Device-independent randomness generation with sublinear shared quantum resources

In quantum cryptography, device-independent (DI) protocols can be certified secure without requiring assumptions about the inner workings of the devices used to perform the protocol. In order to display nonlocality, which is an essential feature in DI protocols, the device must consist of at least two separate components sharing entanglement. This raises a fundamental question: how much entanglement is needed to run such DI protocols? We present a two-device protocol for DI random number generation (DIRNG) which produces approximately $n$ bits of randomness starting from $n$ pairs of arbitrarily weakly entangled qubits. We also consider a variant of the protocol where $m$ singlet states are diluted into $n$ partially entangled states before performing the first protocol, and show that the number $m$ of singlet states need only scale sublinearly with the number $n$ of random bits produced. Operationally, this leads to a DIRNG protocol between distant laboratories that requires only a sublinear amount of quantum communication to prepare the devices.

A quantum random number generation (RNG) protocol is device-independent (DI) if its output can be guaranteed to be random with respect to any adversary on the sole basis of certain minimal assumptions, such as the validity of quantum physics and the existence of secure physical locations [1]. The internal workings of the devices, however, do not need to be trusted.
Device-independence is made possible by exploiting the violation of a Bell inequality [2], which certifies the random nature of quantum measurement outcomes. As a result, DIRNG protocols necessarily consume two fundamental resources: entangled states shared across separated devices and an initial public random seed that is uncorrelated to the devices and used to determine the random measurements performed on the entangled states. Out of these two resources, a DIRNG protocol produces n private random bits.
The initial random seed that is consumed can be of extremely low quantity or quality. Indeed, n private random bits can be produced starting from an initial string of uniform bits whose required length has gradually been reduced in a series of works [3][4][5][6], culminating in the result that only a constant, i.e., independent of the output length n, amount of initial uniform random bits are required. Furthermore, the initial seed does not necessarily need to consist of uniform random bits, as it possible to design DIRNG protocols consuming an arbitrarily weak random seed characterized only by its total min-entropy [7].
What about entanglement, the second fundamental resource that is consumed in any DIRNG protocol? This quantum resource usually consists of m copies |ψ ⊗m of some bipartite entangled state |ψ shared between two separated devices A and B that can be prevented at will from interacting with one another. Though DIRNG protocols involve a single user, it is useful for exposition purposes to view these two devices as being operated by two agents, Alice and Bob, in two remote sublaboratories. The m copies |ψ ⊗m can either be stored prior to the start of the protocol inside quantum memories in Alice's and Bob's sublaboratories, or each copy |ψ can be produced individually during each execution round of the protocol, say by a source located between Alice and Bob.
All existing protocols consume at best a linear amount m = Ω(n) of such shared entangled states |ψ , as they operate by separately measuring (in sequence or in parallel) each of these m copies, with each separate measurement yielding at most a constant amount of random bits. Furthermore, the states |ψ are typically highly entangled states-the prototypical example of a DIRNG protocol involves the measurement of n maximally entangled two-qubit states |φ + , from each of which roughly 1 bit of randomness can be certified using the CHSH inequality [3].
We will show that the consumption of entangled resources can be dramatically improved qualitatively and quantitatively. First, we show-by analogy with the fact that the initial random seed does not need to consist of uniform bits-that highly entangled states are not necessary for DIRNG: instead of using n copies of maximally entangled two-qubit pairs |φ + , n random bits can be produced from n copies of any partially entangled two-qubit pair |ψ θ = cos θ |00 + sin θ |11 with 0 < θ ≤ π/4 (see Theorem 3 and Corollary 4).
We then turn this statement concerning the quality of the shared entangled resources into a quantitative statement about the amount of entanglement that needs to be consumed in a DIRNG protocol. The n partially entangled states |ψ θ correspond to a total of nS(θ) ebits where S(θ) = h 2 (sin 2 θ) is the entropy of entanglement of |ψ θ expressed in terms of the binary entropy h 2 . Since S(θ) can be made arbitrarily low by considering sufficiently small values of θ, the above result seems to suggest that the total amount nS(θ) of entanglement consumed can also be made arbitrarily small as a function of n by considering sufficiently fast decreasing values for θ = θ(n). However, if it is true that for any given θ, one can produce n random bits from n copies of |ψ θ for any n sufficiently large, the dependency between θ and n cannot be chosen arbitrarily. This essentially originates from the fact that as θ → 0 the robustness to noise of the corresponding states |ψ θ , which become less and less entangled, decreases and must be compensated by increasing the number n of copies of the states |ψ θ to improve the estimation phase of the protocol. There is thus a tradeoff between θ and n, which we show can nevertheless result in a total amount of entanglement nS(θ) = Ω(n k log n) with 7/8 < k < 1 (see Corollary 5). This amount of entanglement is sublinear in the number n of output random bits, fundamentally improving over existing protocols for which the entanglement consumption is at best linear.
Though the protocol that we introduce consumes a sublinear amount of entanglement, it still requires a linear number of shared quantum resources in the form of n copies of the twoqubit entangled states |ψ θ . These shared entangled states must be established through some quantum communication between Alice's and Bob's sublaboratories, either during the protocol itself or prior to the protocol, and will thus require the exchange of n qubits. Since this quantum communication will typically be costly (for instance because of high losses in the communication channel), it represents a measure of the use of shared quantum resources which is more operational and better motivated than the entropy of entanglement. From this perspective, however, our first protocol is not fundamentally different from existing protocols that also involve the exchange of n qubits to produce n random bits.
This leads us to consider a slight modification of our protocol in which Alice and Bob initially share m maximally entangled two-qubit states |φ + , which can be established through the exchange of m qubits. These singlets are then transformed by entanglement dilution [8] into roughly n = S(θ)/m copies of |ψ θ states through local operations and classical communication (LOCC), which are then used in our regular protocol. Even though entanglement dilution is inherently noisy and slightly degrades the tradeoff between θ and n, we show that we can get n output random bits starting from a sublinear number m = nS(θ) = Ω(n k log n) of initial copies of |φ + states, with 7/8 < k < 1. This represents a quantitative improvement of the use of quantum resources with respect to all existing protocols, analogous to the fact that a DIRNG protocol needs only a sublinear amount of uniform random bits.
The starting point of our analysis are the results of [9], wherein a family of variants of the CHSH inequality, the tilted-CHSH inequalities, are introduced, which seem particularly suited to certify randomness from weakly entangled qubit states. We start by recalling these results.
It is easily seen that the expected winning probability ω for this game is linked to the expectation valueĪ β 1 of the tilted-CHSH expression through where p(a, b | x, y) are the probabilities characterizing Alice and Bob's outputs. The winning probability ω goes up to 1/2 + (2 + β)/(8 + 2β) for classical devices, and 1/2 + 8 + 2β 2 /(8 + 2β) = ω q for quantum devices [9]. This quantum value ω q is uniquely achieved (up to local transformations) by a pair of devices implementing certain local measurements on a twoqubit partially entangled state |ψ θ = cos θ |00 + sin θ |11 with tan(2θ) = 2/β 2 − 1/2 [9]. We call this optimal pair of devices the reference devices for the tilted-CHSH game of tilting parameter β. In the following we will sometimes use θ as the game parameter instead of β; it is always understood that they are linked by the above relation.
One important feature of the reference devices, as highlighted in [9], is that, for any 0 < θ ≤ π/4, Alice's measurement when x = 1 returns a uniformly distributed outcome a ∈ {0, 1} uncorrelated with the environment, i.e., one bit of ideal randomness. Thus by separately measuring n copies of the partially entangled state |ψ θ = cos θ |00 +sin θ |11 according to the reference measurements, one could in principle generate n bits of randomness for any 0 < θ ≤ π/4. However, the results of [9] do not immediately imply this claim because they only apply to a single use of a quantum system that is known to achieve the maximal winning probability ω q of the tilted-CHSH game. Thus one should first embed the tilted-CHSH game in a proper DIRNG protocol in which no assumptions are made beforehand about the quantum systems, but where the amount of randomness generated is instead estimated from their observed behavior. This requires in particular a robust version of the results of [9], i.e., an assessment of the randomness produced by quantum devices achieving a suboptimal winning probability ω < ω q . Indeed, even ideal devices are not expected to achieve the quantum maximum when they are used a finite number n of times because of inherent statistical noise. We now address this by introducing an explicit DIRNG protocol based on the tilted-CHSH inequalities and a robust security analysis based on the entropy accumulation theorem (EAT) [10,11] and the self-testing properties of the tilted-CHSH inequalities introduced in [12].
DIRNG protocol based on the tilted-CHSH game. Our protocol consists of the following steps: 1. Select values for the following parameters: • The game parameter β ∈ [0, 2); • The number of measurement rounds n; • The expected fraction of test rounds γ; perform a game round: measure the devices with settings (X i , Y i ), selected at random according to the distribution given in (1), record the output (A i , B i ) and compute (2). If T i = 0, perform a generation round: measure the devices with 3. Repeat step 2 for i = 2, . . . , n. 4. Finally, if i:C i =1 1 ≥ nγ(ω q − ξ), the protocol succeeds. Otherwise, it aborts.
An immediate application of Hoeffding's inequality [13] produces an upper bound on the completeness error for this protocol, that is, the probability that the ideal devices fail the protocol: Using the reference devices in the n rounds, the completeness error for the protocol is bounded by Soundness of the protocol. We now establish the soundness of our protocol, that is, its ability to produce a positive amount of randomness with high probability given that the protocol did not abort. The security of this protocol rests on three standard assumptions in the DI setting: that the devices and their environment obey the laws of quantum mechanics, that the random seed used to select inputs is independent from the devices, and that the two devices are unable to communicate during each round of the protocol. Our analysis is based on the entropy accumulation theorem (EAT) [10] following closely its application to DIRNG in [11].
The EAT, as its name indicates, provides an estimate of the smooth min-entropy accumulated throughout a sequence of measurements. It implies that the smooth min-entropy of the joint measurement outcomes of our protocol scales linearly with the number of rounds, with each round providing on average an amount of min-entropy roughly equivalent to the von Neumann entropy of a single round's outcome. In order to use the EAT, it is first necessary to bound this single-round von Neumann entropy as a function of the expected probability of success ω in the tilted-CHSH game. The following Lemma, which we derive in Appendix A from the robust self-testing bounds for the tilted-CHSH inequality [12], provides a bound on the conditional min-entropy, which in turn bounds the conditional von Neumann entropy: Let ω be the expected winning probability for the tilted-CHSH game with parameter β of a pair of quantum devices, whose internal degrees of freedom can be entangled with the environment E. Then the conditional min-entropy of the measurement outcome A for input X = 1 is bounded as The behavior of the bound with respect to ω q − ω is optimal [14], while numerical results suggest that the optimal dependency in θ is O(θ −2 ) [15]. This will not, however, significantly affect our conclusions.
Using this bound in the EAT along the lines of [11] (see Appendix B) yields the following theorem: where ν = 1 − γ(2 + β)/(4 + β), and H s min (AB | XYTE; S) is the s -smooth min-entropy of the output (A, B) given X, Y, T, E and conditioned on the event S.
Given such a bound on the smooth min-entropy, there exist efficient procedures to extract from the raw outputs of the protocol a string of close-to-uniform random bits whose length is of the order of H s min , with the smoothing parameter s characterizing the closeness to the uniform distribution.
Random bits from any partially entangled two-qubit state. Theorem 3 directly implies the following corollary, which shows the possibility of generating one bit of randomness per arbitrarily weakly entangled qubit pair: Corollary 4. For any constant values of the protocol parameters θ, ξ, and γ such that κθ −4 √ ξ < 1 and for sufficiently large n, the protocol has vanishing completeness error and it generates Ω(n) bits of randomness from n partially entangled states |ψ θ . For ξ and γ approaching 0, the production of randomness in the protocol is asymptotically equal to n.
Sublinear entanglement consumption. We now consider how, in an ideal implementation of our protocol, the amount of shared entanglement consumed is related to the amount of randomness produced. For given n, the entanglement consumption obviously decreases with smaller values of θ. According to (6) and (7), the randomness produced, however, also decreases with smaller θ, unless this decrease is compensated by a suitable choice of the parameters ξ and γ. But these latter parameters also appear in the completeness error (11) and thus cannot be set completely freely if this error is to remain small. In the following corollary to Theorem 3, we show that there exists a choice for the parameters θ, ξ, and γ, expressed as functions of n, such that the consumption of ebits m is sublinear in the number of rounds n: Corollary 5. Let λ ξ , λ γ , λ θ be positive scaling parameters such that λ ξ + λ γ < 1/2 and λ θ < 2λ ξ . Let θ = n −λ θ /16 , ξ = n −λ ξ , γ = n −λ γ , and constant s and . Then, for n → ∞, the entropy bound of Theorem 3 is asymptotically equal to n, the completeness error vanishes, and the amount of entanglement consumed is sublinear: with k = 1 − λ θ /8 ∈ (7/8, 1).
Using diluted singlets. As mentioned in the introduction, the use of partially entangled states for randomness expansion enables us to reduce the amount of qubits exchanged between the devices when preparing their shared entanglement. We reach this goal by applying our protocol to the outcome of an entanglement dilution procedure, which transforms m singlet states |φ + to n m/S(θ) partially entangled states |ψ θ . Thus, only m qubits need to be transferred between the devices in order to prepare the initial state |φ + ⊗m .
We use the procedure of Bennett et al. [8], in which Alice prepares the n pairs locally, processes Bob's share with Schumacher compression then teleports them to Bob using the m singlets, who expands them back to n qubits. Since Schumacher compression is a lossy operation, the resulting state shared by Alice and Bob, which we denote as D θ,δ (|φ + φ + | ⊗m ) is not exactly |ψ θ ⊗n , but it is close in trace distance (with ρ 1 = Tr| ρ|): Lemma 6. Using perfect devices, This lemma mostly follows from [8,16]; we prove it in Appendix C.
It follows from Lemma 6 that even a perfectly implemented dilution procedure introduces some noise in the protocol. We thus need to derive a new statement for the completeness error, the probability that perfect devices fails the protocol. Using the indistinguishability interpretation of the trace distance, if the reference state |ψ θ ⊗n passes the threshold of the protocol with probability 1 − , the diluted state D θ,δ (|φ + φ + | ⊗m ), which is prep -close to the reference, will pass the same threshold with probability at least 1 − − 1 2 prep [16]. Using the value of given in Lemma 1 immediately implies the following: Lemma 7. Starting from m perfect singlets, the composition of the dilution procedure D θ,δ and the randomness generation protocol has its completeness error bounded by The following analogue of Corollary 5 applies to the composition of entanglement dilution and randomness expansion; it immediately follows from the chosen parameterization: Corollary 8. Let δ = S(θ)c with c = n λ c /8 for some real parameter λ c . Let the parameters of the protocol be set as in Corollary 5, with the additional constraint 0 < λ c < λ θ . Starting from m singlets, the composition of entanglement dilution with parameters δ and θ with the randomness expansion protocol yields an entropy bound in Theorem 3 which is asymptotically equal to n for n → ∞, with a vanishing completeness error, and a sublinear consumption of entanglement: m = n (S(θ) + δ) ∼ n 1+λ c /8 θ 2 log 2 θ −2 = λ θ 8 n k log 2 n , (12) with k = 1 − (λ θ − λ c )/8 ∈ (7/8, 1).
Noise robustness. While we have shown above that the inherent noise associated to dilution is tolerated by our protocol, we implicitly assumed that the quantum devices themselves are noise-free. Indeed the completeness error given by Eq. (4) is evaluated assuming quantum devices with an expected winning probability equal to the quantum maximum ω q . If the quantum devices are noisy, for example due to faulty measurements, and have instead a suboptimal winning probability ω = ω q − ζ, then the completeness error becomes It is easy to see that a sublinear entanglement consumption remains possible with such noisy devices, provided the noise parameter ζ decreases with n as ζ = n −λ ζ for some suitable scaling parameter λ ζ . However, realistic devices will be subject to a constant amount of noise, rather than an asymptotically vanishing one. In this case, the protocol as described so far breaks down. This is most easily seen from Lemma 2: it is clear that θ can only be taken as low as values of the order of (ω q − ω) 1/8 = ζ 1/8 to get a non-trivial bound on the minentropy. Nevertheless, given a small enough finite upper bound on the amount of noise ζ, partially entangled qubit pairs with an appropriate value of θ < π/4 can still be used to produce a linear amount of randomness with a yield per ebit higher than 1 according to Theorem 3, thus improving what can directly be achieved using maximally entangled states. A sublinear consumption of entanglement using diluted singlets can be recovered even with devices whose components fail with constant probability if our protocol is combined with error correction and fault-tolerant quantum computation. Indeed, according to the threshold theorem for fault-tolerant quantum computation, an arbitrary quantum circuit containing G(n) gates may be simulated with probability of error e(n) on hardware whose components fail with constant probability at most p, provided p is below some threshold, through an encoding that increases the local dimension of each qubit by a factor poly log G(n)/e(n) [17]. In our case, the number G(n) of gates needed to perform entanglement dilution [18] and the subsequent bipartite measurements is polynomial in n. On the other hand, aiming for a probability of error e(n) that decreases polynomially in n for the simulating circuit yields a completeness error that vanishes asymptotically. The number of ebits needed in such a fault-tolerant version of our protocol is then multiplied only by a factor poly log G(n)/e(n) = poly log n resulting in a total number of ebits that is still sublinear in n, i.e., m ∼ n k poly log n.
Discussion. We showed that the consumption of entangled resources in DIRNG can be dramatically improved qualitatively and quantitatively with respect to existing protocols. Our results about entanglement are analogous to those concerning the initial random seed, the other fundamental resource required in DIRNG. In the present work, we did not attempt to minimize simultaneously the entanglement and the size of the initial seed. (Note that in our protocol, the size of the initial random seed is determined by the parameter γ specifying the proportion of test rounds.) Nevertheless, in the parameter regimes of Corollaries 5 and 8, the entanglement and the initial seed are both sublinear. Interestingly, it appears that our approach involves a tradeoff between entanglement and seed consumption, given the constraints placed on λ γ and λ θ in Corollaries 5 and 8. In Corollary 5, if λ θ is close to 1 (corresponding to a small consumption of entanglement), λ γ must be close to 0, which indicates a high proportion γ of test rounds and, as a result, high consumption of random seed. Likewise, if λ γ is close to 1/2, λ θ must be close to 0, and the protocol requires high entanglement and low random seed. We leave as open questions whether there is some kind of fundamental trade-off between the required amounts of random seed and shared quantum resources, and whether the amount of quantum resources in our protocol is optimal or can be further decreased.

Appendix A: Proof of Lemma 2
Lemma 2 gives a lower bound on the conditional min-entropy in the outcome of Alice's measurement x = 1 for devices which achieve a certain success probability ω in the tilted-CHSH game of parameter β.
To derive this bound, we use our self-testing result for the tilted-CHSH inequalities [12]. The robustness bounds for the self-test in [12] are rather unwieldy, so we will instead provide a crude upper bound that retains the same asymptotic behavior in β and ω and greatly simplifies the use of the bound.
We will lower-bound H min (A | E; X = 1) as a function of the expected violation of the tilted-CHSH inequality, I = I q − , where I q = 8 + 2β 2 = 4/ √ 1 + sin 2 2θ is the maximal quantum value of the expression. This min-entropy is equivalent to the guessing probability for the measurement X = 1, which is defined as where {M g } is a POVM on the subsystem E, which an adversary would use to measure the side information contained in E to formulate a guess G for A [19]. Formulated in terms of a given physical state |ψ ABE and observablesÃ x ≡Ã x ⊗ I B ⊗ I E and B y ≡ I A ⊗B y ⊗ I E , for a given adversary POVM {M g } we have letting C = M 0 − M 1 , which is bounded as C ∞ ≤ 1. (From here on we will sometimes use a shorter notation where instead of e.g. I A ⊗ I B ⊗ C, we simply write C.) We will now relate this expression to the reference system using self-testing.
Using the notation of [12], the self-testing result shows that any pure state |ψ ABE measured byÃ x andB y in such a way that the tilted-CHSH inequality for these observables is violated up to I q − obeys1 where Φ = Φ A ⊗ Φ B ⊗ I E is a local isometry acting on Alice and Bob's subsystems which introduces and transforms ancillary qubits A and B , |ψ θ is the reference state (see main text), A 1 is the reference observable that yields one bit of randomness, and the error bound parametersδ, δ A a = O( √ θ −4 ) are explicitly defined in [12]. Effectively, this isometric transformation extracts a state onto A B which is close to a copy of the reference state and almost decorrelated from the initial system ABE. Likewise, the isometry approximately maps the physical observables' action on the physical state in AB to ideal actions on the reference state in the ancillary registers A B . From this result, we see that the guessing probability with respect to |ψ (which is by isometry identical to the guessing probability for Φ(|ψ )) is close to the guessing probability with respect to the reference state, for which p guess = max a Pr[A = a | X = 1] = 1/2 since the side information E is decorrelated from the devices A and B.
To show this approximate equality of guessing probabilities, we rewrite the last term of (A3) as using that Φ is an isometry which acts like the identity on E. We then use (A4) and the triangle inequality to transform this into ψ θ | A 1 |ψ θ junk|C|junk , with additional error terms. First, we replace Φ(Ã 1 |ψ ) with A 1 |ψ θ ⊗ |junk with an additional error term 2δ + 2δ A a since Φ † ( ψ |) C ≤ 1, then we replace Φ † ( ψ |), again using A 1 ∞ , C ∞ ≤ 1: This last inequality is generally saturated by one of C ∈ {±I}, which corresponds to the adversary making a constant guess for the ideal system's most likely outcome.2 Since for the reference system ψ θ | A 1 |ψ θ = 0, we find that We now proceed to find a simple expression of and θ that upper-bounds 2δ + δ A a . After some careful manipulation of the rather long expressions forδ and δ A a , we find with c = cos(2θ), s = sin(2θ), I q = 4/ √ 1 + s 2 . The dominating term in this bound for small θ comes from the term in s −4 , namely A crude upper bound on (A10) is obtained by taking a s −4 factor out of the square brackets and giving rough numerical bounds on the bounded function that remains. For instance, the factor of s −4 2I q √ in the first term becomes We obtain the following bound: where we have also bounded I q ≤ 4 and used the following tight bounds after expanding the third term in the square brackets of (A10): The factor tan θ in the last term is simply bounded by 1. The bound we reach is the following: Finally, the polynomial in s in square brackets is bounded by its maximum at s = 1. Eq. (A9) then becomes Further bounding by concavity of the sine function on [0, π/2] and substituting = (8 + 2β)(ω q − ω), we reach our final bound for the guessing probability, Putting this together with (A1), we find, using ln(1 + x) ≤ x, Secondly, in contrast to this first property, the typical set has a relatively low cardinality: the number of typical sequences is exponentially small compared to the total number of sequences. Indeed, from the definition (C1), |T δ | = 2 n(S+δ) y ∈T δ 2 −n(S+δ) (C9) ≤ 2 n(S+δ) y ∈T δ P(y) ≤ 2 n(S+δ) , which is smaller than the total number of 2 n sequences if S < 1 − δ. Source coding consists in discarding atypical sequences, which occur with low probability, and encoding typical sequences into smaller codewords. This encoding is possible because of the small cardinality of the typical set: a sequence can simply be encoded by its index within a given ordering of the elements of the typical set, which gives codewords a length of at most log 2 |T δ | ≤ n(S + δ) = m.
Schumacher compression applies this procedure to the quantum state ρ A = 2 n −1 y=0 λ n(0 |y) |y y|, which describes the output of a quantum source of pure states |y with probabilities λ n(0 |y) . In order to identify an atypical state, a projective typicality measurement is performed, with projectors {Π δ , I − Π δ } where If the typicality measurement succeeds, the state ends up in the typical subspace spanned by {|y : y ∈ T δ }, and can be encoded in a 2 m -dimensional Hilbert space by an invertible isometric map V. If instead the measurement fails, a given typical state σ is substituted and encoded the same way. The resulting state is therefore S(ρ A ) = V[Π δ ρ A Π δ + (1 − Tr(Π δ ρ A ))σ]V † . The two properties (C7) and (C10) of the typical set can be expressed in terms of the typical projector Π δ : Tr(Π δ ) ≤ 2 n(S+δ) .
The first property can be used in the gentle operator lemma [23,24] to show that a successful typicality measurement does not disturb the state by much [16]: Hence, the decompressed state is close in trace distance to the original [16]: As Schumacher originally noted [21], this remains true when we consider the global state in AA ; the entanglement of the state is therefore not destroyed by compression: (I ⊗ V † )(Id ⊗S)[|ψ θ ψ θ | ⊗n ](I ⊗ V) − |ψ θ ψ θ | ⊗n Thus, defining D δ,θ (|φ + φ + | ⊗m A B ) to be the outcome of the composition of a local preparation of |ψ θ ψ θ | ⊗n AA , followed by Schumacher compression over δ-typical sequences of A , teleportation from A to B using |φ + φ + | ⊗m AB and decompression on B, Lemma 6 follows.