Semi-device-independent framework based on natural physical assumptions

The semi-device-independent approach provides a framework for prepare-and-measure quantum protocols using devices whose behavior must not be characterized nor trusted, except for a single assumption on the dimension of the Hilbert space characterizing the quantum carriers. Here, we propose instead to constrain the quantum carriers through a bound on the mean value of a well-chosen observable. This modified assumption is physically better motivated than a dimension bound and closer to the description of actual experiments. In particular, we consider quantum optical schemes where the source emits quantum states described in an infinite-dimensional Fock space and model our assumption as an upper bound on the average photon number in the emitted states. We characterize the set of correlations that may be exhibited in the simplest possible scenario compatible with our new framework, based on two energy-constrained state preparations and a two-outcome measurement. Interestingly, we uncover the existence of quantum correlations exceeding the set of classical correlations that can be produced by devices behaving in a purely pre-determined fashion (possibly including shared randomness). This feature suggests immediate applications to certified randomness generation. Along this line, we analyze the achievable correlations in several prepare-and-measure optical schemes with a mean photon number constraint and demonstrate that they allow for the generation of certified randomness. Our simplest optical scheme works by the on-off keying of an attenuated laser source followed by photocounting. It opens the path to more sophisticated energy-constrained semi-device-independent quantum cryptography protocols, such as quantum key distribution.

The semi-device-independent approach provides a framework for prepareand-measure quantum protocols using devices whose behavior does not need to be characterized or trusted, except for a single assumption on the dimension of the Hilbert space characterizing the quantum carriers. Here, we propose instead to constrain the quantum carriers through a bound on the mean value of a well-chosen observable. This modified assumption is physically better motivated than a dimension bound and closer to the description of actual experiments. In particular, we consider quantum optical schemes where the source emits quantum states described in an infinite-dimensional Fock space and model our assumption as an upper bound on the average photon number in the emitted states. We characterize the set of correlations that may be exhibited in the simplest possible scenario compatible with our new framework, based on two energy-constrained state preparations and a two-outcome measurement. Interestingly, we uncover the existence of quantum correlations exceeding the set of classical correlations that can be produced by devices behaving in a purely pre-determined fashion (possibly including shared randomness). This feature suggests immediate applications to certified randomness generation. Along this line, we analyze the achievable correlations in several prepare-and-measure optical schemes with a mean photon-number constraint and demonstrate that they allow for the generation of certified randomness. Our simplest optical scheme works by the on-off keying of an attenuated laser source followed by photocounting. It opens the path to more sophisticated energy-constrained semi-device-independent quantum cryptography protocols, such as quantum key distribution.

Introduction
Understanding the nature and extent of correlations that distinct systems may display is a central problem in many applications of quantum physics. In particular, it is an essential stone for developing device-independent (DI) quantum information protocols [1][2][3][4][5][6][7], where the correlations that are observed between separate quantum devices provide a guarantee that the protocol performs as expected. This guarantee follows independently of any assumptions on the local behavior of the quantum devices, hence its name, but it must necessarily rely on some specific constraints on the information that they exchange. Indeed, if arbitrary, unlimited communication is allowed between the devices, any kind of correlations can be generated, even in a scenario restricted to classical physics.
In the standard DI framework based on Bell non-locality [8], the constraint on communication is maximal: the separate devices are not allowed to communicate any type of information, neither classical nor quantum. This no-communication constraint has the conceptual advantage of having a clear physical and operational significance. In particular, it is in principle possible to enforce it without knowledge of the internal behavior of the devices, i.e., by adequate shielding or space-like separation of the devices. However, the generation of useful, non-classical correlations in the absence of quantum communication must then necessarily rely on (loophole-free) entanglement, which presently represents a serious obstacle to practical DI applications.
This difficulty has motivated the development of an alternative framework for DI applications, which is inspired by the traditional prepare-and-measure implementation of quantum key distribution and where communication is allowed between the quantum devices. As noted above, a constraint, though, must be put on this communication and it is usually formulated as a bound on the Hilbert space dimension of the exchanged quantum messages [9][10][11]. With such a constraint, useful non-classical correlations can already be generated by restricting the communication to qubits or qutrits in a purely prepare-andmeasure scenario, without the need of entanglement, which provides a clear advantage from the implementation point of view. Several protocols for randomness generation (RNG) [12] and quantum key distribution (QKD) [13,14] have been introduced within this framework, which is usually referred to as "semi-device-independent" (semi-DI). The downside, however, is that the dimension assumption, even if it represents a convenient abstraction for a theorist, is only an idealization. Carriers of quantum information, such as photons, live in an infinite Hilbert space, and assuming that information is encoded in only a few degrees of freedom is not justified without some intricate characterization of the devices (hence the terminology "semi device independent").
In this paper, we propose a physically better motivated approach for constraining the exchanged quantum messages in a semi-DI framework. We express the restriction on the exchanged states in terms of the mean values of some well-chosen observable, such as the energy. As a simple example, consider the case where the Hilbert space carrying the quantum messages is the Fock space of several quantum optical modes. This is the appropriate space to describe quantum optics experiments, including those demonstrating results based on dimension bounds, in which attenuated laser sources [15] or non-ideal heralded photon sources [12,16] are used. In this context, the emitted states can in principle occupy an infinite-dimensional space so that, instead of putting a limit on the dimension, it is much more natural to constrain the average number of photons. The corresponding observable would then be the photon-number operator, which has a clear physical significance. Alternatively, we could constrain the energy contained in one or more frequency modes containing the quantum message, as the two are closely related. This is thus a natural substitute for the dimension of a finite Hilbert space. Moreover, designing devices in such a way that the average photon number does not exceed a given threshold or verifying experimentally that it does not exceed such a threshold will typically require a less detailed modeling of the devices than would be needed to verify, e.g., that the emitted states span a Hilbert space of a given dimension.
A prerequisite for the development of any DI or semi-DI protocol is to examine the set of correlations that are available under the assumptions considered. Much work has been done specifically on this question in the standard settings based on non-locality and dimension bounds, see e.g. [8,[17][18][19][20][21][22] and [9-11, 23, 24]. Here, we fully characterize analytically the set of available correlations in the simplest scenario compatible with our general framework. This uncovers interesting features suggesting immediate applications to randomness generation, which will be fully developed in a forthcoming publication [25].
In Section 2, we introduce the general framework of semi-DI prepare-and-measure scenarios and modify it to account for a physical constraint (mean value of an observable) instead of a dimension bound. We define a simple setting with two state preparations and a single measurement with binary outcomes, which suffices to produce a separation between the quantum and classical correlations, and subsequently suggest a few simple potential implementations using currently accessible quantum optics technology. The quantum region (i.e., the set of available quantum correlations) is analyzed in Sections 3 and 4, while the classical region (i.e., the set of available correlations arising from a mixture of classical deterministic behaviors) is studied in Section 5. Then, in Section 6, with an eye toward the application to certified random number generation, we characterize an intermediate deterministic region; correlations outside of this region are those for which randomness can be certified for a specified input. We also show that correlations outside this intermediate region are achievable with simple optical implementations. Finally, we conclude in Section 7 and discuss other possible applications.
2 Semi-DI setting with a physical constraint 2.1 Definition of the general model Let us first remind the general framework of semi-DI prepare-and-measure scenarios. As depicted in Fig. 1, a source S is linked through a quantum channel to a measurement device M. On the source S, an input x ∈ {1, . . . , k} can be selected, resulting in the emission of an unknown quantum state ρ x . The state is then measured by M, according to a measurement selected through an input y ∈ {1, . . . , l}, and yields an outcome b ∈ {1, . . . , d}. This later process is characterized by a set of unknown measurement operators {M b|y }.
To an external observer that has access only to the inputs and output of S and M, the joint behavior of the two devices is completely characterized by the probabilities More generally, the behavior of the two devices could be correlated through dependence on an additional hidden random parameter λ shared between the devices, in which case the probabilities take the more general form In the semi-DI approach, no detailed assumptions are made on the states and measurements underlying the correlations P (b|y, x), except for a specific constraint on the messages ρ x . Here, we propose to express such a constraint in terms of an observable H, describing a physical property of the emitted states ρ x that we trust or on which we have control (more generally, one could introduce several such observables). A restriction on the quantum messages ρ x can then be formulated as a constraint on the corresponding mean values H x = tr[Hρ x ] of this observable.
Note that contrarily to the states ρ x and measurement operators M b|y , which are a priori unspecified and unknown, the observable H must be well defined. It is also implicit that it should be defined on some given (possibly infinite) Hilbert space H describing the physics of the quantum systems emitted by S. Thus, one should also assume that ρ x is defined on H.
This general formulation encompasses the usual dimension assumption, for instance, by defining H as the projector onto a qudit subspace of H and requiring H x = 1 for all x. Expressing the dimension assumption in this form has the merit of making explicit that the message qudits live in a subspace of a larger Hilbert space H, which in practice must also be properly defined and characterized if one wants to make sure that information is propagating in the relevant subspace and not in possible additional degrees of freedom, which in a cryptographic protocol could be exploited by an eavesdropper (side channels).
As stated in the introduction, the main interest of our more general formulation, however, is that it can be used to model communication constraints that are more natural and better motivated physically than the usual dimension bounds. A particular example is the case where H is the photon-number operator of a quantum optical system.
With this application in mind, we will consider in this work two types of constraints on the mean values of H. The first, which we denote the max-average assumption, corresponds to assuming upper bounds on the mean values H x for given thresholds ω x . For instance, if H is the photon-number operator, we may trust that for all states ρ x emitted by the source, the mean photon numbers H x are below some threshold, though we may not know what the actual photon number is.
In the case where the states emitted by S vary from run to run according to some random parameter λ, the max-average assumption only bounds the mean value H x averaged over all possible values of λ. But it does not constrain the maximum values of H x|λ = tr[Hρ λ x ], which could in principle be arbitrarily high. It is therefore natural to introduce another (stronger) assumption, which we call the max-peak assumption, according to which max Note that if H is, e.g., the photon-number operator, this second condition still allows for fluctuations in the photon number within each state ρ λ x and does not correspond to a truncation of the Fock space, as the constraint only imposes a bound on the mean values tr[Hρ λ x ] of H for every ρ λ x . In particular, the states ρ λ x could have a non-zero amplitude in any of the number-basis states. These two possible physically-motivated constraints on the communicated quantum messages will be analyzed on specific examples later on. The max-average assumption has the advantage that it could in principle be verified "from the outside" by performing tests on the average emitted states ρ x without any knowledge of the internal behavior of the source. Verifying that the max-peak assumption is satisfied, on the other hand, would typically rely on some modeling of the source. Its main advantage is that it is more constraining and thus can certify useful properties that wouldn't be certified using the average-peak assumption (see examples in Sections 5 and 6).

The simplest setting: two inputs and two outputs
In the rest of this paper, we consider the simple situation where the source S has two possible inputs x ∈ {1, 2} and the measurement device M has no input (i.e., y ∈ {1}) and two possible outputs, which we denote b ∈ {±1} for convenience, see Fig. 2. Note that this corresponds to the simplest non-trivial prepare-and-measure scenario. Indeed, M must obviously output at least two different possible values, and S must have at least two different preparation choices, otherwise no quantum messages are needed and any observed behavior can be classically simulated by S and M.
This prepare-and-measure scenario is simpler than any possible scenario based on a dimension bound, for which one must have at least three choices on the source, i.e., x ∈ {1, 2, 3}, and any measurement device outputting a single bit b ∈ {±1} should have at least two inputs, i.e., y ∈ {1, 2}. Indeed, since the smallest dimension bound corresponds to one qubit, the channel connecting S to M always has a capacity of at least 1 bit under a dimension assumption. This implies that the number of inputs on S should be larger than two, because otherwise the input x can be encoded perfectly in the channel and transmitted to M, who knowing x can now generate an output b compatible with any probability distribution p(b|x, y). There should also be a number of binary measurements greater than one, because otherwise S could locally choose a value b ∈ {±1} compatible with any probability distribution p(b|x) and simply send that value b to M through the channel. Strikingly, such strategies are not available under the assumptions that we consider here, since, as we will see, they constrain the classical channel capacity to be sub-unity by forcing the two emitted states ρ 1 and ρ 2 to have some non-zero overlap.
In our scenario, the joint behavior of S and M is thus characterized by the four probabilities P (b|x) = tr[M b ρ x ] where x = 1, 2 and b = ±1. It will be convenient to work with the equivalent representation where E x = P (+1|x)−P (−1|x) is the expectation value of the observable M = M +1 −M −1 , with −1 ≤ M ≤ 1. The value of E x characterizes the bias of the output b toward +1 or −1 for a given input x. We refer in the following to the quantities E x as "correlations" as they represent how the output of M is correlated to the input of S. For instance if E 1 = 1 and E 2 = −1, the output of M is completely correlated to the input of S. More precisely, the presence of correlations is actually reflected by the fact that |E − | = |E 1 − E 2 | > 0. In particular, a value |E − | > 0 implies that the measurement device M can (at least partly) distinguish the two states ρ 1 and ρ 2 . We will see further below that the quantity E − plays a special role in our analysis, analogous to a Bell expression in the context of non-locality.
Having defined the general behavior of S and M, we now specify the properties of the observable H that we use to model our assumptions on the quantum messages. As noted above, in our scenario the two states ρ 1 , ρ 2 should have a non-zero overlap, otherwise they could encode faithfully the two values x = 1, 2 and our entire problem would become trivial. One simple possibility for satisfying this condition in an optical system is simply to have both states ρ 1 , ρ 2 sufficiently close to the vacuum state |0 . In a multimode system with a discrete and finite number of possible mode frequencies ω, this amounts to upper bounding the expectation values of the photon-number operator H = ω a † ω a ω or the energy operator H = ω ω a † ω a ω . Alternatively, one could directly bound the weight of the non-vacuum component, i.e., the expected value of the non-vacuum projector H = 1−|0 0|. More generally, the condition that ρ 1 , ρ 2 have a non-zero overlap is satisfied if they are both close to some given reference state |φ φ|, i.e., if the expectation values H x of the observable H = 1 − |φ φ| are below some sufficiently small thresholds.
Formally, all the above examples correspond to constraints on the expected values of an observable H satisfying the two following conditions: 1. H has a non-degenerate ground state,

H has a finite gap.
The results that we will derive below apply to any observable H satisfying these two conditions, independently of their physical meaning. Without loss of generality, we can assume (if necessary by rescaling H) that the ground state eigenvalue is 0 and the gap is 1. In the following, we let |0 denote the ground state of H.
Before characterizing, in Sections 3 and 4, the set of possible correlations E x between S and M in terms of the constrained mean values H x of such observables H, we briefly describe for concreteness some standard optical circuit implementations that can be analyzed in our framework.

Binary Phase-Shift Keying (BPSK)
Our first optical implementation corresponds to the Binary Phase-Shift Keying (BPSK) scheme and is illustrated in Fig. 3(a). We consider a single optical mode described over the phase space (X, P ) of the two quadratures of light ([X, P ] = i 2 ). Depending on x, the source prepares one of two coherent states |φ 1 = |ξ or |φ 2 = |−ξ , where ξ is a small positive real parameter, so that both states are close to the vacuum |0 . Although these two states have a non-zero overlap e −2|ξ| 2 , it is possible to partly distinguish them by performing a homodyne measurement of the quadrature X. In particular if we define the output of the measurement device M as b = sign(X), then a straightforward calculation gives i.e., we observe a correlation between the sign of b and the input x whose strength depends on the value ξ.
The source (S) consists of a laser that produces a coherent pulse which is sent through an unbalanced beam splitter. The intense reflected beam is sent to the measurement device (M) as a phase reference, i.e., local oscillator (LO); the transmitted beam is highly attenuated at an optical density (OD) and phase shifted by 0 or π depending on x at a phase shifter. This is the quantum signal (QS) sent to M. M then performs a homodyne measurement on QS: the two beams interfere on a balanced beam splitter and two photodiodes measure the intensities of the resulting beams. The difference of the two intensities is proportional to the quadrature X of the quantum signal. Finally, M outputs the sign of X. Note that the LO does not depend on the input x and can be modeled as shared randomness.

Laser
OD Att The source (S) consists of a laser that produces a coherent pulse, which is, at first, highly attenuated at an optical density (OD), and then sent through a variable attenuator (Att), so that, depending on x, the amplitude of the resulting coherent states is ξ ± . This is the quantum signal (QS) sent to the measurement device (M). M is a single-photon detector that outputs b = +1 if it clicks, and b = −1 otherwise.

Laser
OD Shutter The source (S) consists of a laser that produces a coherent pulse, which is, at first, highly attenuated at an optical density (OD). A controllable shutter then transmits or blocks the beam depending on the value of x. The measurement device is a single-photon detector that outputs b = +1 if it clicks, and b = −1 otherwise. Alternatively to the use of a shutter, the laser can simply be turned on and off depending on x. A semi-DI analysis for this setup (see Sections 5 and 6) is possible based only on the assumption that the source emits optical systems with low mean photon number (choosing H = ω a † ω a ω ) or small non-vacuum component (choosing H = 1 − |0 0|). The coherent states |±ξ have a mean photon number |ξ| 2 and non-vacuum component 1 − e −|ξ| 2 , where the mean photon number is larger than the non-vacuum component: |ξ| 2 > 1−e −|ξ| 2 . Thus for given ξ, one can impose more constraining bounds if one defines H as the non-vacuum projector rather than the photon-number operator and we will thus make the former choice in the following. The difference between 1 − e −|ξ| 2 and |ξ| 2 , though, is negligible when ξ is small and this choice does not fundamentally affect our results. When performing the semi-DI analysis of the above setup, we will thus take H = 1 − |0 0| and upper bound the expectation values of this operator through the max-average assumption (3) or the max-peak assumption (4) using thresholds Note that in the implementation illustrated in Fig. 3(a), in addition to the quantum states |φ x , the source also emits an intense reference laser beam that serves as a local oscillator to define the phase of these states. This local oscillator can, however, be modeled as shared randomness (for instance it could exit the source S before the input x is chosen). Alternatively, one could also consider more involved implementations where a phase synchronization between S and M can be achieved without the need for the transmission of a local oscillator signal between S and M [26].

2-level Amplitude-Shift Keying (2ASK)
Our second example corresponds to the 2-level Amplitude-Shift Keying (2ASK) scheme and is illustrated in Fig. 3(b). The source emits the two coherent states |φ 1 = |ξ + or |φ 2 = |ξ − , where ξ and are two real, positive parameters. The measurement device is a photodetector that outputs b = −1 if no photon is detected and b = +1 if at least one photon has been detected. This setup generates the correlations Suitable choices for ξ and can easily be found so that |E 1 − E 2 | > 0, i.e., such that the output of M and the input of S are correlated. In this second example, the two states |φ 1 = |ξ + and |φ 2 = |ξ − are not necessarily close to the vacuum if ξ is large, but they are close to the intermediate state |ξ . We thus define for the purpose of the semi-DI analysis of this setup (see Sections 5 and 6) the observable H as H = 1 − |ξ ξ|, which measures the proximity of the states |φ x to the reference state |ξ . Specifically, we have φ x |H|φ x = 1 − e − 2 2 for x = 1, 2. Thus we will constrain the expected values of H using thresholds Note that, contrarily to the previous example, such an assumption on the expectation values of H may actually require a more detailed characterization of the source. First, the observable does not correspond to a natural property, like the energy, and, second, an experimental verification of the assumption would require a displacement operation with a beam that is coherent with the quantum message followed by a photon number measurement. It is thus probably not the most natural in a semi-DI setting. We nevertheless include this example to stress that our formulation can be adapted to different constraints on the source.

On-Off Keying (OOK)
Our final example corresponds to the On-Off Keying (OOK) scheme and is illustrated in Fig. 3(c). When x = 1, the source emits a coherent state |ξ where |ξ| 2 is small, and when x = 2 it emits the vacuum state |0 . The measurement performed at M corresponds, as in the previous example, to a photodetector that outputs b = −1 if no photon is detected and b = +1 if at least one photon has been detected. This yields That is, when x = 2 one obviously observes the result b = −1 with certainty, while when x = 1, there is a non-zero probability 1 − e −|ξ| 2 |ξ| 2 to obtain the outcome b = +1. The measurement performed at M can thus be interpreted as a partial unambiguous discrimination of the two states ρ 1 , ρ 2 in the sense that when we find b = +1, we are sure that the state sent was ρ 1 , but we cannot conclude anything definite when b = −1.
As in the first example, the semi-DI analysis for this setup (see Sections 5 and 6) will only rely on the assumption that the source emits optical systems with low non-vacuum component, i.e., we use H = 1 − |0 0|. The non-vacuum component is 1 − e −|ξ| 2 for x = 1 and 0 for x = 2 and we will thus use the thresholds Note that contrarily to the two above examples, here we bound differently the expectation values of H in the case x = 1 and x = 2 since the implementation is not symmetric with respect to the two situations. Alternatively to bounding the non-vacuum component, we could use the mean photon number, but the difference would be negligible when ξ is small and making one choice or the other does not fundamentally affect our results.
3 Pure-state quantum correlations As we have explained earlier, a prerequisite for the development of any DI or semi-DI protocol is to examine the set of correlations that are available under the assumptions considered. One of our objectives is thus to characterize the most general set of quantum correlations (E 1 , E 2 ) compatible with arbitrary implementations of our prepare-andmeasure scenario.
In general, the source S and the measurement device M could behave in a way depending on shared random parameters λ. As a first step, it is useful to consider the case where the devices do not exploit such shared randomness and where in addition the source S emits pure states φ 1 , φ 2 . In Section 4, we will relax these conditions and consider completely general implementations.
Let us therefore define the set of pure-state correlations as that is, the set of possible values (E 1 , E 2 ) that are attainable with arbitrary pure states )] = 1 can be obtained for any two orthogonal states |φ 1 and |φ 2 in the space spanned by |0 and |1 . Therefore, one cannot exclude that S emits two orthogonal pure states φ 1 and φ 2 . But in this case, they can encode faithfully the two values x = 1, 2 and any correlations (E 1 , E 2 ) are possible, for instance by setting M to M = E 1 φ 1 + E 2 φ 2 .
However, if H 1 + H 2 < 1, then intuitively H 1 and H 2 are both small and both close to the non-degenerate ground state |0 of H. Thus they should have a non-zero overlap which will restrict the set of possible correlations (E 1 , E 2 ). This intuition is made precise by the following result. For where The trivial constraints |E x | ≤ 1 follow immediately from the definition of these quantities, so we only need to establish (13). We do this in two steps. First of all, given two pure states φ 1 , φ 2 , the set of correlations (E 1 , E 2 ) = tr[M φ 1 ], tr[M φ 2 ] that can be obtained using an arbitrary measurement M obviously only depends on the scalar product φ 1 |φ 2 . We show in Subsection 3.1 that this set is completely characterized by the constraint We then show in Subsection 3.2 that the parameters H 1 , H 2 imply a tight lower bound on the scalar product, Combining these two bounds we obtain the relation g(E 1 , E 2 ) ≥ h(H 1 , H 2 ) in (13). Note that we characterize the set Q only for values of H 1 , H 2 such that H 1 + H 2 ≤ 1. Indeed, in the next sections we are going to use pure-state correlations in Q as building blocks for more general sets of correlations but under the assumption that the possible expectation values H x of the observable H are upper bounded by some given thresholds ω x , as in (3) and (4). But since any correlations (E 1 , E 2 ) are already possible in the case H 1 + H 2 = 1, as we pointed out above, there is obviously no advantage in considering larger values H 1 + H 2 > 1 to comply with the assumed thresholds. From now on, we thus always consider that H 1 + H 2 ≤ 1 (and similarly that ω 1 + ω 2 ≤ 1 in bounds of the type (3) and (4)).
3.1 Characterization of the possible correlations (E 1 , E 2 ) for pure states as a function of their scalar product φ 1 |φ 2 Since |E x | ≤ 1, the region of possible values (E 1 , E 2 ) is obviously contained in the square [−1, 1] × [−1, 1]. We now show how a promise on the scalar product φ 1 |φ 2 = γ further constrains the possible values of (E 1 , E 2 ).
The parameter γ satisfies 0 ≤ γ ≤ 1. The two extreme cases are readily solved. When γ = φ 1 |φ 2 = 1, the two states are indistinguishable and the measurement statistics must necessarily yield E 1 = E 2 . When γ = 0, the two states are orthogonal and thus can perfectly encode the value of the input x. In particular, we can attain any value These two situations can be summarized by the relation g(E 1 , E 2 ) ≥ γ, which implies E 1 = E 2 when γ = 1 and which does not put any restriction on (E 1 , E 2 ) when γ = 0 since g(E 1 , E 2 ) ≥ 0 is always satisfied for |E x | ≤ 1.
Let us now assume 0 < γ < 1. Obviously, we can restrict our analysis to the twodimensional subspace spanned by φ 1 and φ 2 . In that subspace, we can rewrite the states as qubit operators φ x = (1 + n x · σ)/2, where σ = (σ 1 , σ 2 , σ 3 ) are the Pauli matrices and n x = 1. Then, a general measurement M in that subspace can be written as a convex combination (p 0 − p 1 )1 + p 2 m · σ, where p i ≥ 0, i p i = 1, m = 1, and m can be taken in the span of {n 1 , n 2 } without loss of generality. The resulting correlations correspond to the mixture m, n 2 · m). (18) In other words, the region of allowed (E 1 , E 2 ) is the convex hull of the points Let us characterize further the points (E 1 , E 2 ) = (n 1 · m, n 2 · m). Since m lies in the span of n 1 , n 2 and since (n 1 + n 2 ) · (n 1 − n 2 ) = 0, we can write without loss of generality m = cos(θ) n 1 + n 2 n 1 + n 2 + sin(θ) Using this formulation together with n 1 + n 2 = 2γ and n 1 − n 2 = 2 1 − γ 2 , we find We thus find that the set of points (E 1 , E 2 ) = (n 1 · m, n 2 · m) for a given γ corresponds to the ellipse where we have defined E ± = E 1 ± E 2 . The region of allowed (E 1 , E 2 ) for an arbitrary measurement M is therefore the convex hull of (1, 1), (−1, −1), and any points on this ellipse, as represented in Fig. 4. We can represent this region in a compact way as the condition g(E 1 , E 2 ) ≥ γ. Indeed, first note that the ellipse (23) intersects the borders of [−1, 1] × [−1, 1] at the two points (E 1 , E 2 ) ∈ (2γ 2 −1, 1), (−1, 1−2γ 2 ) in the region above the E + -axis and at the two points (1−2γ 2 , −1), (1, 2γ 2 −1) in the region below the E + -axis, as represented in Fig. 4. These two pairs of points define two arcs of ellipses, as illustrated in Fig. 4. After some basic algebra (corresponding to writing (23) explicitly in terms of E 1 , E 2 ), one finds that these two arcs of ellipses correspond to the values of (E 1 , E 2 ) which solve g(E 1 , E 2 ) = γ. It is not difficult to observe that any point in the convex hull of (1, 1), (−1, −1), and the ellipse (23) also belongs to the arcs of a second ellipse satisfying g(E 1 , E 2 ) =γ ≥ γ. Indeed, by increasingγ, the four intersection points defined above move towards the corners (−1, −1) and (1, 1), which they reach whenγ = 1 and the ellipse becomes the line segment between the points (1, 1) and (−1, −1). Therefore, asγ increases, the two corresponding arcs of ellipses stretch and move over the entire convex region for (E 1 , E 2 ) defined above. We deduce that this convex region is given by the values of (E 1 , E 2 ) satisfying g(E 1 , E 2 ) ≥ γ.
In summary, we have established that the set of correlations (E 1 , E 2 ) that can be obtained by measuring two pure states with given scalar product γ = φ 1 |φ 2 is given by  g(E 1 , E 2 ) ≥ γ, i.e., (16). The corresponding regions for different values of φ 1 |φ 2 = γ are represented in Fig. 5. Note that the regions strictly grow when the scalar product γ decreases, starting from the line segment E 1 = E 2 when γ = 1 (corresponding to two indistinguishable states), to the full square when γ = 0 (corresponding to two fully orthogonal states).
3.2 Lower bound on the scalar product φ 1 |φ 2 as a function of expectation values (H 1 , H 2 ) We have just seen that the region of possible correlations (E 1 , E 2 ) attainable with pure states only depends on their scalar product through (16). We now show that the parameters (H 1 , H 2 ) constrain the possible values of this scalar product through the lower bound (15). Intuitively if H 1 and H 2 are small, both states φ 1 and φ 2 are close to the non-degenerate ground state |0 of H and thus they should have a non-zero overlap. This is what (15) makes precise.
Let us first show that for any values of (H 1 , H 2 ) it is indeed possible to find two states φ 1 , φ 2 such that their scalar product satisfies φ 1 |φ 2 = h(H 1 , H 2 ). This implies that any point (E 1 , E 2 ) satisfying (13) can indeed be realized in our prepare-and-measure scenario.
Let us now show that the scalar product between φ 1 , φ 2 cannot be smaller than the value given by (15). This implies that no correlations outside the region defined by (13) can be obtained by measuring pure states in our scenario.
For this, let β x = 1− 0|φ x |0 be the weight of the state φ x in the subspace orthogonal to the groundstate |0 of H. We have that β where λ i and P i denote the eigenvalues of H and the corresponding projectors, with λ 0 = 0 and λ i ≥ 1 for i > 0. Writing where |ξ x is in the subspace orthogonal to |0 , we have that where in the second line we used that the right hand-side is minimized when ξ 1 |ξ 2 = −1 and in the last line we used that h(β 1 , β 2 ) is positive when β 1 + β 2 ≤ 1, which is the case since H 1 + H 2 ≤ 1 and β x ≤ H x . Now, given that the function h(x, y) is non-decreasing in x and y in the region x + y ≤ 1, we have that h(β 1 , β 2 ) ≥ h(H 1 , H 2 ), which gives (15).

General quantum correlations 4.1 Shared randomness
Let us now turn to the general case where S and M can exploit shared random parameters λ. This includes in particular the case where the source S can emit mixed states since any mixed state ρ x can be viewed as a convex decomposition ρ x = λ p λ φ λ x of pure states. Let i.e., the set of pure-state correlations is closed under shared-randomness. Interestingly, the same property is also shared by pure-state quantum correlations in the context of Bell non-locality, but is not true in the context of semi-DI scenarios based on dimension bounds. Since obviously Q ⊇ Q, we need only prove that Q ⊆ Q, i.e., that given any mixture E = λ p λ E λ of pure-state correlations with average expectations H = λ p λ H λ , then the exact same correlations E can be obtained through a single pure-state quantum realization with expectation values H. This simply amounts to showing that g(E) ≥ h(H) since this condition fully characterizes the set of pure-state quantum correlations, or equivalently that g(E) 2 − h(H) 2 ≥ 0 since the functions g and h are positive in the domain H 1 + H 2 ≤ 1. We establish this by showing that g 2 and −h 2 are concave. Indeed, if this is the case we have where we used the concavity of g 2 and −h 2 in the first inequality and the condition g(E λ ) 2 − h(H λ ) 2 ≥ 0 for each λ in the second inequality, since by assumption E λ ∈ Q H λ . Note that both g 2 and −h 2 can be written in term of the function Showing the concavity of g 2 and −h 2 thus reduces to showing that f is concave for 0 ≤ x, y ≤ 1, i.e., that its Hessian matrix Hess(f ) is negative semidefinite. A straightforward computation shows that tr Hess(f ) ≤ 0 and det Hess(f ) ≥ 0 for any 0 ≤ x, y ≤ 1. Since Hess(f ) is a 2 × 2 symmetric matrix, this implies, as desired, that both of its eigenvalues are nonpositive.

Upper bounds on the expectation values of H
The sets Q and Q defined above assume that the source S emits states with given expectation values H = (H 1 , H 2 ) for the observable H. However, as we pointed out in Section 2, rather than assuming that H takes some exact values, it is more natural to assume upper bounds on the possible values of H, and we introduced two possible ways to bound such values, either through the max-average assumption (3) or the max-peak assumption (4). This leads us to define the set of quantum correlations under the max-average assumption as (32) and the set of quantum correlations under the max-peak assumption as where we have written ω = (ω 1 , ω 2 ). Note that following the remark made at the end of Section 3, we always assume that ω 1 + ω 2 ≤ 1, since any possible correlations (E 1 , E 2 ) are already possible in the case ω 1 + ω 2 = 1. From our previous results, the characterization of Q ω 1 ,ω 2 and Q ω 1 ,ω 2 is immediate. First, it is easy to check that the sets Q H 1 ,H 2 of allowed values of (E 1 , E 2 ) are strictly increasing with This follows from the fact that h (H 1 , H 2 ) is a non-increasing function of H 1 and H 2 in the range H 1 + H 2 ≤ 1 and that the sets of values (E 1 , E 2 ) defined by g(E 1 , E 2 ) ≥ γ increase with decreasing γ, as illustrated in Fig. 5. It thus follows that in (32) one can always assume that λ p λ H λ = ω and in (33) that H λ = ω for all values of λ. Using the results of the previous subsection on the behavior of Q under shared randomness, we deduce that We thus conclude that any correlations that can be generated by an arbitrary quantum realization constrained only by upper bounds ω 1 and ω 2 on H 1 and H 2 , whether through the max-average or the max-peak assumption, always admit an equivalent pure-state quantum representation saturating these upper bounds. In this sense the max-average and maxpeak assumptions are equivalent. As we will see in Sections 5 and 6, however, different quantum realizations of the same correlations may exhibit different underlying quantum properties, and the max-average and max-peak assumptions are different from this perspective.

Classical correlations
A basic property of fully-or semi-DI setups based on non-locality or dimension bounds is the existence of quantum correlations that have no classical analogue. This is clearly a prerequisite for any application of such correlations, e.g., for randomness certification. This property is also present in our semi-DI scenario as we now show.

Definition
We need first to define some notion of "classicality" in our context and a corresponding set of correlations. The no-communication assumption in standard Bell tests and the dimension bound in usual semi-DI protocols have a well-defined meaning in a classical context, without any reference to quantum theory. This is no longer the case for the assumptions that we consider here, as they are expressed as constraints on the mean value of a quantum observable H and hence explicitly assume some underlying quantum model. It is nevertheless still possible to identify sets of correlations that are "classical" in the sense that they do not exhibit genuinely quantum features and thus are useless for semi-DI applications. The most straightforward way to do so is to proceed by analogy with standard Bell tests or usual semi-DI protocols, where classical correlations correspond mathematically to those that can be expressed, with the help of shared randomness, as convex combinations of deterministic correlations. We thus define the set of classical correlations under the max-average assumption (3) as and under the max-peak assumption as The constraint E λ ∈ {±1}×{±1} in these definitions implies that for any given value of the shared randomness λ, an output ±1 for the measurement performed at M is completely pre-determined for each of the two states emitted by the source S. Thus no genuinely quantum behavior is exhibited by the two devices. Conversely, if some correlations E lie outside the set C ω 1 ,ω 2 , then necessarily the output of M cannot be predetermined for at least one of the states sent by S, a typically quantum feature.
We show that C ω 1 ,ω 2 is a polytope, which apart from the trivial facets |E x | ≤ 1 is defined by Similarly, C ω 1 ,ω 2 is a polytope characterized by the stronger inequality where Θ(z) = 0 if z < 1 and Θ(z) = 1 if z = 1. Let us first establish the characterization (37) of C. Remark that for any (E λ , H λ ) ∈ Q for which E λ ∈ {±1} × {±1} there are two possibilities. Either E 1|λ = E 2|λ , in which case |E 1|λ − E 2|λ | = 0. Or E 1|λ = −E 2|λ , in which case the states emitted for x = 1 and x = 2 must be orthogonal pure states and thus H 1|λ + H 2|λ ≥ 1 = |E 1|λ − E 2|λ |/2. By taking convex combination of these possibilities, we find Conversely, any correlations E satisfying the constraint (37) belong to C. To prove this, note that the polytope defined by (37) has the following six extreme points Proving that any E in this polytope belongs to C amounts to showing, by convexity, that any of these six extreme points belongs to C. This is evident for the two points (±1, ±1). The point 1, 1 − 2(ω 1 + ω 2 ) can be decomposed as p 1 E 1 + p 2 E 2 + p 3 E 3 , where and thus also belongs to C. Similar decompositions are readily obtained for the three other points.

Bell inequality analogues
The inequalities (37) and (38) play the same role as the inequality |CHSH| ≤ 2 in the context of Bell non-locality, in that they separate the quantum region from the region of convex combinations of deterministic correlations, see illustration of the sets C and Q in Fig. 6. The analogue of the Tsirelson inequality |CHSH| ≤ 2 √ 2 is the inequality This quantum bound is readily obtained from the results of the previous sections (the points maximizing |E 1 − E 2 | in Q correspond to the points on the E − -axis of the ellipse (23)).
The axis E − thus corresponds to the axis along which "quantumness" increases. Note that we can interpret |E − | as a measure of how well it is possible to guess which input x = 1 or x = 2 was used given the measurement outcome b. Indeed, since the quantity 1 2 |E − | is equal to the statistical distance between the output probability distributions P B|x=1 and P B|x=2 for the two possible inputs.
In particular, the optimal probability to guess the input is p g = 1 2 (1+ 1 2 |E − |). For given H 1 , H 2 , this probability is maximal when |E − | achieves its maximal value 2 in which case we know for sure that the two states sent by S are as distinguishable as possible given the constraints on H 1 and H 2 , and that M implements the measurement that best distinguishes them. When (which necessarily happens when H 1 + H 2 < 1), it follows that it is not possible to deterministically guess which of the two choices x = 1 or x = 2 were made on S, which proves that the quantum channel relating S to M has sub-unit capacity, as previously anticipated.

Implementations discussion
The three experimental implementations that we have presented in Subsection 2.3 generate non-classical correlations as illustrated in Fig. 9. Note that the BPSK and 2ASK schemes do not admit a fully deterministic explanation under the max-average assumption, i.e., even if the source S is allowed to send states with arbitrary values for H, provided that the average values do not exceed the assumed thresholds. This is not true for the OOK implementation, which admits a deterministic explanation in this case. However, such a deterministic explanation is no longer possible if the peak values for H are constrained.
Note that for ω 1 + ω 2 < 1, the set C is of measure 0. We can get some intuition for the meaning of this set as follows. If ω 1 + ω 2 < 1, then for given λ every pair of states φ λ 1 , φ λ 2 emitted by the source must be non-orthogonal, as follows from the results of Subsection 3.2 and the max-peak assumption. Since there is no non-trivial measurement that will yield with certainty definite outcomes for two non-orthogonal states, the measurement device M, if it behaves deterministically, must actually ignore the quantum messages sent by M and simply output a pre-registered outcome b = −1 or b = 1, independently of whether x = 1 or x = 2. We thus necessarily have E 1 = E 2 in this case. Conversely, if we observe correlations for which |E 1 − E 2 | > 0, we can conclude that the measurement device M did not simply output pre-registered values, but actually performed a non-trivial measurement on the states emitted by S, which are non-orthogonal. That is, the observation of |E 1 − E 2 | > 0 witnesses a typical quantum feature, which in particular necessarily results in a non-deterministic outcome for at least one of x = 1, 2. A similar conclusion can be reached under the max-average assumption, but this now requires |E 1 − E 2 | to be above a finite value 2(ω 1 + ω 2 ), as follows from (37).

Correlations exhibiting certified randomness
If S and M generate correlations in the classical sets C or C, then the output b is predetermined simultaneously for both choices of inputs x = 1, 2, and the apparent randomness of b only arises from the pre-established classical randomness λ. Observing a point outside the sets C or C thus guarantees that at least one of the inputs, x = 1 or x = 2 leads to genuinely random outcomes, but does not guarantee that a specific one, say x = 1 does, or that both x = 1 and x = 2 do. For instance, as can be seen in Fig. 6, the point (E 1 , E 2 ) = 1, 2h 2 (ω 1 , ω 2 ) − 1 does not belong to C but nevertheless corresponds to a situation where M returns b = 1 with certainty when x = 1 is used. A similar situation arises in the context of Bell non-locality, in which correlations can be non-local and yet have definite values for a subset of the measurement inputs [27].
In cryptographic applications, and for instance in DI or semi-DI RNG protocols, it is usually the case that the certified randomness comes from a fixed subset of the inputs. For instance, in our context, a semi-DI RNG protocol along the lines of [28][29][30] would most of the time use the input x = 1 to generate the random string and from time to time both x = 1 and x = 2 to estimate the correlations E produced by the devices. Given the estimated E, it is then possible to lower bound the amount of randomness extractable from the x = 1 measurement data.
This leads us to consider sets based on a weaker constraint than those introduced in the previous section, those for which the output of M is deterministic when a specified input x is chosen, while potentially random for the remaining inputs: The sets D 1 , D 2 clearly contain C but can be larger, and similarly for D 1 , D 2 with respect to C, see Fig. 7. Observing a point outside D x or D x now certifies that the output of M is (at least to some extent) random when the input x is chosen. Furthermore, observing a point outside the convex hull of D 1 ∪ D 2 or D 1 ∪ D 2 guarantees that the output of M is random, independently of which input x = 1 or x = 2 was used. The sets D x and D x have a direct significance in the context of semi-DI random number generation (RNG) protocols. The existence of quantum correlations outside, say, D 1 or D 1 is sufficient to guarantee the existence of a semi-DI RNG protocol along the lines of [28][29][30], in which the input x = 1 is used to generate the random string and both x = 1 and x = 2 are used on a smaller subsets of the runs to estimate the correlations E. As long as the estimated E is outside D 1 or D 1 (modulo statistical corrections), one will be able to certify that a certain amount of randomness has been produced (how to quantify precisely this randomness will be presented in [25]).
We have thus regrouped the components (E λ , H λ ) in two subsets (E ± , H ± ), for which E 1|+ = +1 and E 1|− = −1, respectively. Since Q is convex, the two points (E ± , H ± ) belong to Q and satisfy the constraints obtained in Section 3.
In particular, since E 1|+ = 1, it follows that E 2|+ ≥ 2h 2 (H 1|+ , H 2|+ ) − 1 and thus that On the other hand, and similarly H 2|+ ≤ ω 2 /p. It is easily established that the function h(x, y) is non increasing in its two arguments and thus that We can now use that p = (1 + E 1 )/2 and substitute in the inequality above, which gives (48a). Following the same lines to lower bound E 2 , one obtains (48b). Finally, it is not difficult to verify that all the intermediate inequalities in our derivation are tight and thus that any E in the region defined by (48) can be attained by points in D 1 .
The sets D x are compared in Fig. 7 to C and Q.

Implementation examples
The three experimental implementations that we presented in Subsection 2.3 can be used to certify the production of genuine randomness, as illustrated in Fig. 9. The BPSK and 2ASK implementations can generate certified randomness under the max-average assumption, while the OOK implementation requires the max-peak assumption.
Note that the BPSK correlations (6) satisfy E + = E 1 + E 2 = 0 and thus only the values of |E − | are important to determine whether they are outside of D 1 or D 1 . Fig. 10 compares the BPSK value of |E − | to the intersections of the sets D 1 and D 1 with the E − -axis as a function of the parameter ξ.
Finally, it is clear from Fig. 9 that the certification of randomness is robust to noise in the three implementations, i.e., to correlations that deviate from the ideal ones. Let us consider as an example the OOK implementation in the case where the source emits a coherent state |ξ and the photodetector has a limited efficiency η < 1. The correlations (10) then change to Figure 7: Representations of the sets C, D 1 , D 2 , and Q for ω 1 = ω 2 = 0.15. Since the quantum region is strictly larger than the individual sets D x (or even than their convex combination), it is possible to certify the production of genuine randomness. Figure 8: Comparison of the sets D 1 and D 1 , corresponding respectively to the max-average and maxpeak assumptions, for ω 1 = ω 2 = 0.15, illustrating that the latter of the two assumptions puts a stronger constraint on the behavior of the devices. The quantum set Q is also represented for comparison.
The inequality (56) characterizing the region D 1 is violated if h 2 (ω 1 , ω 2 )E 1 − E 2 > 1 − h 2 (ω 1 , ω 2 ). Inserting the above values for E 1 and E 2 and the threshold values (11) characterizing the source (which give h(ω 1 , ω 2 ) = e −|ξ| 2 /2 ), we find the condition which is satisfied provided that e −|ξ| 2 η < 1, i.e., that η > 0. In other words, the OOK implementation can generate certified randomness with arbitrarily low detection efficiency in the absence of other imperfections. The situation corresponding to η = 25% is represented in Fig. 9(c) and Fig. 9(d). Since in addition to this tolerance to detector inefficiency the OOK implementation is also very simple to implement experimentally, we will present in a forthcoming publication [25] a full theoretical analysis of a semi-DI RNG protocol based on this scheme.

Conclusion
In this paper, we introduced a new setting for semi-device-independent (semi-DI) quantum information. Contrarily to the usual approach, we do not assume bounds on the Hilbert space dimension of the carriers of quantum information, but instead on the mean values of one (or several) physical observable(s). Ideally, the choice of such an observable should be dictated by the physics of the source of quantum information carriers and rely as much as possible on a high-level characterization of its internal behavior. In quantum optics implementations, a natural choice is to upper bound the expected number of photons of the states emitted by the source or, alternatively, the energy contained in a range of frequency modes describing the system. We have completely characterized analytically the set of possible correlations in the simplest possible prepare-and-measure scenario compatible with such an assumption. We have in particular identified analogues of Bell inequalities, which are able to distinguish genuinely quantum devices from those behaving in a purely classically pre-determined fashion. We note that semi-DI prepare-and-measure scenarios that do not rely on a Hilbert space dimension bound have also been introduced in [31]. However, they rely on a bound on the average von Neumann entropy of the emitted states, a quantity which as defined in [31] requires a greater level of characterization of the source and also depends on the probability distribution p(x) used to select the preparation x.
Our approach has several interests. First of all, as with semi-DI approaches based on dimension bounds, it is of the prepare-and-measure type, and thus does not require the manipulation of entanglement. But, as with full DI approaches based on non-locality, it relies on assumptions that are physically motivated. It thus combines the practical advantages of these two different approaches.
Quite nicely, such an advantage from the implementation point of view does not come at the expense of theoretical simplicity. On the contrary, the minimal requirements on the number of inputs and outputs in our setting (x ∈ {1, 2}, y ∈ {1}, b ∈ {±1}) are smaller than those required for non-locality or dimension-bound protocols. Furthermore, in this minimal scenario, our assumptions are not only more natural than dimension bounds, but also more restrictive since they force the emitted states to have a sub-unit communication capacity.
A further point to notice is that the no-communication assumption in the non-locality scenario and the dimension-bound assumption are "yes or no" criteria (though it is also possible to introduce more refined assumptions in such contexts [14,32]). Our assumptions are instead formulated in term of parameters that can take a continuous range of possible values, e.g., as thresholds on the average photon number. As such, they naturally allow (d) Figure 9: The sets Q, C, and D 1 are displayed and compared to the correlations produced with the three implementations. The BPSK and the 2ASK protocols are analyzed with the constraints ω 1 = ω 2 = 0.15 under (a) the average-peak assumption and (b) the max-peak assumption. The OOK protocol is analyzed for two different detector efficiencies (η = 100% and η = 25%) with the constraints ω 1 = 0.51 and ω 2 = 0 under (c) the average-peak assumption and (d) the max-peak assumption. Note that when ω 2 = 0, the sets C and D 1 coincide under the max-average assumption.  Figure 10: The correlations produced with the BPSK implementation are compared to the sets D 1 and D 1 . As these correlations lie on the E − -axis (they satisfy E 1 + E 2 = 0), it is only necessary to compare the value of E − for the BPSK implementation to the intersections of the boundaries of the sets D 1 and D 1 with the E 1 -axis. This is done for different values of the parameter ξ, which determines corresponding values for ω 1 and ω 2 through (7). The range 0 ≤ ξ ≤ √ ln 2 ≈ 0.83 was chosen such that 0 ≤ ω 1 , ω 2 ≤ 0.5. This figure shows that, with the BPSK implementation, it is possible to generate correlations that produce certifiable randomness for ξ 0.55 under the max-average assumption and for ξ 0.63 under the max-peak assumption.
for the introduction of additional "margins of security" making protocols based on them more robust to device imperfections. For instance, in an implementation using a source designed to prepare states with certain average photon numbers, one could performing the analysis assuming thresholds ω corresponding to higher average photon numbers in order to allow for an additional margin for safety.
There are many potential applications of our results. First of all, note that one could reverse their interpretation. We have characterized the possible correlations E generated in a prepare-and-measure setting given upper bounds on the expectation values H of a physical observable H. But one can equally well understand these results as providing lower bounds for H given that some correlations E are observed. That is, in analogy to the concept of DI "dimension witnesses" [9,10], our results imply the existence, e.g., of DI "photon-number witnesses". It is also reasonable to expect that our results could be exploited to perform self-testing of quantum properties, namely one could probably infer that the states and measurements have a specific form if certain correlations E are observed under our assumptions.
Our main motivation at the origin of the present paper, however, is the possibility to introduce new, physically motivated semi-DI random number generation and quantum key distribution protocols. We have seen in Section 2.3 that very simple implementations of our prepare-and-measure scenario can lead to correlations that do not admit any deterministic explanation. It is in fact possible to use the characterization of the quantum set that we have obtained here to compute precise lower bounds on the randomness that is produced by such implementations as a function of the correlations E they generate. Such lower bounds can directly be combined with the analysis of [28][29][30] and then lead to explicit protocols for semi-DI random number generation protocols. We will present in detail how to compute such lower bounds on the randomness and analyze the resulting semi-DI RNG protocols under realistic experimental condition in a forthcoming publication [25], with a special focus on the OOK implementation.

Note added
The use of the On-Off Keying protocol of Fig. 3(c) in the context of semi-DI randomness generation has also been discussed by the authors of [33], although it was analyzed under different technical and security assumptions.