Real-Time Source-Independent Quantum Random Number Generator Based on a Cloud Superconducting Quantum Computer

Quantum random number generator (QRNG) relies on the intrinsic randomness of quantum mechanics to produce true random numbers which are important in information processing tasks. Due to the presence of the superposition state, quantum computer can be used as a true random number generator. However, in practice, the implementation of quantum computer is subject to various noise sources which affect the randomness of the generated random numbers. To solve this problem, we propose a source-independent QRNG (SI-QRNG) scheme based on quantum computer which is motivated by the SI-QRNG scheme in quantum optics. The scheme can provide certiﬁed randomness by estimating the preparation error of superposition states in real time even when the source is untrusted, under the assumption that the measurement operation is trusted. Our analysis takes into account the readout error of quantum state and further gives the ﬁnal extracted number of random bits. And the estimation method of preparation error of superposition state in randomness source. We also provide a parameter optimization method to increase the generation rate of random bits. In addition, by utilizing the cloud superconducting quantum computer of IBM, we experimentally demonstrate the practicality of our SI-QRNG scheme and achieve the generation of true random numbers.


Introduction
Random number generators play an important role in many fields, such as cryptography 1 and scientific simulations 2 . Different applications require different levels of randomness. For the applications which require the random numbers to be statistically unbiased, pseudo random number generators (PRNGs) or classical random number generators relying on deterministic algorithms or physical processes have been widely used 3,4 . Although their output sequences may appear random and usually have a perfect balance between 0 and 1, the predictability and strong long-range correlation may result in security loopholes when employed in some applications, particularly in cryptography and quantum key distribution 5 .
To solve this problem, based on the intrinsic uncertainty of quantum mechanics, quantum random number generators (QRNGs) can produce unpredictable random numbers and have attracted great attention in the past few years. Nowadays, many QRNG protocols implemented in quantum optics are proposed by using different randomness sources, including single photon detection [6][7][8] , vacuum state fluctuation [9][10][11] , laser phase fluctuation 12,13 and amplified spontaneous emission noise 14,15 . There are already some commercial QRNG products implementing these protocols. In general, QRNG system consists of two parts, a randomness source and a measurement unit. The randomness source emits the superposition state in the measurement basis whose measurement outcome is unpredictable to produce random numbers. For example, for the superposition state |+ = (|0 + |1 )/ √ 2, the results of projection measurements onto the {|0 , |1 } basis of the state are purely random and ideally form the random numbers.
On the other hand, quantum computers based on different physical implementations have been rapidly developed 16 , including superconducting quantum circuits 17,18 , nuclear magnetic resonance 19,20 and optical systems 21 . Some companies have all launched cloud quantum computer which enables users to send quantum programs to use quantum computer 22,23 . Furthermore, due to the presence of superposition state, quantum computer can be considered as an unbiased QRNG to generate random numbers 24 . Generally, a quantum bit (qubit) can be prepared in the superposition state |+ = (|0 + |1 )/ √ 2 by applying the Hadamard gate on the initial state |0 . Thus, repeating measurements on the qubit in the {|0 , |1 } basis, the 0 and 1 can be obtained with equal probabilities. Compared with the PRNG based on conventional digital computers, the QRNG based on quantum computers does not require the random seeds, in which the risk of the predictability of output sequence can be avoided.
However, the imperfections of realistic devices and the presence of hardware noise may leave security loopholes that provide side information to eavesdroppers in practice. To enhance the security of QRNG, a self-testing or device-independent (DI) QRNGs are proposed which do not need to trust the generated quantum state and the measurement devices [25][26][27] . By observing the violation of the Bell inequality, the randomness of source can be guaranteed and true random numbers can be obtained. Unfortunately, realizing the practical implementation is difficult due to the requirement of loophole-free Bell test, and the random number generation rate is very low, which cannot satisfy the demands of the practical applications. In order to increase the generation rate and make the protocols more practical, a semi-self-testing or semi-device-independent (SDI) QRNG scheme with trusted part of the physical devices is proposed which presents a trade-off between the generation rate and the security of certified randomness [28][29][30] .
Among SDI-QRNG schemes, source-independent (SI) QRNG has gathered lots of attention [31][32][33] . With reasonable assumptions that measurement devices are well-calibrated and the source is untrusted, the SI-QRNG can generate secure random numers and achieve considerable random number generation rate. Most of the SI-QRNG protocols are realized by the quantum optics devices. Utilizing a laser as randomness source, Zhu et al proposed a SI-QRNG scheme and realized a randomness generation rate of over 5000 bps 33 , and Marco et al proposed a continuous-variable version of SI-QRNG protocol and realized a generation rate of 17 Gbps 34 .
In addition to the quantum optics based SI-QRNG, the SI-QRNG scheme can also realized by using the quantum computer. In practice, the existing quantum computers are noisy and vulnerable to various types of errors such as gate error, initial state error, readout error and etc, which cause the randomness source to be untrusted. Motivated by the discrete-variable SI-QRNG based on quantum optics, we propose a scheme that can be quantify the randomness of quantum computer in real time and the final extraction rate of random number is given. Using the cloud superconducting quantum computer of IBM, we experimentally examine the effectiveness of the proposed SI-QRNG protocol.
The rest of this article is organized as follows. In Sec. 2, the protocol of SI-QRNG based on cloud superconducting quantum computer is briefly introduced. In Sec. 3, we analyze the protocol, where the final extracted number of random bits is further given with the readout error, and the estimation method and optimization of parameter are provided. In Sec. 4, an experimental demonstration of the scheme is performed with the cloud superconducting quantum computer of IBM. Finally, we conclude this paper in Sec. 5. In the quantum computer, the initial state of a qubit is generally prepared in |0 and can be represented with state vector as 1 0 T (T = Transpose). By applying RY (π/2) gate, the superposition state |+ = (|0 + |1 )/ √ 2 can be acquired, in which RY (π/2) gate applies π/2 rotation around Y-axis in the Bloch sphere and can be expressed with 1 should be uniformly random based on the mathematical axiom of quantum mechanics. However, the initial state of each qubit may be impacted by hardware noise which cause the temporal correlation between the output bits 35 . Moreover, the single-qubit gate RY (θ ) may also exit error due to the imperfections in the control mechanism. These errors cause the randomness source to be untrusted. At the same time, the readout error also cannot be ignored which leads to the bias of output bits. Motivated by the quantum optics based SI-QRNG protocol proposed in Ref. 33 , we implement the SI-QRNG protocol on quantum computer and give the quantum circuits, as shown in Fig. 1. Here, we assume that the randomness source is untrusted and the measurement operations can be characterized. That is to say, the readout errors in quantum computer are known for legitimate users. Eavesdropper may control the preparation of the initial state and the operation of quantum gate to acquire the information of randomness source. But if the preparation of initial state exists significant errors, malicious attackers cannot prepare the desired quantum state and eavesdrop on the information of the generated random numbers. And the preparation of initial state is generally perfect in a real quantum computer. Thus, we can make a reasonable assumption that the error in the preparation of initial state is negligible.
By estimating the conditional min-entropy based on the error of the X-basis measurement, the true random numbers can be extracted from the results of the Z-basis measurement. The details steps of the protocol are as follows: (1) Source: By applying RY (π/2) gate on the initial state |0 , a qubit is prepared in superposition state |+ = (|0 + |1 )/ √ 2. The quantum state might be correlated with the untrusted party Eve or the hardware noise. Then, the prepared superposition state is transmitted to the trusted measurement box of Alice.
(2) Random sampling: By utilizing a short random seed, Alice randomly chooses the X basis quantum circuit or Z-basis quantum circuit to measure the received quantum state. By adding a RY (π/2) gate to the circuits, the Z-basis measurement can be converted into X-basis measurement, where In this process, quantum circuit is executed n times, including n x in the X-basis quantum circuit and n z in the Z-basis quantum circuit, where n = n x + n z .
(3) Parameter estimation: The quantum state emitted by the source should be |+ state when the quantum computer system is noiseless. The measurement result of |+ is |1 and the result of |− is |0 in the X-basis, respectively. Therefore, a result of |0 means an error. Alice estimates the bit error rate e bx in the X-basis measurement and the statistical deviation is denoted by o, the preparation error of |+ state in the Z-basis e z can be estimated by o is the deviation due to statistical fluctuations which is bounded by 33 where , q x = n x /n is the rate of choice X-basis and represents the Shannon entropy function. If the value of e bx + o exceeds 0.5, Alice aborts the protocol.
(4) Randomness generation: The measurement results of the Z-basis are used to generate random numbers. Alice performs n z times Z-basis quantum circuit to generate n z random bits.
(5) Randomness extraction: Alice uses the Topelitz-matrix hashing method to extract true random numbers. The number of final random bits is where 2 −t e is the failure probability of the randomness extraction 36 . In practice, Alice needs to construct a Topelitz matrix of size n z × [n z − n z H(e z ) − t e ] for randomness extraction, which requires the length of n z + n z − n z H(e z ) − t e random bits and consumes n z H(e z ) + t e bits to correct the errors of state |+ . According to the leftover hash lemma 37 , the final output random bits are not affected by the random bits used in the construction of the Topelitz matrix.

Measurement with readout error
In the protocol of SI-QRNG based on quantum computer, except focusing on the untrusted source, the imperfections of measurement operation cannot be ignored. In what follows, we give the method to solve the problem and recalculate the number of final extracted random bits. In practice, the readout operation of quantum state is imperfect due to the presence of hardware noise or environment noise. Generally, the readout errors of |0 and |1 are different. The readout error of |0 , r 0 , means that |0 is prepared but the measurement outcome is |1 . Similarly, the readout error of |1 , r 1 , means that |1 is prepared but the measurement outcome is |0 . In the IBM's quantum computer, the measurement of a qubit yields an outcome of 0 or 1, and the difference between r 0 and r 1 leads to the asymmetry in the 1/0 ration of measurement outcomes. The readout error impacts the randomness and security of the output bits.
Motivated by the method of detector efficiency mismatch in quantum key distribution 38 and quantum optics based QRNG 39 , we analyze the scenario that the readout errors of |0 and |1 are different in SI-QRNG protocol based on quantum computer. When r 0 and r 1 are equal, the numbers of 1 and 0 in the measurement outcomes of superposition state |+ are equal and the randomness of the output bits cannot be affected by the readout error. Thus, the readout process of a qubit can be equivalent to the superposition of two parts, as shown in Fig. 2. One is the case that the readout errors of |0 and |1 are equal, and the probability of occurrence of Part A is c a . The other one is the case that the readout errors of |0 and |1 are completely different and the probability of occurrence of Part B is c b , in which the readout error of one quantum state is 1 and no genuine randomness can be extracted. The relationship between c a and c b is c a + c b = 1. Moreover, the readout error should fulfill where r i, j denotes the readout error of quantum state |i for Part j with i ∈ {0, 1} and j ∈ {A, B}. Without loss of generality, we assume that the readout error r 1 is larger than r 0 . Due to the relationships r 0,A = r 1,A , r 0,B = 0 and r 1,B = 1, Eq. 4 can be simplified as Furthermore, we can obtain that c b = r 1 − r 0 and c a = 1 − c b = 1 − (r 1 − r 0 ). Because the output bits in Part B cannot extract any random numbers in which all information is stolen by Eve, the mutual information between Alice and Eve is Therefore, we can rewrite the number of extracted random bits as By observing Eq. 3 and Eq. 7, we can find that the two formulas are the same when r 1 = r 0 (i.e., the readout error is same for |0 and |1 ). To extract true random numbers from the original data in Z-basis measurements, the number of random bits consumed in the error correction is given by n z (1 − r 1 + r 0 )H(e z ) + t e .

Parameter estimation
In practice, the various noise source affect the preparation of superposition state |+ and the operation of measurement. The results of X-basis measurement is used to estimate the preparation error of superposition state in source, which can monitor the conditional min-entropy in real time. As shown in Fig. 1, the errors in the preparation of |+ state e z can be mainly divided

4/11
into two parts, one is the error in the preparation of initial state |0 , and the other is the error in the operation of single-qubit RY (π/2) gate. To eavesdrop on the information of the generated random numbers, the eavesdropper may control the quantum gate operation to prepare the desired quantum state under the condition that the initial state is perfectly prepared. Therefore, we only need to consider the error in quantum gate to estimate the preparation error of superposition state in randomness source. Note that the quantum gate operation and the readout operation can be considered as unaltered in a short time.
In the SI-QRNG protocol, only the single-qubit gate RY (π/2) is used. Due to the presence of various noise and the imperfection of control mechanism, RY (π/2) gate exits deviations of the angle of rotation around the Y-axis and the axis of rotation. In this case, the actual RY (π/2) gate can be equivalent to the superposition of RY (θ ) gate and RZ(θ ) gate. Denoting that the deviation of the angle of rotation around the Y-axis is δ and the angle of rotation around the Z-axis is φ . Therefore, the actual angle of rotation around the Y-axis is π 2 + δ and the RY ( π 2 + δ ) gate can be represented by square matrices, i.e., To prepare the superposition state |+ , the first RY (π/2) gate is performed on the initial state |0 , which is equivalent to the superposition of RY ( π 2 + δ ) gate and RZ(φ ) gate, resulting in quantum state Therefore, the qubit state prepared in the randomness source is in the superposition of |+ state and |− state, where the probability of |+ state is ( √ 2 ) 2 and the probability of |− state is ( Applying the same RY ( π 2 + δ ) gate and RZ(φ ) gate on the quantum state |ϕ 1 , resulting the quantum state is Finally, we can obtain |0 or |1 to measure the quantum state |ϕ 2 , where the probability of |0 is 2 )) 2 = ( sin 2 δ +1−cosφ +sin 2 cosφ 2 ) and the probability of |1 is (( cos(δ ) 2 )(cosφ − isinφ + 1)) 2 = cos 2 δ 2 (1 + cosφ ) in theory. Furthermore, considering the readout error in the quantum computer, we can obtain where N 0 and N 1 are the numbers of 0 and 1 in the results of X-basis measurement with readout error which satisfies N 0 +N 1 = n x , n 0 and n 1 represent the numbers of 0 and 1 in the results of X-basis measurement without readout error, respectively. n 0 and n 1 can be expressed as In the SI-QRNG protocol, the result of |− state in the randomness source is defined as the preparation error of superposition state, so the error e bx is equal to the probability of |− state, i.e., e bx = cos( π 4 + δ 2 )e −i φ 2 −sin( π 4 + δ 2 )e i φ 2 √ 2 2 = sin 2 φ 2 cos 2 δ 2 + sin 2 δ 2 cos 2 φ 2 . By solving Eq. 10, the value of n 0 and n 1 can be obtained. In a real quantum computer, the deviation of angle of rotation around the Y-axis δ and around the Z-axis φ are both in (− π 2 , π 2 ), so 0 < cos(φ ) < 1. According to Eq. 11, we can obtain cos 2 δ = 2n 1 n x (1+cosφ ) . Based on the expression for cos 2 δ and the range value of cosφ , the range of δ can be determined which satisfies n 1 n x < cos 2 δ < 2n 1 n x . Given a value of δ , the value of φ can also be determined with Eq. 11. Therefore, the preparation error of |+ in the X-basis measurement can be calculated with e bx = sin 2 φ 2 cos 2 δ 2 + sin 2 δ 2 cos 2 φ 2 . For example, suppose N 0 n x = 0.151, N 1 n x = 0.849, r 0 = 0.05 and r 1 = 0.95, we can obtain n 0 n x = 0.06 and n 1 n x = 0.94 with Eq. 10. Based on the expression of cos 2 δ , the range value of δ results in (−0.24747, 0.2474). With Eq. 11, the deviation of rotation angle around the Z-axis φ is determined, and the relationship between δ and φ is given by Fig. 4(b). Utilizing the

5/11
determined value of δ and φ , the error e bx can be calculated, and the relationship between δ , φ and e bx is shown in Fig. 3. Fig. 4(a) shows the relationship between δ and e bx . We can discover that the parameter e bx has a maximum value when δ = 0, i.e., e bx ≤ 0.05998. This means that the preparation error of |+ state in the X-basis achieve the max value when all errors are attributed to the deviation of the rotation angle δ around the Y-axis. According to Eq. 1, the bound of error e z can be determined.

Parameter Optimization
In the cloud superconducting quantum computer of IBM, the quantum circuit is repeatedly sent to the real devices. The running time directly affects the final data and parameter estimation. To increase the final generation rate of the QRNG and improve the security of QRNG protocol, parameter should be optimized. Here, we consider the influence of the finite data size on the parameter estimation and optimize the ratio of X-basis measurements q x . In the SI-QRNG protocol, the preparation error of superposition state |+ in the Z-basis can be well approximated by e bx . However, due to the statistical fluctuations, the parameter e z cannot be estimated accurately and the method of approximating it is crucial. The parameter e z is estimated by Eq. 1 and the statistical fluctuation o is bounded by Eq. 2. According to Eq. 2, there is a trade-off between q x and o for the ratio of the final random bit length over the raw data size given that ε e is fixed. Generally, the failure probability ε e is picked to be a small value. Hence, the value of q x should be optimized for the randomness extraction rate and follows the condition: With the method of numerical solution, the optimized q x can be obtained. In the cloud superconducting quantum computer of IBM, the maximum executing number of a quantum circuit is 8192 times. Repeating the quantum circuit, the final number of executions n can be up to 8.192 × 10 6 times. The value of ε o is 2 −100 in our later data processing. Supposing that the preparation error of superposition sate in the X-basis e bx is 0.05, the readout error of |0 is r 0 = 0.05 and the readout error of |1 is r 0 = 0.1, we can compute the optimal q x for the final extracted random bits K f inal , as shown in Fig. 5. The value of K f inal has a max value which means the generation rate of random numbers can achieve a max value for a given condition.

Experiment
In this section, we perform the SI-QRNG protocol on the cloud superconducting quantum computer of IBM to show its practicality. In the quantum computer system, 8192 is the maximum number of uninterrupted shots available. For demonstration purpose, the basis choice is achieved by running the Z-basis measurement of quantum circuit with 8192 times and the X-basis measurement of quantum circuit with 251 times. IBMQ 5 yorktown and IBMQ lima are used in the experiment where the device topologies are shown in Fig. 6 40 . IBMQ 5 yorktown and IBMQ lima both have five qubits and the readout error for each qubit is provided by Qiskit 41 . Without loss of generality, we select the qubit 0 (Q 0 ) of the two devices to execute the quantum circuit and the readout errors of Q 0 for these two devices are shown in Table. 1.   By running the quantum circuits of SI-QRNG repeatedly, we obtain two sequences under each quantum computer device which are the results of the Z-basis measurement and X-basis measurement. The sequence L z of Z-basis measurement is used to extract random bits and its length n z is 819200. The other sequence L x is used to estimate the preparation error of superposition state |+ in the Z-basis e bx and its length n x is 25100.
In the sequence L x of IBMQ 5 yorktown, the number of 0 is N 0 = 2669 and the number of 1 is N 1 = 22431. According to Eq. 10 and the readout error of Q 0 , we can obtain n 0 = 299.8557 and n 1 = 24800.1443. With Eq. 11, the value of δ is calculated which is between −0.1095186 and 0.1095186. Exploiting the expression for e bx , we can obtain the maximum value of e bx is 0.011943. Based on Eq. 1 and Eq. 2, the bound of e z is determined and equal to 0.029116. Thus, the number of random bits K yorktown that can be extracted from the Z-basis measurement is 647310 which is calculated by using Eq. 7. Utilizing the same method, the parameter e z and the final extracted random bits K lima in the IBMQ lima device can be calculated. The numbers of 0 and 1 in the X-basis of IBMQ lima are N 0 = 1186 and N 1 = 23914. By calculating, we can obtain e z = 0.0166923 and K lima = 682495.
After obtaining the raw data and the estimated e z , we apply the Toeplitz matrix hashing on the raw data to obtain the final random numbers 42 . To evaluate the randomness of the final data, we perform NIST Statistical Test on the final random numbers 43 . Since the length of the final data cannot satisfy some test items of the NIST Statistical Test, the final data is only subjected to the nine test items from the NIST Statistical Test which are the frequency test, frequency within a block test, runs test, longest runs within a block test, FFT test, approximate entropy test, Matrix Rank Test and the cumulative sums test (forward, backward). Each test item produces a corresponding P-value and the significance level α is set as 0.01 in our test. If the P-value ≥ α, the final data is considered as true random numbers with 1 − α of confidence level. The results of NIST Statistical Test on the two final sequences with length of 600000 bits are shown in Table. 2. From Table. 2, one can see that all the P-values are larger than 0.01, which indicates final data of IBMQ 5 yorktown and IBMQ lima pass all test items.
, where Ξ stands for expectation, X i denotes the i th bit in the sequence, µ and σ 2 are the average and the variance of the sequence 15 . The final data with length of n l is considered as true random numbers when all autocorrelation coefficients are greater than the three-standard-deviation value a 3σ with a 3σ = 3/ √ n l . We choose a sequence with length of 600000 bits to perform autocorrelation test and the corresponding a 3σ is approximately 0.003873. The results of the autocorrelation test of the two final sequences are shown in Fig. 7. The red line stands for the corresponding three-standard-deviation value a 3σ . It can be seen that all the absolute values of autocorrelation coefficients are below a 3σ . From the results of NIST Statistical Test and autocorrelation test, we can know the randomness of the final data generated by IBMQ 5 yorktown and IBMQ lima can be guaranteed.

Conclusion
Motivated by the SI-QRNG based on the quantum optics, we propose and implement a source-independent and loss-tolerant QRNG scheme based on a cloud superconducting quantum computer. Due to the presence of noise and the imperfection of control mechanism, there exits errors in the preparation and readout of superposition state in the quantum computer which results in challenge to being a true random generator. By trusting the measurement operation, we propose the SI-QRNG scheme that can estimate the preparation error of superposition state in randomness source in real time, which guarantees the security of generated random numbers. In the quantum computer, the readout errors of |0 and |1 are generally different. Considering the condition, we further give the final extracted number of random bits. Considering the deviation of the rotation angle around the Y-axis and the axis of rotation, an estimation method for parameter e z is given. Furthermore, we optimize the ratio of X-basis measurements q x to increase the final random number generation rate. By utilizing the cloud superconducting quantum computer of IBM, we perform the SI-QRNG scheme and the practicability and effectiveness of our scheme are proved.. The random numbers generated by IBMQ 5 yorktown and IBMQ lima are post-processed by Toeplitz matrix hashing to obtain the final random numbers. The results of NIST Statistical Test and autocorrelation test show that the final random numbers  could be considered as true random numbers. Utilizing the SI-QRNG scheme, the conditional min-entropy of superconducting quantum computer can be monitored in real time, and we realize the generation of true random numbers in quantum computer with noise. Figure 1 Quantum circuits for the proposed SI-QRNG. The qubit state is randomly measured in the X-basis or Zbasis.

Figure 6
Device topology of IBMQ 5 yorktown and IBMQ lima. The absolute value of autocorrelation function of the nal data generated by IBMQ 5 yorktown and IBMQ lima.