us consider the situation in which all the MZIs are set with different rotation phases (see Fig. 3):

#### Fig. 3. Schematic representation of the different phases (green) associated with each MZI with the relative phase errors (white). Each green rectangle highlights the rotation operation performed by the considered MZI according to its phases.

The ${P}_{1}$ and ${P}_{2}$ matrices consider that each MZI rotates a particular part of the SPE state that is generated: considering the upper MZI in the first green box of Fig. 2, it rotates the far and near components of the up part of the state. Consequently, in order to have the equalities

## 3.5 A. Broadband Light Source

Here, we consider the wavelength dependence of the transmission and reflection coefficients of the MMIs ($t$, $r$), as well as of the rotation angles ${\zeta}_{1(2)}$ set via the MZIs. Without any loss of generality, we can represent the state $\rho $ of the incoming photons as a convex superposition of the following form:

The corresponding quantum probabilities are a convex superposition of the following form:

This is equivalent to saying that each monochromatic component ${\rho}_{\omega}$ of the generic state Eq. (22) is subject to the measurement of a different pair of observables, $A{(\varphi )}_{\omega}\otimes B{(\theta )}_{\omega}$, associated with specific projection-valued measures (PVMs) ${\{{P}_{a}^{\theta ,\omega}\otimes {P}_{b}^{\varphi ,\omega}\}}_{a,b}$:

Analogously, the Bell parameter $\chi $ is given by the convex superposition

This means that using a broadband light source results in a correlation function which is a spectrally weighted average. It is important to point out that this fact does not affect the entropy certification protocol (see Section 6 and Appendix C).

Moreover, we want to stress that here the fact that our light source is non-monochromatic does not require the use of a narrowband optical filter for the actual integrated setup as it is the case for the bulk one reported in Ref. [12]. Indeed, thanks to the fact that the phase delay of MZIs is varied by slightly changing the refractive index of the waveguides all the rotation operations naturally occur within the coherence time.

## 3.6 B. Losses

We can consider two types of losses affecting the PIC:

Thanks to the homogeneity of the discrete components and to the symmetry of the PIC, in particular to the nominally equal lengths of the paths corresponding to the four different outputs (detection channels), the overall impact of losses can be modeled by a diagonal operator of the form $L=\gamma I\otimes I$, with $\gamma \in (\mathrm{0,1}]$, hence commuting with any operator acting on the 2-qubits Hilbert space. Therefore, the probability of photon detection per channel is given by

## 3.7 C. Current Instabilities

In all cases in which electrical currents applied to PSs do not precisely correspond to the desired nominal values, an error $(\delta \zeta )$ is introduced for each PS. As a general consequence, the matrices representing the rotation operators implemented by the MZIs are no longer in product form, but they have to be written as follows:

Note that, with respect to Fig. 3, we have already introduced the conditions ${\varphi}_{3}={\varphi}_{1}$, ${\varphi}_{4}={\varphi}_{2}$ and ${\theta}_{3}={\theta}_{1}$, ${\theta}_{4}={\theta}_{2}$. The terms $\delta {\varphi}_{1},\delta {\varphi}_{2},\delta {\varphi}_{3},\delta {\varphi}_{4},\delta {\theta}_{1},\delta {\theta}_{2},\delta {\theta}_{3},\delta {\theta}_{4}$ are all different and appear both in the rotation angles $\varphi ={\varphi}_{1}-{\varphi}_{2}$ and $\theta ={\theta}_{1}-{\theta}_{2}$, as well as in the global phase terms imposed by the MZIs $\mathrm{\Phi}={\varphi}_{1}+{\varphi}_{2}$ and $\mathrm{\Theta}={\theta}_{1}+{\theta}_{2}$. ${P}_{1}$ and ${P}_{2}$ are defined in Eq. (19). In this situation the matrix ${U}_{\mathrm{PS}}$ is influenced by the experimental error as

In general, due to these current instabilities, the effective angle of rotation is different for each PS of each MZI. For clarity, we focus our discussion on the rotation angle $\varphi $, for which $\delta {\zeta}_{1}=\delta {\varphi}_{1},\delta {\zeta}_{2}=\delta {\varphi}_{2},\delta {\zeta}_{3}=\delta {\varphi}_{3},\delta {\zeta}_{4}=\delta {\varphi}_{4}$. Then, the same arguments can be applied to current-related non-idealities affecting the other rotation angle $\theta $. We start by representing the real operator describing the rotation of the related qubit in the following form:

This problem is addressed by using the same techniques reported in [15,36]: we look for an ideal operator that can be written as $I\otimes {U}^{\text{ideal}}$ whose distance from ${U}^{\mathrm{real}}$ is the smallest possible, i.e., an operator minimizing the distance from ${U}^{\mathrm{real}}({\varphi}_{1},{\varphi}_{2},\delta {\varphi}_{1},\delta {\varphi}_{2},\delta {\varphi}_{3},\delta {\varphi}_{4})$ according to the Hilbert–Schmidt norm. Without loss of generality, we can represent ${U}^{\text{ideal}}$ as the product ${U}^{\text{ideal}}={U}_{\mathrm{MMI}}{W}^{\text{ideal}}{U}_{\mathrm{MMI}}$, for a suitable unitary operator ${W}^{\text{ideal}}$. In the general case, the real operator describing the rotation of one qubit by an angle $\varphi $ can be represented as

Similarly, we can rewrite the factorized unitary operator ${U}^{\text{ideal}}$, which minimizes the Hilbert–Schmidt distance from ${U}^{\mathrm{real}}$, as

Consequently, it is necessary to evaluate

## 3.8 D. Other Sources of Non-Idealities

Other non-idealities in our experimental setup come from the detectors (dead-time, after-pulsing, and dark counts), especially because no randomization of the input sequence of measurement operations necessary to estimate the probabilities ${\{\mathbb{P}(a,b|\varphi ,\theta )\}}_{\varphi ,\theta ,a,b}$ is performed. In this particular implementation we neglect such non-idealities because in Ref. [15] it has been observed that, for a photon flux of $\simeq 200\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{kHz}$, the corrections to the probabilities are negligible. As a lower flux of photons $\simeq 120\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{kHz}$ is here used (mainly because of LED-to-fiber low coupling efficiency), we can safely neglect such a correction factor.

## 4. METHODS

The PIC has been fabricated in the cleanroom of Fondazione Bruno Kessler. The waveguide core (300 nm thick and 700 nm wide) is made of silicon oxynitride (${\mathrm{SiO}}_{x}{\mathrm{N}}_{y}$) and the bottom and top claddings are made, respectively, of thermally grown silicon oxide (${\mathrm{SiO}}_{2}$) and borophosphosilicate glass. The design wavelength of the integrated components is 730 nm and the mode polarization is transverse electric (TE). The linear characterization of the building-blocks of the PIC, namely MMIs and CRs, has been carried out using a spectrally filtered supercontinuum laser emitting from 300 to 2000 nm, and details about their performances can be found in Appendix A. The measured insertion loss of a 1 cm long straight waveguide is 27 dB for TE polarization.

Our experiment is performed using an attenuated commercial LED at $730\pm 10\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{nm}$. The light coming from the LED is collimated using an objective and polarized using a Glan–Thompson polarizer. A fiber port is used to couple light inside an optical fiber, where light is attenuated by means of a variable optical attenuator and polarization is controlled and set to be TE at the output. The input–output coupling is performed using a standard fiber array. A power supply is used to control the different phase shifters present on the PIC.

Prior to our measurements, a mandatory calibration of integrated MZIs has been performed using a Ti:sapphire laser tuned at 730 nm. In particular, the phase-power relation $\varphi =\varphi (W)$ of the different MZIs is retrieved by fitting operations of the transmitted optical power using the following equations:

The phase $\xi ={\xi}_{1}-{\xi}_{2}$ of the generation stage is obtained by another fitting operation, applying the correct calibration to each MZI. Here an issue is due to the absence of additional compensation phase shifters after the MZIs rotating the relative-position qubit. In this situation, the value of $\xi $ to fix the phase difference between the $|N\u27e9$ components of the state basis is different with respect to the one for the $|F\u27e9$ components. For this reason, the following strategy is introduced. First, we set the value of $\xi $ necessary to have the expected phase relation between the $|F\u27e9$ components, and only counts from channels $|UF\u27e9$ and $|DF\u27e9$ are acquired. Second, the experiment is repeated acquiring only counts from channels $|UN\u27e9$ and $|DN\u27e9$, by changing $\xi $ to the value that adjusts the phase relation of the $|N\u27e9$ components too.

Finally, the measurements to demonstrate our certified QRNG integrated device are performed using four SPADs (Excelitas), whose efficiencies have been equalized using fiber-coupled variable optical attenuators, and whose electrical outputs are sent to a time-tagging electronics (Swabian Instruments) connected to a PC in order to count single-photon detection events for each channel over time. The following procedure has been followed. First, an angle of rotation $\theta $ of the absolute-position qubit is fixed and a sweep over $\varphi $ angles of relative position is performed. For each pair $(\theta ,\varphi )$ of angles, a 1 s time window is acquired with a time bin set at 1 μs for the time tagger. Then, the angle $\theta $ is changed and a sweep of the other angle $\varphi $ is again performed. Time bins with no detection events are discarded, while whenever multiple photon detection events are registered at different SPADs within the same time bin, one single event is randomly assigned to one of the four two-qubit states by means of a pseudo-random number generator.

## 5. EXPERIMENTAL DEMONSTRATION OF THE PRESENCE OF ENTANGLEMENT

The experimental demonstration of the presence of entanglement is performed by fixing the angle $\theta \in [-\mathrm{2,0}]\text{\hspace{0.17em}}\mathrm{rad}$ and performing a sweep of the rotation angle $\varphi \in [-\mathrm{2,2}]\text{\hspace{0.17em}}\mathrm{rad}$. An acquisition 1 s long with a time bin of 1 μs is performed for each $(\varphi ,\theta )$. The average photons flux is $\simeq 120\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{kHZ}$. In this way, we estimate the conditional probabilities $\mathbb{P}(|\mu \nu \u27e9|\varphi ,\theta )$ as the empirical frequencies of the counts:

#### Fig. 4. Experimental correlation coefficients $\mathbb{E}(\varphi ,\theta )$ ) (blue dots) with the related fit (colored surface), according to Eq. (45 ). $\varphi $ is the rotation angle of the relative-position qubit, while $\theta $ is the rotation angle of the absolute-position qubit. Color bar refers to the value of $\mathbb{E}$ .

Using these correlation coefficients, it is possible to construct the correlation function $\chi (\varphi ,{\varphi}^{\prime},\theta ,{\theta}^{\prime})$. By making the choice $\varphi =-\alpha ,{\varphi}^{\prime}=\alpha ,\theta =0,{\theta}^{\prime}=2\alpha $, the correlation function can be plotted as a function of the parameter $\alpha $. The resulting $\chi (\alpha )$ function is reported in Fig. 5 as a blue curve [obtained starting from Eq. (45) with the fitted value of $\eta $], while measured data are plotted as red dots. A good agreement can be observed. It can also be noticed that the theoretical form of the correlation function does not reach the maximum attainable value of $2\sqrt{2}$: this is caused by the non-ideal transmission and reflection coefficients of the MMIs. However, a clear violation of the CHSH inequality can be observed, reaching a maximum value ${\chi}^{+}=2.297\pm 0.004$ and a minimum ${\chi}^{-}=-2.181\pm 0.004$, meaning that single-photon entangled states have been generated. Moreover, it is important to underline that the choice $\varphi =-\alpha ,{\varphi}^{\prime}=\alpha ,\theta =0,{\theta}^{\prime}=2\alpha $ gives the maximum achievable Bell inequality violation only if the considered entangled state is exactly $|{\varphi}^{+}\u27e9$. However, due to the fact that the MMI-based beam splitters do not have a 50:50 branching ratio, in our experimental implementation the generated state is actually different. For this reason, it is a better strategy to consider every possible combination of $(\varphi ,{\varphi}^{\prime},\theta ,{\theta}^{\prime})$ between the measured $\mathbb{E}(\varphi ,\theta )$ to look for a better violation of the inequality. Using this approach, we obtain respectively ${\chi}^{+}=2.697\pm 0.004$ for $({\varphi}_{0}=-0.576\pm \mathrm{0.002,}{\varphi}_{1}=-1.445\pm \mathrm{0.002,}{\theta}_{0}=-1.11\pm \mathrm{0.02,}{\theta}_{1}=-1.87\pm 0.02)$ and ${\chi}^{-}=-2.668\pm 0.004$ for $({\varphi}_{0}=-1.589\pm \mathrm{0.002,}{\varphi}_{1}=0.863\pm \mathrm{0.002,}{\theta}_{0}=-0.35\pm \mathrm{0.02,}{\theta}_{1}=-1.27\pm 0.02)$. Error bars on $\chi $ data points are obtained by dividing each 1 s time sequence in intervals of 0.2 s. For each interval, the correlation function is evaluated, and the final uncertainty is obtained as the standard error related to the number of intervals. Lastly, it is necessary to correct the values ${\chi}^{\pm}$ with the terms ${e}_{{\chi}^{\pm}}$ [Eq. (41)]. Using the values of current instabilities-related errors reported in Table 1, we obtain ${e}_{{\chi}^{+}}=0.092$ for ${\chi}^{+}$ and ${e}_{{\chi}^{-}}=0.077$ for ${\chi}^{-}$. As a result, the corrected values of the correlation functions are ${\chi}^{+}=2.605\pm 0.004$ and ${\chi}^{-}=-2.591\pm 0.004$.

Experimental demonstration of the violation of the Bell inequality. Data points (red dots) with their error bars (smaller than the size of the data points) and the theoretical curve (blue line) of the

Errors on the Rotation Angles ^{a}

0.000 | 0.011 | −0.004 | −0.006 | 0.068 | 0.216 | 0.036 | 0.215 | |

0.002 | 0.004 | 0.007 | −0.006 | 0.068 | 0.187 | 0.036 | 0.180 |

The standard error for each value is

## 6. FROM ENTANGLEMENT TO QUANTUM-CERTIFIED RANDOM NUMBERS

Recently, a few of us demonstrated that it is possible to obtain a semi-device-independent randomness certification scheme starting from SPE states of momentum and polarization using a bulky experimental implementation [15,36]. Therefore, here we use the PIC reported in Fig. 2 as an SDI-QRNG, certified by the evaluation of the correlation function $\chi $.

Using SPE states, the methods of generating quantum-certified random numbers can be schematized in the following way [Fig. 6(a)]: first, a set of angles ${\{({\varphi}_{i},{\theta}_{j})\}}_{i,j=\mathrm{0,1}}$ is selected to evaluate the Bell correlation function $\chi ({\varphi}_{0},{\varphi}_{1},{\theta}_{0},{\theta}_{1})$. Then, the actual protocol starts. A single-photon path-entangled state is generated. The two qubits that compose the state are rotated by the operation $U({\varphi}_{i},{\theta}_{j})$. The rotated state is projected over the four states $|UF\u27e9,|UN\u27e9,|DF\u27e9$, and $|DN\u27e9.$ Depending on the outcome of the measurement operation, or equivalently, on the collapsed state, a random digit is obtained according to the following encoding: $|UF\u27e9\to 00,|UN\u27e9\to 01,|DF\u27e9\to 10,|DN\u27e9\to 11$. Then, the raw random sequence is generated by repeating this procedure many times for each pair of angles. An example of the raw sequence obtained is reported in Fig. 6(b). Note that the pair of angles $({\varphi}_{i},{\theta}_{j})$ can be kept fixed during a long acquisition of detection events. Then the angles could be changed, and a new acquisition would start. This methodology does not require any input randomness and enables the application of an entropy certification protocol similar to the one reported in Refs. [15,36].

#### Fig. 6. (a) Method to generate a random number: (1) an SPE state is generated (yellow box); (2) the relative- and absolute-position qubits of the SPE state are rotated respectively by the angles ${\varphi}_{i}$ (first green box) and ${\theta}_{j}$ (second green box) by the different MZIs; (3) the rotated SPE state is measured by state projection on one of the four basis states ($|UF\u27e9,|UN\u27e9,|DF\u27e9,|DN\u27e9$ ) and the clicking SPAD determines the raw number. These steps are repeated many times to generate a raw sequence of random numbers. (b) Example of the random number sequence obtained using the encoding $|UF\u27e9\to 00,|UN\u27e9\to 01,|DF\u27e9\to 10,|DN\u27e9\to 11$ given a certain pair (${\varphi}_{i}$ , ${\theta}_{j}$ ). The outcome of multiple detection events is randomized (slots with $*$ in the figure), while time bins with no detection are discarded.

First of all, we recall the hypotheses over which our certification scheme is based:

Hypothesis 1 means that the used SPADs are trustworthy and not controlled by an adversary. Moreover, their non-idealities, such as the limited efficiency, the probability of after-pulsing, and the dead time, are known. Such a hypothesis is necessary to fairly reconstruct the probabilities $\mathbb{P}(a,b|{\varphi}_{i},{\theta}_{j})$. Indeed, as soon as the pair of angles $({\varphi}_{i},{\theta}_{j})$ is not randomized for every round of the experiment, an adversary could induce detector clicks in a deterministic way to mimic the violation of a Bell inequality. Hypotheses 2 and 3, instead, are necessary to set the same angles $\varphi $ and $\theta $ on the different MZIs pairs. In particular, hypothesis 2 is required to take into account the fact that the starting phase of each MZI is not exactly 0, while hypothesis 3 is necessary to set the correct currents at the phase shifters. These hypotheses mean that for each MZI in the PIC, the relation between the rotation angle $\xi $ and the applied power $W$, $\xi (W)=bW+d$ is known. Moreover, the power supply used is trustworthy and not maliciously controlled by an adversary. However, it can be error-prone, so it can set a power ${W}^{\prime}$, slightly different from the selected one, $W$. Hypothesis 4 is necessary to rule out any possible measurement basis-dependent change of the input state [15]. In practice, this means that when the pair of angles $({\varphi}_{i},{\theta}_{j})$ is fixed and the measurement is performed, the entangled state and the rotations do not change with time, i.e., the phases set by the different PSs do not change. Such a requirement is ensured by selecting a total measurement time short enough that no instabilities are observed and by letting the PIC thermalize between different measurements to eliminate any thermal cross talk. Our certification protocol is independent of the particular form of the input state $\rho $. In particular, for the four sequences of detection events corresponding to the angles ${\{({\varphi}_{i},{\theta}_{j})\}}_{i,j=\mathrm{0,1}}$, the related conditional guessing probability can be bounded by using [15,36]

To experimentally demonstrate the generation of certified random numbers we select the time trace of the detection events giving the maximum and minimum violations of the Bell inequality, as reported in Section 5. These are ${\chi}^{+}=2.697\pm 0.004$ for $({\varphi}_{0}=-0.576\pm \mathrm{0.002,}{\varphi}_{1}=-1.445\pm \mathrm{0.002,}{\theta}_{0}=-1.11\pm \mathrm{0.02,}{\theta}_{1}=-1.87\pm 0.02)$ and ${\chi}^{-}=-2.668\pm 0.004$ for $({\varphi}_{0}=-1.589\pm \mathrm{0.002,}{\varphi}_{1}=0.863\pm \mathrm{0.002,}{\theta}_{0}=-0.35\pm \mathrm{0.02,}{\theta}_{1}=-1.27\pm 0.02)$. The time traces of the estimated probabilities used for computing the correlation functions ${\chi}^{+}$ and ${\chi}^{-}$ are reported in Figs. 7(a) and 8(a). These are obtained as 50 ms long averages. As can be observed, the probabilities are quite stable during the entire acquisition time. The values of $\chi $ corresponding to these time intervals are then reported in Fig. 7(b) for ${\chi}^{+}$ and Fig. 8(b) for ${\chi}^{-}$, together with their mean value and related 99% confidence interval (blue shaded region).

#### Fig. 7. (a) Probabilities of each measurement outcome as a function of time (blue $|DF\u27e9$ , red $|DN\u27e9$ , yellow $|UN\u27e9$ , and purple $|UF\u27e9$ ) for the four pairs of angles $({\varphi}_{0},{\theta}_{0})$ , $({\varphi}_{1},{\theta}_{0})$ , $({\varphi}_{0},{\theta}_{1})$ , $({\varphi}_{1},{\theta}_{1})$ of ${\chi}^{+}$ . The estimates have been done considering time intervals of 50 ms. (b) Dots: corresponding values of ${\chi}^{+}$ as a function of time. Solid line: mean value of ${\chi}^{+}$ . Dashed region: 99% confidence interval.

#### Fig. 8. (a) Probabilities of each measurement outcome as a function of time (blue $|DF\u27e9$ , red $|DN\u27e9$ , yellow $|UN\u27e9$ , and purple $|UF\u27e9$ ) for the four pairs of angles $({\varphi}_{0},{\theta}_{0})$ , $({\varphi}_{1},{\theta}_{0})$ , $({\varphi}_{0},{\theta}_{1})$ , $({\varphi}_{1},{\theta}_{1})$ of ${\chi}^{-}$ . The estimates have been done considering time intervals of 50 ms. (b) Dots: corresponding values of ${\chi}^{-}$ as a function of time. Solid line: mean value of ${\chi}^{-}$ . Dashed region: 99% confidence interval.

Considering these values of violation of Bell inequality and the corresponding values of ${e}_{\chi},{e}_{P}$ [${e}_{{\chi}^{+}}=\mathrm{0.092,}{e}_{P}({\chi}^{+})=0.02$ and ${e}_{{\chi}^{-}}=\mathrm{0.077,}{e}_{P}({\chi}^{-})=0.014$], we obtain the following guessing probabilities:

Note that the upper bound to ${\mathbb{P}}_{\text{guess}}(a,b|{\varphi}_{x},{\theta}_{y})$ given by Eq. (46) represents the best estimate for the marginal guessing probability, e.g., ${\mathbb{P}}_{\text{guess}}(b|{\theta}_{y})=\mathrm{max}{\sum}_{a}{\mathbb{P}}_{\text{guess}}(a,b|{\varphi}_{x},{\theta}_{y})$, where the marginal refers to a single qubit. Therefore, from an operative point of view, in order to refer ${H}_{\mathrm{min}}$ to a single qubit, we write as bit 0 each photon detected as $|F\u27e9$ state independently of its absolute position, and as bit 1 each photon detected as $|N\u27e9$ state independently of its absolute position (i.e., $\mathrm{00,10}\to 0$; $\mathrm{01,11}\to 1$). By applying the formula [29]

Having used an average rate of 120 kHz for each acquisition, the final rate of our quantum-certified SDI-QRNG is given by $(120\times {H}_{\mathrm{min}})$ kHz which, in the best case (namely ${\chi}^{+}$), gives a generation rate of $\simeq 40\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{kHz}$. This rate does not consider the randomness extraction procedure [30]. We remind the reader that, in this work, we focus on the estimation of ${H}_{\mathrm{min}}$ and the extraction procedure is not performed. However, by applying a quantum-safe randomness extractor, e.g., Toeplitz-hashing extractor [37] or Trevisan’s extractor [38,39], it is mathematically proven that it is possible to obtain a final sequence of independent and uniformly distributed bits up to a given level of accuracy.

## 7. CONCLUSION

Single-photon path entanglement has been demonstrated in a PIC by measuring the Bell inequality violation in the CHSH formulation. Photons are generated in an off-chip LED, are manipulated in a PIC fabricated in a silicon foundry, and are detected by using off-chip silicon SPADs. The PIC is based on simple and well-known optical components, i.e., MMIs, PSs based on the thermo-optic effect, MZIs, and CRs. Experimental data are well fitted by a theoretical model which considers the non-idealities of our setup, mainly related to unbalanced beam splitters (MMIs). A large violation of the CHSH inequality is reported ($2.605\pm 0.004$) by recursively trying each possible combination of the acquired correlation coefficients.

These SPE states are used to demonstrate a certified QRNG working accordingly to a semi-device-independent certification protocol similar to the one in Refs. [15,36]. Since in Refs. [15,36] discrete optical components and different degrees of freedom were used, a few assumptions are here different. Specifically, our present approach is based on the knowledge of the single-photon detectors as well as of the integrated MZIs. In addition, the power supply controlling the heaters in the MZIs must be trusted, even if error-prone, as well as the set phase delays must be stable during the acquisition time. No hypothesis is needed on the input state. Under these assumptions, we are able to certify a maximum value of the quantum min-entropy ${H}_{\mathrm{min}}=(33.0\pm 0.4)\%$, which is 1 order of magnitude larger than that obtained with a bulk setup [15]. This large improvement is due to the smaller correction terms ${e}_{\chi}$ and ${e}_{P}$ of the integrated QRNG because of the smaller non-idealities in the integrated photonic components with respect to the discrete optical components. To compare the proposed SDI-QRNG to the existing literature, three parameters will be discussed: security, speed, and integration. Concerning security, the proposed QRNG can be compared to source-independent QRNGs, in which the source is left uncharacterized while the measurement operations are fully characterized. Our system is more secure because the performed measurements are only partially characterized. The only requirements are that the measured observables must be in product form, i.e., the measurement performed on one qubit does not influence the other, and they do not change during the experiment. Apart from these assumptions, the particular form of the chosen operator is unimportant. Concerning speed, the achieved generation rate is low compared to the ones reported in the literature. However, this work has focused on demonstrating the generation of certified quantum random numbers using an integrated PIC without optimizing the generation rate. The measured QRNG generation rate ($\simeq 40\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{kHz}$) is strongly limited by the actual coupling efficiency of the LED to the optical fiber and to the PIC, decreasing the photon flux in the PIC. In future experiments, a better coupling scheme based on, e.g., optimized grating couplers or direct LED bonding could significantly improve the coupling efficiency. Then, the saturation rate of the SPAD detectors will give the other limit. Considering working at the linearity limit of SPADs, i.e., 1 MHz rate, the achievable certified random bit rate is of the order of 330 kHz. To further increase such a value, it is necessary to use engineered detectors, e.g., multiplexing more SPADs in a single detector. The use of silicon photomultipliers (SiPMs), which are arrays of SPADs, could be a viable solution. For example, having four SiPMs composed by 16 SPADs with a linearity limit of 1 MHz, as the one reported in Ref. [40], it is possible to reach a generation rate of $\simeq 5\text{\hspace{0.17em}\hspace{0.17em}}\mathrm{MHz}$. By using SiPMs with bigger arrays of SPADs, it is possible to increase the rate further. Another solution relies on the multiplexing of *N* circuits in the same PIC, using the same light source and dividing it by using an initial $1\times N$ MMI. Such a solution will require less attenuation of the LED. Moreover, all the circuits act as independent SDI-QRNGs, improving the rate by a factor of $N$. Last but not least, integration. The proposed QRNG is particularly interesting concerning potential applications. Many works in the literature are based on laser sources which can be fully integrated as well. However, our QRNG uses an LED, which is potentially cheaper to integrate than a laser. This, together with the possibility of co-integration of the SPADs [41,42], enables its use for applications that necessitate low production costs, such as Internet of Things devices.

To conclude, a PIC able to generate quantum certified random numbers using single-photon path-entangled states represents a further step to move semi-device-independent QRNGs from the lab to real-world applications.

## 8 Acknowledgment

**Acknowledgment**. This project has been supported by PAT via Q@TN, the joint lab between University of Trento, FBK-Fondazione Bruno Kessler, INFN-National Institute for Nuclear Physics and CNR-National Research Council.

[2] J. Bell. On the Einstein-Rosen-Podolsky paradox**. Physica, 1964, 1: 195-200**.

[6] A. K. Ekert. Quantum cryptography based on Bell’s theorem**. Phys. Rev. Lett., 1991, 67: 661-663**.

[17] S. Van Enk. Single-particle entanglement**. Phys. Rev. A, 2005, 72: 064306**.

[23]

[25]

[28]

[34]

[38] L. Trevisan. Extractors and pseudorandom generators**. J. ACM, 2001, 48: 860-879**.

##### Article Outline

Nicolò Leone, Stefano Azzini, Sonia Mazzucchi, Valter Moretti, Matteo Sanna, Massimo Borghi, Gioele Piccoli, Martino Bernard, Mher Ghulinyan, Lorenzo Pavesi. Generation of quantum-certified random numbers using on-chip path-entangled single photons from an LED[J]. Photonics Research, 2023, 11(9): 1484.