Mutually unbiased bases and symmetric informationally complete measurements in Bell experiments

Armin Tavakoli,1 Máté Farkas,2, 3 Denis Rosset,4 Jean-Daniel Bancal,1 and J˛edrzejKaniewski5 1Department of Applied Physics, University of Geneva, 1211 Geneva, Switzerland 2Institute of Theoretical Physics and Astrophysics, National Quantum Information Centre, Faculty of Mathematics, Physics and Informatics, University of Gdansk, 80-952 Gdansk, Poland 3International Centre for Theory of Quantum Technologies, University of Gdansk, 80-308 Gdansk, Poland 4Perimeter Institute for Theoretical Physics, 31 Caroline St. N, Waterloo, Ontario, N2L 2Y5, Canada 5Faculty of Physics, University of Warsaw, Pasteura 5, 02-093 Warsaw, Poland (Dated: October 21, 2020) Mutually unbiased bases (MUBs) and symmetric informationally complete projectors (SICs) are crucial to many conceptual and practical aspects of quantum theory. Here, we develop their role in quantum nonlocality by: i) introducing families of Bell inequalities that are maximally violated by d-dimensional MUBs and SICs respectively, ii) proving device-independent certification of natural operational notions of MUBs and SICs, and iii) using MUBs and SICs to develop optimal-rate and nearly optimal-rate protocols for device independent quantum key distribution and device-independent quantum random number generation respectively. Moreover, we also present the first example of an extremal point of the quantum set of correlations which admits physically inequivalent quantum realisations. Our results elaborately demonstrate the foundational and practical relevance of the two most important discrete Hilbert space structures to the field of quantum nonlocality.

One-sentence summary — Quantum nonlocality is de- a single measurement. Since MUBs and SICs are both con- veloped based on the two most celebrated discrete struc- ceptually natural, elegant and (as it turns out) practically im- tures in quantum theory. portant classes of measurements, they are often studied in the same context [9–14]. Let us briefly review their importance to foundational and applied aspects of quantum theory. I. INTRODUCTION MUBs are central to the concept of complementarity in quantum theory i.e. how the knowledge of one quantity Measurements are crucial and compelling processes at the limits (or erases) the knowledge of another quantity (see heart of quantum physics. Quantum measurements, in their e.g. Ref. [15] for a review of MUBs). This is often high- diverse shapes and forms, constitute the bridge between the lighted through variants of the famous Stern–Gerlach exper- abstract formulation of quantum theory and concrete data pro- iment in which different Pauli observables are applied to a duced in laboratories. Crucially, the quantum formalism of qubit. For instance, after first measuring (say) σx, we know measurement processes gives rise to experimental statistics whether our system points up or down the x-axis. If we then that elude classical models. Therefore, appropriate measure- measure σz, our knowledge of the outcome of yet another σx ments are indispensible for harvesting and revealing quantum measurement is entirely erased since σz and σx are MUBs. phenomena. Sophisticated manipulation of quantum measure- This phenomenon leads to a inherent uncertainty for the out- ments is both at the heart of the most well-known features of comes of MUB measurements on all quantum states, which quantum theory such as contextuality [1] and the violation of can be formalised in terms of entropic quantities, leading to Bell inequalities [2] as well as its most groundbreaking appli- so-called entropic uncertainty relations. It is then natural that cations such as quantum cryptography [3] and quantum com- MUBs give rise to the strongest entropic uncertainties in quan- putation [4]. In the broad landscape of quantum measure- tum theory [16]. Moreover, MUBs play a prominent role in ments [5], certain classes of measurements are outstanding quantum cryptography, where they are employed in many of due to their breadth of relevance in foundations of quantum the most well-known quantum key distribution protocols [17–

arXiv:1912.03225v2 [quant-ph] 20 Oct 2020 theory and applications in quantum information processing. 21] as well as in secret sharing protocols [22–24]. Their ap- Two widely celebrated, intensively studied and broadly use- peal to cryptography stems from the idea that eavesdroppers ful classes of measurements are known as mutually unbiased who measure an eigenstate of one basis in another basis unbi- bases (MUBs) and symmetric informationally complete mea- ased to it obtain no useful information, while they also induce surements (SICs). Two measurements are said to be mutually a large disturbance in the state which allows their presence to unbiased if by preparing any eigenstate of the first measure- be detected. Furthermore, complete (i.e. largest possible in ment and then performing the second measurement, one finds a given dimension) sets of MUBs are tomographically com- that all outcomes are equally likely [6]. A typical example of plete and their symmetric properties make them pivotal for MUBs corresponds to measuring two perpendicular compo- quantum state tomography [25, 26]. In addition, MUBs are nents of the polarisation of a photon. A SIC is a quantum mea- useful for a range of other problems such as quantum random surement with the largest number of possible outcomes such access coding [27–31], quantum error correction [32, 33] and that all measurement operators have equal magnitude overlaps entanglement detection [34]. This broad scope of relevance [7,8]. Thus, the former is a relationship between two differ- has motivated much efforts towards determining the largest ent measurements whereas the latter is a relationship within number of MUBs that exist in general Hilbert space dimen- 2 sions [15]. two results of this type have been proven: (a) a triple of MUBs The motivations behind the study of SICs are quite simi- in dimension three [59] and (b) the measurements conjectured lar to the ones discussed for MUBs. It has been shown that to be optimal for the Collins–Gisin–Linden–Massar–Popescu SICs are natural measurements for quantum state tomogra- Bell inequality [60] (the former is a single result, while the lat- phy [35], which has also prompted several experimental real- ter is a family parameterised by the dimension d ≥ 2). None isations of SICs [36–38]. Also, some protocols for quantum of these results can be used to certify MUBs in dimension key distribution derive their success directly from the defin- d ≥ 4. ing properties of SICs [39, 40], which have also been exper- imentally demonstrated [41]. Furthermore, a key property of SICs is that they have the largest number of outcomes possi- Since mutual unbiasedness and symmetric informational ble while still being extremal measurements i.e. they cannot completeness are natural and broadly important concepts in be simulated by stochastically implementing other measure- quantum theory, they are prime candidates of interest for such ments. This gives SICs a central role in a range of applica- certification in general Hilbert space dimensions. This chal- tions which include random number generation from entan- lenge is increasingly relevant due to the broader experimental gled qubits [42], certification of non-projective measurements advances towards high-dimensional systems along the fron- [43–46], semi-device-independent self-testing [45] and entan- tier of quantum information theory. This is also reflected in glement detection [47, 48]. Moreover, SICs have a key role in the fact that recent experimental implementations of MUBs quantum Bayesianism [49] and they exhibit interesting con- and SICs can go well beyond the few lowest Hilbert space nections to several areas of mathematics, for instance Lie and dimensions [38, 41, 61]. Jordan algebras [50] and algebraic number theory [51]. Due to their broad interest, much research effort has been directed towards proving the existence of SICs in all Hilbert space di- Focusing on mutual unbiasedness and symmetric informa- mensions (presently known, at least, up to dimension 121) tional completeness, we solve the above challenges. To this [7,8, 52, 53]. See e.g. Ref. [54] for a recent review of SICs. end, we first construct Bell inequalities that are maximally In this work, we broadly investigate MUBs and SICs in violated using a maximally entangled state of local dimen- the context of Bell nonlocality experiments. In these experi- sion d and, respectively, a pair of d-dimensional MUBs and ments, two separated observers perform measurements on en- a d-dimensional SIC. In the case of MUBs, we show that the tangled quantum systems which can produce nonlocal corre- maximal quantum violation of the proposed Bell inequality lations that elude any local hidden variable model [55]. In device-independently certifies that the measurements satisfy recent years, Bell inequalities have played a key role in the an operational definition of mutual unbiasedness, and also that rise of device-independent quantum information processing the shared state is essentially a maximally entangled state of where they are used to certify properties of quantum systems. local dimension d. Similarly, in the case of SICs, we find Naturally, certification of a physical property can be achieved that the maximal quantum violation device-independently cer- under different assumptions of varying strength. Device- tifies that the measurements satisfy an analogous operational independent approaches offer the strongest form of certifi- definition of symmetric informational completeness. More- cation since the only assumptions made are space-like sep- over, we also show that our Bell inequalities are useful in two aration and the validity of quantum theory. The advent of practically relevant tasks. For the case of MUBs, we con- device-independent quantum information processing has re- sider a scheme for device-independent quantum key distribu- vived interest in Bell inequalities as these can now be tailored tion and prove a key rate of log d bits, which is optimal for to the purpose of certifying useful resources for quantum in- any protocol that extracts key from a d-outcome measurement. formation processing. The primary focus of such certification For SICs, we construct a scheme for device-independent ran- has been on various types of entangled states [56]. However, dom number generation. For two-dimensional SICs, we ob- quantum measurements are equally important building blocks tain the largest amount of randomness possible for any proto- for quantum information processing. Nevertheless, our un- col based on qubits. For three-dimensional SICs, we obtain derstanding of which arrangements of high-dimensional mea- more randomness than can be obtained in any protocol based surements can be certified in a device-independent manner is on projective measurements and quantum systems of dimen- highly limited.1 The simplest approach relies on combining sion up to seven. For low dimensions, we numerically show known self-testing results for two-qubit systems, which allows that both protocols are robust to noise, which is imperative to us to certify high-dimensional measurements constructed out any experiment. The implementation of these two protocols of qubit building blocks [57, 58]. Alternatively, device- involves performing a Bell-type experiment, estimating the independent certification of high-dimensional structures can outcome statistics and computing the resulting Bell inequal- be proven from scratch, but to the best of our knowledge only ity violation. The efficiency and security of the protocol is then deduced only from the observed Bell inequality viola- tion, i.e. it does not require a complete characteristion of the devices. Device-independent protocols can in principle be im- 1 We speak of arrangements of measurements because for a single measure- ment (acting on a quantum system with no internal structure) no interesting plemented on any experimental platform suitable for Bell non- property can be certified. The task becomes non-trivial when at least two locality experiments, such as entangled spins [62], entangled measurements are present and we can certify the relation between them. photons [63, 64] and entangled atoms [65]. 3

or lost. If she outputs a ∈ {1, 2}, points will be won or lost if b = xy. More specifically, Alice and Bob win a point if a = y and lose a point if a =y ¯, where the bar-sign flips the value of y ∈ {1, 2}. This leads to the score

MUB X Rd ≡ p(a = y, b = xy|x, y) − p(a =y, ¯ b = xy|x, y), x,y (2) 2 where the sum goes over x = x1x2 ∈ [d] and y ∈ {1, 2}. At this point the outcome a =⊥ might seem artificial, so let FIG. 1: Bell scenario for two MUBs of dimension d. Alice receives 2 us show why it plays a crucial role in the construction of the one of d inputs and produces a ternary output while Bob receives a game. To this end, we use intuition based on the hypotheti- d binary input and produces a -valued output. cal case in which Alice and Bob share a maximally entangled state II. BELL INEQUALITIES FOR MUTUALLY UNBIASED d max 1 X BASES |ψd i = √ |k, ki. (3) d k=1 The task of finding Bell inequalities which are maximally The reason we consider the maximally entangled state is that violated by mutually unbiased bases for d ≥ 3 has been at- we aim to tailor the Bell inequalities so that this state is opti- tempted several times [66–69] but with limited success. The mal. Then, we would like to ensure that Alice, via her mea- only convincing candidate is the inequality corresponding to surement and for her outcomes a ∈ {1, 2}, remotely prepares d = 3 studied in Ref. [66] and even then there is only numer- Bob in a pure state. This would allow Bob to create stronger ical evidence (no analytical proof is known). Some progress correlations as compared to the case of Alice remotely prepar- has been made in Ref. [59], which considers the case of prime ing his system is a mixed state. Hence, this corresponds to Al- d and proposes a family of Bell inequalities maximally vio- ice’s outcomes a ∈ {1, 2} being represented by rank-one pro- lated by a specific set of d MUBs in dimension d. These in- max jectors. Since the subsystems of |ψd i are maximally mixed, equalities, however, have two drawbacks: (a) there is no gen- it follows that p(a = 1|x) = p(a = 2|x) = 1/d ∀x. Thus, eralisation to the case of non-prime d and (b) even for the case we want to motivate Alice to employ a strategy in which she of prime d we have no characterisation of the quantum reali- outputs a =⊥ with probability p(a =⊥ |x) = 1 − 2/d. Our sations that achieve the maximal violation. tool for this purpose is to introduce a penalty. Specifically, In this work we present a family of Bell inequalities in whenever Alice decides to output a ∈ {1, 2}, she is penalised which the maximal quantum violation is achieved with a max- by losing γd points. Thus, the total score (the Bell functional) imally entangled state and any pair of d-dimensional MUBs. reads These Bell inequalities have been constructed so that their MUB MUB X
maximal quantum violation can be computed analytically Sd ≡ Rd − γd p(a = 1|x) + p(a = 2|x) . (4) which then enables us to obtain a detailed characterisation of x the optimal realisations. As a result we discover a new, inter- Now, outputting a ∈ {1, 2} contributes towards RMUB but mediate form of device-independent certification. d also causes a penalty γ . Therefore, we expect to see a trade- We formally define a pair of MUBs as two orthonormal d off between γ and the rate at which Alice outputs a =⊥. We bases on a d-dimensional Hilbert space d, namely {|e i}d d C j j=1 must suitably choose γ such that Alice’s best strategy is to d d and {|fki}k=1, with the property that output a =⊥ with (on average over x) the desired probability p(a =⊥ |x) = 1 − 2/d. This accounts for the intuition that 1 |he |f i|2 = (1) leads us to the following Bell inequalities for MUBs. j k d Theorem II.1 (Bell inequalities for MUBs). The Bell func- for all j and k. The constant on the right-hand-side is merely MUB tional Sd in Eq. (4) with a consequence of the two bases being normalised. To this end, r consider a bipartite Bell scenario parameterised by an integer 1 d − 1 2 γ = , (5) d ≥ 2. Alice randomly receives one of d possible inputs la- d 2 d 2 belled by x ≡ x1x2 ∈ [d] (where [s] ≡ {1, . . . , s}) and pro- duces a ternary output labelled by a ∈ {1, 2, ⊥}. Bob receives obeys the tight local bound a random binary input labelled by y ∈ {1, 2} and produces a r ! LHV 1 d − 1 d-valued output labelled by b ∈ [d]. The joint probability dis- SMUB ≤ 2 (d − 1) 1 − , (6) tribution in the Bell scenario is denoted by p(a, b|x, y) and the d 2 d scenario is illustrated in Figure1. To make our choice of Bell functional transparent, we will and the quantum bound phrase it as a game in which Alice and Bob collectively win Q MUB p or lose points. If Alice outputs a =⊥, no points will be won Sd ≤ d (d − 1). (7) 4

Moreover, the quantum bound can be saturated by sharing a inequality test. We now turn to the converse matter, namely maximally entangled state of local dimension d and Bob per- that of device-independent certification. Specifically, given forming measurements in any two mutually unbiased bases. that we observe the maximal quantum violation, i.e. equality in Eq. (7), what can be said about the shared state and the Proof. A complete proof is presented in Supplementary Ma- measurements? Since the measurement operators can only be terial (SM, section I.A). The essential ingredient to obtain the characterised on the support of the state, to simplify the no- bound in Eq. (7) is the Cauchy–Schwarz inequality. Further- tation let us assume that the marginal states of Alice and Bob more, for local models, by inspecting the symmetries of the are full-rank.2 MUB Bell functional Sd , one finds that the local bound can be attained by Bob always outputting b = 1. This greatly simpli- Theorem III.1 (Device-independent certification). The max- MUB fies the evaluation of the bound in Eq. (6). imal quantum value of the Bell functional Sd in Eq. (4) To see that the bound in Eq. (7) can be saturated in quan- implies that tum theory, let us evaluate the Bell functional for a particular |ψi {P }d • There exist local isometries which allow Alice and Bob quantum realisation. Let be the shared state, x1 x1=1 d to extract a maximally entangled state of local dimen- and {Qx } be the measurement operators of Bob cor- 2 x2=1 sion d. responding to y = 1 and y = 2 respectively and Ax be the observable of Alice defined as the difference between Al- • If the marginal state of Bob is full-rank, the two d- ice’s outcome-one and outcome-two measurement operators, outcome measurements he performs satisfy the relations 1 2 i.e. Ax = Ax − Ax. Then, the Bell functional reads Pa = dPaQbPa and Qb = dQbPaQb, (9) MUB X 1 2
Sd = hψ|Ax ⊗ (Px1 − Qx2 ) − γd Ax + Ax ⊗ 11|ψi. x for all a and b. (8) Proof. The proof is detailed in SM (section I.A). Here, we Now, we choose the maximally entangled state of local dimen- briefly summarise the part concerning Bob’s measurements. max Since the Cauchy–Schwarz inequality is the main tool for sion d, i.e. |ψi = |ψd i, and define Bob’s measurements as proving the quantum bound in Eq. (7), saturating it implies rank-one projectors Px1 = |φx1 ihφx1 | and Qx2 = |ϕx2 ihϕx2 | 2 that also the Cauchy–Schwarz inequality is saturated. This al- which correspond to MUBs, i.e. |hφx1 |ϕx2 i| = 1/d. Finally, p lows us to deduce that the measurements of Bob are projective we choose Alice’s observables as Ax = d/(d − 1)(Px1 − T and moreover we obtain the following optimality condition: Qx2 ) , where the pre-factor ensures the correct normalisation and T denotes the transpose in the standard basis. Note that r d Ax is a rank-two operator; the corresponding measurement Ax ⊗ 11|ψi = 11 ⊗ (Px − Qx ) |ψi, (10) 1 2 d − 1 1 2 operator Ax (Ax) is a rank-one projector onto the eigenvector of Ax associated to the positive (negative) eigenvalue. Since p max for all x1, x2 ∈ [d] where the factor d/(d − 1) can be re- the subsystems of |ψd i are maximally mixed, this implies max 1 2 max garded as a normalisation. Since we do not attempt to certify hψd |(Ax + Ax) ⊗ 11|ψd i = 2/d. Inserting all this into the above quantum model and exploiting the fact that for any the measurements of Alice, we can without loss of generality linear operator O we have O ⊗ 11|ψmaxi = 11 ⊗ OT|ψmaxi, we assume that they are projective. This implies that the spectrum d d of A only contains {+1, −1, 0} and therefore (A )3 = A . straightforwardly saturate the bound in Eq. (7).  x x x This allows us to obtain a relation that only contains Bob’s We remark that for the case of d = 2 one could also choose operators. Tracing out Alice’s system and subsequently elim- γ2 = 0 and retain the property that qubit MUBs are optimal. inating the marginal state of Bob (it is assumed to be full-rank) In this case the marginal term is not necessary, because in the leads to optimal realisation Alice never outputs ⊥. Then, the quan- √ d 2 2 2 3 tum bound becomes and the local bound becomes . Px1 − Qx2 = (Px1 − Qx2 ) . (11) The resulting Bell inequality resembles the Clauser–Horne– d − 1 Shimony–Holt (CHSH) inequality [70], not just because it Expanding this relation and then using projectivity and the gives the same local and quantum values, but also because the completeness of measurements, one recovers the result in optimal realisations coincide. More specifically, the measure- Eq. (9).  ments of Bob are precisely the optimal CHSH measurements, whereas the four measurements of Alice correspond to two pairs of optimal CHSH measurements. 2 Note that this is not a physical assumption but a mathematical conven- tion which simplifies the notation in the rest of this work. Whenever the III. DEVICE-INDEPENDENT CERTIFICATION OF marginal state is not full-rank, the local Hilbert space naturally decomposes MUTUAL UNBIASEDNESS as a direct sum of two terms, where the state is only supported on one of them. Clearly, the measurement operators can only be characterised on the support of the state and that is precisely what we achieve. This convention Theorem II.1 establishes that a pair of MUBs of any di- allows us to only write out the part that can be characterised and leave out mension can generate a maximal quantum violation in a Bell the rest. 5

We have shown that observing the maximal quantum value unbiased. An operational approach must rely on observable MUB of Sd implies that the measurements of Bob satisfy the quantities (i.e. probabilities), as opposed to algebraic relations relations given in Eq. (9). It is natural to ask whether a between vectors or operators. This notion, which we refer to stronger conclusion can be derived, but the answer turns out as mutually unbiased measurements (MUMs), was recently to be negative. In SM (section I.B) we show that any pair formalised by Tasca et al. [74]. Note that in what follows of d-outcome measurements (acting on a finite-dimensional we use the term “eigenvector” to refer to eigenvectors corre- Hilbert space) satisfying the relations in Eq. (9) is capable of sponding to non-zero eigenvalues. generating the maximal Bell inequality violation. For d = 2, 3 the relations given in Eq. (9) imply that the unknown mea- Definition III.2 (Mutually unbiased measurements). We say n n surements correspond to a direct sum of MUBs (see SM sec- that two n-outcome measurements {Pa}a=1 and {Qb}b=1 are tion II.C) and since in these dimension there exists only a mutually unbiased if they are projective and the following im- single pair of MUBs (up to unitaries and complex conjuga- plications hold: tion), our results imply a self-testing statement of the usual 1 kind. However, since in higher dimensions not all pairs of hψ|Pa|ψi = 1 ⇒ hψ|Qb|ψi = MUBs are equivalent [71], our certification statement is less n informative than the usual formulation of self-testing. In other 1 hψ|Qb|ψi = 1 ⇒ hψ|Pa|ψi = , (12) words, our inequalities allow us to self-test the quantum state, n but we cannot completely determine the measurements (see for all a and b. That is, two projective measurements are mu- Refs. [72, 73] for related results). Note that we could also con- tually unbiased if the eigenvectors of one measurement give duct a device-independent characterisation of the measure- rise to a uniform outcome distribution for the other measure- ments of Alice. In fact, Eq. (61) from the SM enables us to ment. relate the measurements of Alice to the measurements of Bob, which we have already characterised. However, since we do Note that this definition captures precisely the intuition be- not expect the observables of Alice to satisfy any simple al- hind MUBs without the need to specify the dimension of the gebraic relations and since they are not directly relevant for underlying Hilbert space. Interestingly enough, MUMs admit the scope of this work (namely MUBs and SICs), we do not a simple algebraic characterisation. pursue this direction. n The certification provided in Theorem III.1 turns out to be Theorem III.3. Two n-outcome measurements {Pa}a=1 and n sufficient to determine all the probabilities p(a, b|x, y) that {Qb}b=1 are mutually unbiased if and only if arise in the Bell experiment (see SM section I.C), which MUB P = nP Q P and Q = nQ P Q , (13) means that the maximal quantum value of Sd is achieved a a b a b b a b by a single probability distribution. Due to the existence of inequivalent pairs of MUBs in certain dimensions (e.g. for for all a and b. d = 4), this constitutes the first example of an extremal point of the quantum set which admits inequivalent quantum reali- Proof. Let us first assume that the algebraic relations hold. By sations.3 summing over the middle index, one finds that both measure- ments are projective. Moreover, if |ψi is an eigenvector of It is important to understand the relation between the con- 1 1 Pa, then hψ|Qb|ψi = hψ|PaQbPa|ψi = hψ|Pa|ψi = . dition given in Eq. (9) and the concept of MUBs. Naturally, if n n d d By symmetry, the analogous property holds if |ψi is an eigen- {Pa} and {Qb} are d-dimensional MUBs, the relations a=1 b=1 vector of Qb. (9) are satisfied. Interestingly, however, there exist solutions Conversely, let us show that MUMs must satisfy the above to Eq. (9) which are neither MUBs nor direct sums thereof. P algebraic relations. Since a Pa = 11 we can choose an or- While, as mentioned above, for d = 2, 3 one can show that any thonormal basis of the Hilbert space composed only of the measurements satisfying the relations (9) must correspond to a eigenvectors of the measurement operators. Let {|ej i}a,j be a direct sum of MUBs, this is not true in general. For d = 4, 5 an orthonormal basis, where a ∈ [n] tells us which projector we have found explicit examples of measurement operators the eigenvector corresponds to and j labels the eigenvectors satisfying Eq. (9) which cannot be written as a direct sum of within a fixed projector (if P has finite rank, then j ∈ [tr P ], MUBs. In fact, they cannot even be transformed into a pair of a a otherwise j ∈ N). By construction for such a basis we have MUBs via a completely positive unital map (see SM section a0 a P |e i = δ 0 |e i. To show that P = nP Q P it suffices II for details). These results beg the crucial question: how a j aa j a a b a to show that the two operators have the same coefficients in should one interpret the condition given in Eq. (9)? this basis. Since To answer this question we resort to an operational formu- a0 a00 a a lation of what it means for two measurements to be mutually hej |nPaQbPa|ek i = nδaa0 δaa00 hej |Qb|eki, (14) a0 a00 hej |Pa|ek i = δaa0 δaa00 δjk (15)

a a 3 Recall that the notion of equivalence we employ is precisely the one that it suffices to show that nhej |Qb|eki = δjk. For j = k this is appears in the context of self-testing, i.e. we allow for additional degrees a direct consequence of the definition in Eq. (12√). To prove a iθ a
of freedom, local isometries and a transposition. the other case, define |φθi = |ej i + e |eki / 2, for θ ∈ 6

[0, 2π). Since Pa|φθi = |φθi, we have hφθ|Qb|φθi = 1/n. state and MUMs, and moreover that it is achieved by a unique Writing this equality out gives probability distribution, suggests that these inequalities might be useful for device-independent quantum information pro- 1 1  2  = + eiθhea|Q |eai + e−iθhea|Q |eai . (16) cessing. In the task of quantum key distribution [17, 18, 78] n 2 n j b k k b j Alice and Bob aim to establish a shared data set (a key) that is secure against a malicious eavesdropper. Such a task re- a a Choosing θ = 0 implies that the real part of hej |Qb|eki van- quires the use of incompatible measurements, and MUBs in ishes, while θ = π/2 implies that the imaginary part vanishes. dimension d = 2 constitute the most popular choice. Since Proving the relation Qb = nQbPaQb proceeds in an analo- in the ideal case the measurement outcomes of Alice and Bob gous fashion.  that contribute to the key should be perfectly correlated, most protocols are based on maximally entangled states. In the Theorem III.3 implies that the maximal violation of the Bell device-independent approach to quantum key distribution, the inequality for MUBs certifies precisely the fact the Bob’s mea- amount of key and its security is deduced from the observed surements are mutually unbiased. To provide further evidence Bell inequality violation. that MUMs constitute the correct device-independent gener- We present a proof-of-principle application to device- alisation of MUBs, we give two specific situations in which independent quantum key distribution based on the quantum the two objects behave in the same manner. nonlocality witnessed through the Bell functional in Eq. (4). Maassen and Uffink considered a scenario in which two In the ideal case, Alice and Bob follow the strategy that gives measurements (with a finite number of outcomes) are per- them the maximal violation, i.e. they share a maximally entan- formed on an unknown state. Their famous uncertainty re- gled state of local dimension d and Bob measures two MUBs. lation provides a state-independent lower bound on the sum To generate the key we provide Alice with an extra setting of the Shannon entropies of the resulting distributions [16]. that produces outcomes which are perfectly correlated with While the original result only applies to rank-one projective the outcomes of the first setting of Bob. This will be the only measurements, a generalisation to non-projective measure- pair of settings from which the raw key will be extracted and ments reads [75] let us denote them by x = x∗ and y = y∗ = 1. In most rounds of the experiment, Alice and Bob choose these set- H(P ) + H(Q) ≥ − log c, (17) tings and therefore contribute towards the raw key. However, to ensure security, a small number of rounds is used to evalu- where H√ denotes the Shannon entropy and c = √ 2 ate the Bell functional. In these rounds, which are chosen at maxa,bk Pa Qbk where k·k is the operator norm. If we restrict ourselves to rank-one projective measurements on a random, Alice and Bob randomly choose their measurement Hilbert space of dimension d, one finds that the largest uncer- settings. Once the experiment is complete, the resulting value tainty, corresponding to c = 1/d, is obtained only by MUBs. of the Bell functional is used to infer the amount of secure raw It turns out that precisely the same value is achieved by any key shared between Alice and Bob. The raw key can then be pair of MUMs with d outcomes regardless of the dimension turned into the final key by standard classical post-processing. of the Hilbert space: For simplicity, we consider only individual attacks and more- over we focus on the limit of asymptotically many rounds in

p p 2 2 which fluctuations due to finite statistics can be neglected. c = maxk Pa Qbk = maxkPaQbk a,b a,b The key rate, K, can be lower bounded by [79] 1 β
= maxkPaQbPak = maxkPa/dk = . (18) K ≥ − log P − H(B ∗ |A ∗ ), (19) a,b a d g y x

β A closely related concept is that of measurement incompati- where Pg denotes the highest probability that the eavesdrop- bility, which captures the phenomenon that two measurements per can correctly guess Bob’s outcome when his setting is y∗ cannot be performed simultaneously on a single copy of a sys- given that the Bell inequality value β was observed, and H(·|·) tem. The extent to which two measurements are incompatible denotes the conditional Shannon entropy. The guessing prob- β can be quantified e.g. by so-called incompatibility robustness ability Pg is defined as measures [76]. In SM (section II.D), we show that accord- ing to these measures MUMs are exactly as incompatible as  d  β X MUBs. Moreover, we can show that for the so-called gener- Pg ≡ sup hψABE|11 ⊗ Pc ⊗ Ec|ψABEi , (20) alised incompatibility robustness [77], MUMs are among the c=1 most incompatible pairs of d-outcome measurements. d where {Ec}c=1 is the measurement employed by the eaves- dropper to produce her guess, the expression inside the curly IV. APPLICATION: DEVICE-INDEPENDENT QUANTUM braces is the probability that her outcome is the same as Bob’s KEY DISTRIBUTION for a particular realisation and the supremum is taken over all quantum realisations (the tripartite state and measurements of The fact that the maximal quantum violation of the Bell in- all three parties) compatible with the observed Bell inequality equalities introduced above requires a maximally entangled value β. 7

Let us first focus on the key rate in a noise-free scenario, Let us now depart from the noise-free case and estimate MUB i.e. in a scenario in which Sd attains its maximal value. the key rate in the presence of noise. To ensure that both the Then, one straightforwardly arrives at the following result. guessing probability and the conditional Shannon entropy can be computed in terms of a single noise parameter, we have to Theorem IV.1 (Device-independent key rate). In the noise- introduce an explicit noise model. We employ the standard ap- less case the quantum key distribution protocol based on MUB proach in which the measurements remain unchanged, while Sd achieves the key rate of the maximally entangled state is replaced with an isotropic K = log d (21) state given by for any integer d ≥ 2. 1 − v ρ = v|ψmaxihψmax| + 11, (24) Proof. In the noiseless case, Alice and Bob observe exactly v d d d2 the correlations predicted by the ideal setup. In this case the outcomes for settings (x∗, y∗) are perfectly correlated which implies that H(By∗ |Ax∗ ) = 0. Therefore, the only non-trivial where v ∈ [0, 1] is the visibility of the state. Using this state task is to bound the guessing probability. and the ideal measurements for Alice and Bob, the relation MUB Since the actions of the eavesdropper commute with the between v and Sd can be easily derived from (8), namely, actions of Alice and Bob, we can assume that she performs her measurement first. If the probability of the eavesdropper ! observing outcome c ∈ [d], which we denote by p(c), is non- 1 SMUB v = 1 + d . (25) zero, then the (normalised) state of Alice and Bob conditioned 2 pd(d − 1) on the eavesdropper observing that outcome is given by:

(c) 1 ρ = tr (11 ⊗ 11 ⊗ E )|ψ ihψ |. (22) AB p(c) C c ABE ABE Utilising this formula, we also obtain the value of H(By∗ |Ax∗ ) as a function of the Bell violation. The remain- Now Alice and Bob share one of the post-measurement states ing part of (19) is the guessing probability (20). In the case of (c) d = 3, we proceed to bound this quantity through semidefinite ρAB and when they perform their Bell inequality test, they will obtain different distributions depending on c, which we write programming. as pc(a, b|x, y). However, since the statistics achieve the max- Concretely, we implement the three-party semidefinite re- MUB imal quantum value of Sd and we have previously shown laxation [81] of the set of quantum correlations at local level that the maximal quantum value is achieved by a single proba- one4. This results in a moment matrix of size 532 × 532 with bility point, all the probability distributions pc(a, b|x, y) must 15617 variables. The guessing probability is directly given by be the same. Moreover, we have shown that for this probabil- the sum of three elements of the moment matrix. It can then ity point, the marginal distribution of outcomes on Bob’s side be maximised under the constraints that the value of the Bell is uniform over [d] for both inputs. This implies that MUB functional S3 is fixed and the moment matrix is positive d semidefinite. However, we notice that this problem is invari- X 1 ant under the following relabelling: b → π(b) for y = 1, Pg = p(c)pc(b = c|y = 1) = , (23) d c → π(c), x1 → π(x1), where π ∈ S3 is a permutation c=1 of three elements. Therefore, it is possible to simplify this 1 semidefinite program by requiring the matrix to be invariant because pc(b = c|y = 1) = p(b = c|y = 1) = d for all c.  under the group action of S3 on the moment matrix (i.e. it We remark that the argument above is a direct consequence is a Reynolds matrix) [43, 82, 83]. This reduces the number of a more general result which states that if a bipartite prob- of free variables in the moment matrix to 2823. With the Se- ability distribution is a nonlocal extremal point of the quan- DuMi [84] solver, this lowers the precision (1.1×10−6 instead tum set, then no external party can be correlated with the out- of 8.4×10−8), but speeds up the computation (155s instead of comes [80]. 8928s) and requires less memory (0.1GB instead of 5.5GB). It is interesting to note that the obtained key rate is the MUB For the maximal value of Sd , we recover the noise-free re- largest possible for general setups in which the key is gen- sult of K = log 3 up to the fifth digit. Also, we have a key erated from a d-outcome measurement. Also, the key rate MUB rate of at least one bit when Sd & 2.432 and a non-zero is optimal for all protocols based on a pair of entangled MUB key rate when Sd & 2.375. The latter is close to the local d-dimensional systems subject to projective measurements. bound, which is SMUB ≈ 2.367. The resulting lower bound d d This follows from the fact that projective measurements in C on the key rate as a function of the Bell inequality violation is cannot have more than d outcomes. It has recently been shown plotted in Fig.2. that the same amount of randomness can be generated us- ing a modified version of the Collins–Gisin–Linden–Massar– Popescu inequalities [60], but note that the measurements used there do not correspond to mutually unbiased bases (ex- 4 We attribute one operator to each outcome of Bob and the eavesdropper, cept for the special case of d = 2). but only take into account the first two outcomes of Alice. 8

FIG. 3: Bell scenario for SICs of dimension d. Alice receives one of d2
2 inputs and returns a ternary outcome while Bob receives one of d2 inputs and returns a binary outcome. FIG. 2: Lower bound on the key rate K in the asymptotic limit versus MUB the value of the Bell functional S3 .

system. Alice receives an input labelled by a tuple (x1, x2) d2
V. NONLOCALITY FOR SYMMETRIC INFORMATIONAL representing one of 2 possible inputs, which we collec- COMPLETENESS tively refer to as x = x1x2. The tuple is randomly taken 2 2 from the set Pairs(d ) ≡ {x|x1, x2 ∈ [d ] and x1 < x2}. Al- We now shift our focus from MUBs to SICs. We con- ice performs a measurement on her part of the shared system struct Bell inequalities whose maximal quantum violations are and produces a ternary output labelled by a ∈ {1, 2, ⊥}. Bob 2 achieved with SICs. We formally define a SIC as a set of d2 receives an input labelled by y ∈ [d ] and the associated mea- 2 b ∈ {1, ⊥} unit vectors in d, namely {|r i}d , with the property that surement produces a binary outcome labelled by . C j j=1 The joint probability distribution is denoted by p(a, b|x, y), 1 and the Bell scenario is illustrated in Fig.3. |hr |r i|2 = (26) j k d + 1 Similar to the case of MUBs, in order to make our choice of Bell functional transparent, we phrase it as a game played by for all j 6= k, where the constant on the right-hand-side is Alice and Bob. We imagine that their inputs are supplied by fixed by normalisation. The reason for there being precisely a referee, who promises to provide x = x x and y such that d2 elements in a SIC5 is that this is the largest number of unit 1 2 either y = x or y = x . Similar to the previous game Alice vectors in d that could possibly admit the uniform overlap 1 2 C can output a =⊥ to ensure that no points are won or lost. property (26). Moreover, we formally distinguish between a However, in this game also Bob can ensure that no points are SIC as the presented set of rank-one projectors and a SIC- won or lost by outputting b =⊥. If neither of them outputs ⊥, POVM (positive operator-valued measure) which is the gener- a point is either won or lost. Specifically, when a = 1 a point alised quantum measurement with d2 possible outcomes cor- y = x a = 2 1 d2 is won if 1 (and lost otherwise), whereas if then a responding to the sub-normalised projectors { |rkihrk|} . d k=1 point is won if y = x2 (and lost otherwise). Let us remark that Since the treatment of SICs in Bell nonlocality turns out in this game Bob’s only role is to decide whether in a given to be more challenging than for the case of MUBs, we first round points can be won/lost or not. For this game the total establish the relevance of SICs in a simplified Bell scenario number of points (the Bell functional) reads subject to additional constraints. This serves as a stepping stone to a subsequent relaxation which gives a standard (un- X  RSIC ≡ p(1, 1|x, x ) − p(1, 1|x, x ) constrained) Bell inequality for SICs. We then focus on the d 1 2 x1

SIC a ∈ {1, 2} (b = 1) remotely prepare Bob’s (Alice’s) sub- bounds on Rd read system in a pure state. This corresponds to the marginals p (a = 1|x) = p (a = 2|x) = p (b = 1|x) = 1/d which is re- Q p RSIC ≤ d(d − 1) d (d + 1) (31) flected in the marginal constraints in Eq. (28). We remark that d NS imposing these constraints simplifies both the intuitive under- RSIC ≤ d d2 − 1
. (32) standing of the game and the derivation of the results below. d However, it merely serves as a stepping stone to a more gen- We remark that SICs are not known to exist in all Hilbert eral subsequent treatment in which the constraints (28) will be space dimensions. However, their existence in all dimensions removed. is strongly conjectured and explicit SICs have been found in To write the value of the Bell functional of a quantum all dimensions up to 121 [53]. realisation, let us introduce two simplifications. The mea- a surement operators of Alice are denoted by {Ax} and as be- fore it is convenient to work with the observables defined as B. Bell inequalities for SICs 1 2 Ax = Ax − Ax. The measurements of Bob are denoted by {Bb}, but since they only have two outcomes, all the expres- y The marginal constraints in Eq. (28) allowed us to prove sions can be written in terms of a single operator from each that the quantum realisation based on SICs achieves the max- input y. In our case it is convenient to use the outcome-one op- imal quantum value of RSIC. Our goal now is to remove these erator and for convenience we will skip the superscript, i.e. we d constraints to obtain a standard Bell functional. Analogously will write B ≡ B1 for all y. Then, the Bell functional evalu- y y to the case of MUBs we add marginal terms to the original ated on a specific quantum realisation reads SIC functional Rd . To this end, we introduce penalties for both Alice and Bob. X SIC Specifically, if Alice outputs a ∈ {1, 2} they lose αd points, Rd = hψ|Ax ⊗ (Bx1 − Bx2 ) |ψi. (29) x1

Proof. The proof is presented in SM (section III.B ). In or- for all y 6= y0. der to obtain the quantum bound in Eq. (36), the key ingredi- ents are the Cauchy–Schwarz inequality and semidefinite re- A complete proof, which is similar in spirit to the proof of laxations of polynomial optimisation problems. To derive the Theorem III.1, can be found in SM (section III.C). local bound in Eq. (35), the key observation is that the sym- For the special case of d = 2, the conclusion can be made SIC metries of the Bell functional allow us to significantly simplify even more accurate: the maximal quantum violation of S2 the problem. implies that Bob’s outcome-one projectors are rank-one pro- The fact that the quantum bound is saturated by a maxi- jectors acting on a qubit whose Bloch vectors form a regular mally entangled state and Bob performing a SIC can be seen tetrahedron (up to the three standard equivalences used in self- immediately from the previous discussion that led to Eq. (30). testing). SIC p Similar to the case of MUBs, we face the key question of With that strategy, we find Rd = d(d−1) d(d + 1). Since it also respects p(a = 1|x)+p(a = 2|x) = 2/d ∀x, as well as interpreting the condition in Eq. (38) and its relation to SICs. p(b = 1|y) = 1/d ∀y, a direct insertion into Eq. (33) saturates Again in analogy with the case of MUBs, we note that the con- the bound in Eq. (36).  cept of a SIC references the dimension of the Hilbert space, which should not appear explicitly in a device-independent Note that in the limit of d → ∞ the local bound grows scenario. Hence we consider an operational approach to SICs, linearly in d while the quantum bound grows quadratically in which must rely on observable quantities (i.e. probabilities). d. This leads us to the following natural definition of a set of pro- We remark that for the special case of d = 2, no penalties jectors being operationally symmetric informationally com- are needed to maintain the optimality of SICs (which is why plete (OP-SIC). the delta function appears in Eq. (34)). The derived Bell in- equality for a qubit SIC (which corresponds to a tetrahedron Definition V.3 (Operational SIC). We say that a set of pro- n2 configuration on the Bloch sphere) can be compared to the so- jectors {Ba}a=1 is operationally symmetric informationally called elegant Bell inequality [85] whose maximal violation is complete (OP-SIC) if also achieved using the tetrahedron configuration. While we require six settings of Alice and four settings of Bob, the el- X Ba = n 11 (39) egant Bell inequality requires only four settings of Alice and a three settings of Bob. However, the additional complexity in our setup carries an advantage when considering the critical and visibility of the shared state; i.e. the smallest value of v in 1 Eq. (24) (defining an isotropic state) for which the Bell in- hψ|Ba|ψi = 1 ⇒ hψ|Bb|ψi = , (40) equality is violated. The critical visibility for violating the el- n + 1 egant Bell inequality is 86.6%, whereas for our Bell inequality for all a 6= b. it is lowered to 81.6%. We remark that on the Bloch sphere, the anti-podal points corresponding to the four measurements This definition trivially encompasses SICs as special in- of Alice and the six measurements of Bob form a cube and a stances of OP-SICs. More interestingly, an argument analo- cuboctahedron respectively, which constitutes an instance of gous to the proof of Theorem III.3 shows that this definition is the type of Bell inequalities proposed in Ref. [86]. in fact equivalent to the relations given in Eqs. (37) and (38). Hence, in analogy with the case of MUBs, the property of Bob’s measurements certified by the maximal violation of our C. Device-independent certification Bell inequality is precisely the notion of OP-SICs.

Theorem V.1 shows that for any dimension d ≥ 2 we can construct a Bell inequality which is maximally violated D. Adding a SIC-POVM by a SIC in that dimension (provided a SIC exists). Let us now consider the converse question, namely that of device- SSIC independent certification. In analogy with the case of MUBs The Bell inequalities proposed above (Bell functional d ) (Eq. (9)), we find a simple description of Bob’s measurements. are tailored to sets of rank-one projectors forming a SIC. How- ever, it is also interesting to consider a closely related entity, Theorem V.2 (Device-independent certification). The maxi- namely a SIC-POVM, which is obtained simply by normal- SIC mal quantum value of the Bell functional Sd , provided the ising these projectors, so that they can be collectively inter- marginal state of Bob is full-rank, implies that his measure- preted as arising from a single measurement. That is, a SIC- 2 d d d2 ment operators {By}y=1 are projective and satisfy POVM on C is a measurement {Ea}a=1 in which every mea- E = 1 |φ ihφ | X surement operator can be written as a d a a , where By = d 11 (37) the set of rank-one projectors {|φaihφa|}a forms a SIC. Due y to the simple relation between SICs and SIC-POVMs, we can and extend the Bell inequalities for SICs proposed above such that they are optimally implemented with both a SIC (as before) By = (d + 1)ByBy0 By (38) and a SIC-POVM. 11

VI. APPLICATION: DEVICE-INDEPENDENT QUANTUM RANDOM NUMBER GENERATION

SIC SIC The fact that the Bell functionals Sd and Td achieve their maximal quantum values with a SIC and a SIC-POVM respectively, opens up the possibility for device-independent quantum information protocols for tasks in which SICs and SIC-POVMs are desirable. We focus on one such application, namely that of device-independent quantum random number generation [87]. This is the task of certifying that the data generated by a party cannot be predicted by a malicious eaves- FIG. 4: Bell scenario for SICs and SIC-POVMs of dimension d. This dropper. In the device-independent setting, both the amount of scenario modifies the original Bell scenario for SICs (see Figure3) randomness and its security is derived from the violation of a by supplying Alice with an extra setting labelled by povm which Bell inequality. has d2 possible outcomes. Non-projective measurements, such as SIC-POVMs, are useful for this task. The reason is that a Bell experiment im- plemented with entangled systems of local dimension d and It is clear that in order to make SIC-POVMs relevant to the standard projective measurements cannot have more than d Bell experiment, it must involve at least one setting which cor- outcomes. Consequently, one cannot hope to certify more responds to a d2-outcome measurement. For the Bell scenario than log d bits of local randomness. However, Bell exper- previously considered for SICs (see Figure3), no such mea- iment relying on d-dimensional entanglement implemented surement is present. Therefore, we supplement the original with (extremal) non-projective measurements can have up to 2 Bell scenario by introducing a single additional measurement d outcomes [88]. This opens the possibility of generating up setting of Alice, labelled by povm, which has d2 outcomes to 2 log d bits of local randomness without increasing the di- labelled by a0 ∈ [d2]. The modified Bell scenario is illustrated mension of the shared entangled state. Notably, for the case SIC of d = 2, such optimal quantum random number generation in Figure4. We construct the Bell functional Td for this sce- nario by modifying the previously considered Bell functional has been shown using a qubit SIC-POVM [42]. SIC Here, we employ our Bell inequalities for SIC-POVMs to Sd : significantly outperform standard protocols relying on projec- d2 tive measurements on d-dimensional entangled states. To this SIC SIC X 0 end, we briefly summarise the scenario for randomness gener- Td = Sd − p(a = y, b =⊥ |povm, y). (41) y=1 ation. Alice and Bob perform many rounds of the Bell exper- iment illustrated in Figure4. Alice will attempt to generate Hence, whenever Bob outputs “⊥“ and the outcome associ- local randomness from the outcomes of her setting labelled ated to the setting povm coincides with the input of Bob, a by povm. In most rounds of the Bell experiment, Alice per- 0 point is lost. forms povm and records the outcome a . In a smaller num- SIC ber of rounds, she randomly chooses her measurement setting Evidently, the largest quantum value of Td is no greater SIC and the data is used towards estimating the value of the Bell than the largest quantum value of Sd . In order for the for- SIC SIC functional Td defined in Eq. (41). A malicious eavesdrop- mer to equal the latter, we require that: i) Sd reaches its 0 maximal quantum value (which is given in Eq. (36)) and ii) per may attempt to guess Alice’s relevant outcome a . To this that p(a0 = y, b =⊥ |povm, y) = 0 ∀y. We have already end, the eavesdropper may entangle her system with that of seen that by sharing a maximally entangled state and Bob’s Alice and Bob, and perform a well-chosen POVM {Ec}c to enhance her guess. In analogy to Eq. (20), the eavesdropper’s outcome-one projectors {By}y forming a SIC, the condition i) can be satisfied. By normalisation, we have that Bob’s guessing probability reads ⊥ outcome-⊥ projectors are By = 11−By. Again noting that for  d2  max T max β X c any linear operator O we have O ⊗ 11|ψd i = 11 ⊗ O |ψd i, P ≡ sup hψABE|A ⊗ 11 ⊗ Ec|ψABEi , (43) ⊥ g povm observe that if Bob applies By , then Alice’s local state is or- c=1 thogonal to By. Hence, if Alice chooses her POVM {Ea0 }, d2 corresponding to the setting povm, as the SIC-POVM de- where {Ec}c=1 is the measurement employed by the eaves- 1 T 0 0 dropper to produce her guess, the expression inside the curly fined by Ea = d Ba0 , the probability of finding a = y van- ishes. This satisfies condition ii). Hence, we conclude that in braces is the probability that her outcome is the same as Al- a general quantum model ice’s outcome for the setting povm for a particular realisation and the supremum is taken over all quantum realisations (the Q SIC d + 2δd,2 p tripartite state and measurements of all three parties) compat- Td ≤ d (d + 1), (42) SIC 2 ible with the observed Bell inequality violation β = Td . We quantify the randomness generated by Alice using the β
and that the bound can be saturated by supplementing the pre- conditional min-entropy Hmin(Apovm|E) = − log Pg . To vious optimal realisation with a SIC-POVM on Alice’s side. obtain a device-independent lower bound on the randomness, 12

For the case of d = 3 we bound the guessing probabil- ity following the method of Ref [87]. This has the advan- tage of requiring only a bipartite, and hence smaller, moment matrix than the tripartite formulation. However, the amount of symmetry leaving the problem invariant is reduced, be- cause the objective function only involves one outcome. Con- cretely, we construct a moment matrix of size 820 × 820 with 263549 variables. We then write the guessing proba- bility as P (a0 = 1|povm) and identify the following group of permutations leaving the problem invariant: x1 → π(x1), 0 0 x2 → π(x2), a → fπ(a, x1, x2), a → π(a ), y → π(y), where π ∈ S9 leaves element 1 invariant and permutes ele- ments 2,..., 9 in all possible ways. Taking this symmetry into FIG. 5: Lower bound on the amount of device-independent random- 460 ness versus the value of T SIC. account reduces the number of free variables to . In order 2 to further simplify the problem we make use of RepLAB, a recently developed tool which decomposes representations of β finite groups into irreducible representations [89, 90]. This we must evaluate an upper bound on Pg for a given observed value of the Bell functional. We saw in SectionIV that if allows us to write the moment matrix in a preferred basis in the eavesdropper is only trying to guess the outcome of a sin- which it is block diagonal. The semidefinite constraint can gle measurement setting, we can without loss of generality then be imposed on each block independently, with the largest assume that they are only classically correlated with the sys- block of size 28 × 28 instead of 820 × 820. Solving one tems of Alice and Bob. As before, we restrict ourselves to the semidefinite program with SeDuMi [84] then takes 0.7s with asymptotic limit of many rounds, in which fluctuations due to < 0.1GB of memory instead of 162s/0.2GB without block- finite statistics can be neglected. diagonalisation, and fails due to lack of memory without any In order to bound the randomness for some given value of symmetrisation (> 400GB required). SIC Td , we use the hierarchy of quantum correlations [81]. We restrict ourselves to the cases of d = 2 and d = 3. For the case of d = 2, we construct a moment matrix with the opera- tors {(11,Ax) ⊗ (11,By) ⊗ (11,E)}∪{Apovm ⊗ (11,By,E)}, neglecting the ⊥ outcome. The matrix is of size 361 × 361 with 10116 variables. Again, we can make use of symmetry Using entangled states of dimension three and correspond- to simplify the semidefinite program. In this case, the follow- ing SIC-POVMs, one can attain the full range of values for x → π(x ) SIC ing permutation leaves the problem invariant: 1 1 , T3 . Importantly, the guessing probability is independent of 0 0 x2 → π(x2), a → fπ(a, x1, x2), a → π(a ), y → π(y), the outcome guessed by the eavesdropper, and we can verify c → π(c), where that the bound we obtain is convex, hence guaranteeing that no mixture of strategy by the eavesdropper must be consid- a π(x ) < π(x )  1 2 ered [87]. The randomness is then given in Figure6, which 2 π(x ) ≥ π(x ) and a = 1 indicates that by increasing the value of T SIC, we can ob- f (a, x , x ) = 1 2 (44) 3 π 1 2 tain more randomness than the best possible schemes rely- 1 π(x1) ≥ π(x2) and a = 2  ing on standard projective measurements and entangled sys- ⊥ π(x1) ≥ π(x2) and a =⊥ tems of dimensions 3, 4, 5, 6, 7. Especially, in the case of SIC and π ∈ S4. Using this symmetry reduces the number of free T3 being maximal, we find that Hmin(Apovm|E) ≈ 3.03 variables to 477. The trade-off between the amount of certi- bits. This is larger than what can be obtained by performing fied randomness and the nonlocality is illustrated in Figure5. projective measurements on eight dimensional systems (since SIC log 8 = 3 bits). It is, however, worth noting that this last value We find that for sufficiently large values of T2 (roughly SIC is obtained at the boundary of the set of quantum correlations T2 ≥ 4.8718), we outperform the one-bit limitation asso- ciated to projective measurements on entangled qubits. No- where the precision of the solver is significantly reduced7. SIC It is not straightforward to estimate the extent to which this tably, for even larger values of T2 , we also outperform the restriction of log 3 bits associated to projective measurements reduced precision may influence the guessing probability, so on entangled systems of local dimension three. For the opti- it would be interesting to reproduce this computation with a SIC more precise solver such as SDPA [91]. mal value of T2 we find Hmin(Apovm|E) & 1.999, which is compatible up to numerical precision with the largest possible amount of randomness obtainable from qubit systems under general measurements, namely two bits6. randomness from qubits in a Bell scenario since every qubit measurement with more than four outcomes can be stochastically simulated with mea- surements of at most four outcomes [88]. Naturally, a four-outcome mea- surement cannot generate more than two bits of randomness. 6 It is impossible to obtain more than two bits of device-independent local 7 In particular, the DIMACS errors at this point are of the order of 10−4. 13

age, which helped to significantly reduce the complexity of the corresponding semidefinite programs by taking advantage of their symmetry. This work opens many new research directions, so let us mention just a few of them. We showed that a maximal quan- tum violation of the Bell inequality for MUBs self-tests a maximally entangled state of local dimension d. In the case of the Bell inequality for SICs we have managed to certify the measurements of Bob, but we do not have a self-testing re- sult for the state. If a self-test of the state is possible, what are the implications for the device-independent certification of the SIC-POVM setting? This may prove helpful towards FIG. 6: Lower bound on the amount of device-independent random- solving another interesting question, namely that of proving SIC optimal local randomness generation (i.e. 2 log d bits) for any ness versus the value of T3 . d based on the Bell inequality for SIC-POVMs. Another av- enue of exploration regards the concept of mutually unbiased VII. CONCLUSIONS measurements (MUMs). In this work, we have shown some of their basic properties with regard to MUBs as well as exam- MUBs and SICs are conceptually elegant, fundamentally ples of how they are relevant in quantum information theory. important and practically useful features of quantum theory. However, a more systematic exploration of MUMs would be We investigated their role in quantum nonlocality. For both desirable. Similarly, a general exploration of operational SICs MUBs and SICs (of any Hilbert space dimension) we pre- (OP-SICs) in quantum information theory, as well as their re- sented families of Bell inequalities for which they produce lation to SICs, would be of similar interest. Finally, we note the maximal quantum violations. Moreover, we showed that that our noise-robust results for quantum key distribution and these maximal quantum violations certify natural operational quantum random number generation may be relevant for ex- notions of mutual unbiasedness and symmetric informational perimental implementations. completeness. Then, we considered applications of both fam- ilies of Bell inequalities in practically relevant tasks. The Bell inequalities for MUBs turn out to be useful for the task of device-independent quantum key distribution and give the op- Acknowledgments timal key rate for measurements with d outcomes. Moreover, for the case of qutrit systems we investigated the noise robust- We would like to thank Thais de Lima Silva and Nico- ness of the protocol. For the Bell inequalities for SICs, we las Gisin for fruitful discussions. This work was supported considered device-independent random number generation for by the Swiss National Science Foundation (Starting grant qubits and qutrits based on SIC-POVMs. We showed (up to DIAQ, NCCR-QSIT). The project “Robust certification of numerical precision) optimal randomness generation for qubit quantum devices” is carried out within the HOMING pro- systems. For qutrit systems, we showed that more random- gramme of the Foundation for Polish Science co-financed by ness can be generated than in any scheme using standard pro- the European Union under the European Regional Develop- jective measurements and entanglement of up to dimension ment Fund. MF acknowledges support from the Polish NCN seven. These results were obtained using the RepLAB pack- grant Sonata UMO-2014/14/E/ST2/00020.

[1] S. Kochen, and E. P. Specker, The Problem of Hidden Variables (1999). in Quantum Mechanics, Indiana University Mathematics Jour- [8] J. M. Renes, R. Blume-Kohout, A. J. Scott, C. M. Caves, Sym- nal 17, 59 (1967). metric Informationally Complete Quantum Measurements,J. [2] J. S. Bell, On the Einstein Podolsky Rosen Paradox, Physics. 1, Math. Phys. 45, 2171 (2004). 195 (1964). [9] W. K. Wooters, Quantum Measurements and Finite Geometry, [3] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Quantum cryp- Found Phys 36, 112 (2006). tography, Rev. Mod. Phys. 74, 145 (2002). [10] M. Grassl, On SIC-POVMs and MUBs in Dimension 6, [4] M. Nielsen and I. L. Chaung, Quantum Computation and Quan- arXiv:quant-ph/0406175 tum Information, Cambridge University Press. [11] R. Beneduci, T. J. Bullock, P. Busch, C. Carmeli, T. Heinosaari, [5] P. Busch, P. Lahti, J-P. Pellonpää and K. Ylinen. Quantum Mea- and A. Toigo, Operational link between mutually unbi- surement, Springer. ased bases and symmetric informationally complete positive [6] J. Schwinger, Unitary operator bases, PNAS 46, 570-579 operator-valued measures, Phys. Rev. A 88, 032312 (2013). (1960). [12] I. Bengtsson, From SICs and MUBs to Eddington, J. Phys. [7] G. Zauner, Quantendesigns, Grundzüge einer nichtkommuta- Conf. Ser. 254 012007 (2010). tiven Designtheorie, Doctoral thesis at University of Vienna [13] I. Bengtsson, K. Blanchfield, and A. Cabello, A Kochen- 14

Specker inequality from a SIC, Phys. Lett. A 376, 374 (2012). [35] C. M. Caves, C. A. Fuchs, and R. Schack, Unknown quantum [14] A. E. Rastegin, Uncertainty relations for MUBs and SIC- states: The Quantum de Finetti representation, J. Math. Phys. POVMs in terms of generalized entropies, Eur. Phys. J. D 67, 43, 4537 (2002). 269 (2013). [36] Z. E. D. Medendorp, F. A. Torres-Ruiz, L. K. Shalm, G. N. M. [15] T. Durt, B-G. Englert, I. Bengtsson and K. Zyczkowski,˙ On Tabia, C. A. Fuchs, and A. M. Steinberg, Experimental char- mutually unbiased bases, Int. J. Quantum Information 8, 535 acterization of qutrits using symmetric informationally com- (2010). plete positive operator-valued measurements, Phys. Rev. A 83, [16] H. Maassen and J. B. M. Uffink, Generalized entropic uncer- 051801(R) (2011). tainty relations, Phys. Rev. Lett. 60, 1103 (1988). [37] W. M. Pimenta, B. Marques, T. O. Maciel, R. O. Vianna, A. [17] C. H. Bennett and G. Brassard, Quantum cryptography: Public Delgado, C. Saavedra, and S. Pádua, Minimum tomography of key distribution and coin tossing, In Proceedings of IEEE In- two entangled qutrits using local measurements of one-qutrit ternational Conference on Computers, Systems and Signal Pro- symmetric informationally complete positive operator-valued cessing, volume 175, page 8. New York, 1984. measure, Phys. Rev. A 88, 012112 (2013). [18] A. K. Ekert, Quantum cryptography based on Bell’s theorem, [38] N. Bent, H. Qassim, A. A. Tahir, D. Sych, G. Leuchs, L. Phys. Rev. Lett. 67, 661 (1991). L. Sánchez-Soto, E. Karimi, and R. W. Boyd, Experimental [19] D. Bruß, Optimal Eavesdropping in Quantum Cryptography Realization of Quantum Tomography of Photonic Qudits via with Six States, Phys. Rev. Lett. 81, 3018 (1998). Symmetric Informationally Complete Positive Operator-Valued [20] N. J. Cerf, M. Bourennane, A. Karlsson and N. Gisin, Security Measures, Phys. Rev. X 5, 041006 (2015). of quantum key distribution using d-level systems, Phys. Rev. [39] J. M. Renes, Equiangular Spherical Codes in Quantum Cryp- Lett. 88, 127902 (2002). tography, Quant. Inf. Comput. 5, 080 (2005). [21] V. Scarani, A. Acín, G. Ribordy, and N. Gisin, Quantum Cryp- [40] B-G. Englert, D. Kaszlikowski, H. K. Ng, W. K. Chua, J. Re-ˇ tography Protocols Robust against Photon Number Splitting At- hácek,ˇ and Janet Anders, Efficient and Robust Quantum Key tacks for Weak Laser Pulse Implementations, Phys. Rev. Lett. Distribution With Minimal State Tomography, arXiv:quant- 92, 057901 (2004). ph/0412075v4 [22] M. Hillery, V. Bužek, and A. Berthiaume Quantum secret shar- [41] F. Bouchard, K. Heshami, D. England, R. Fickler, R. W. Boyd, ing, Phys. Rev. A 59, 1829 (1999). B-G. Englert, L. L. Sánchez-Soto, and E. Karimi, Experimen- [23] I-Ching Yu, Feng-Li Lin, and Ching-Yu Huang, Quantum secret tal investigation of high-dimensional quantum key distribution sharing with multilevel mutually (un)biased bases, Phys. Rev. A protocols with twisted photons, Quantum 2, 111 (2018). 78, 012344 (2008) [42] A. Acín, S. Pironio, T. Vértesi, and P. Wittek, Optimal ran- [24] A. Tavakoli, I. Herbauts, M. Zukowski,˙ and M. Bourennane, domness certification from one entangled bit, Phys. Rev. A 93, Secret sharing with a single d-level quantum system, Phys. Rev. 040102(R) (2016). A 92, 030302(R) (2015). [43] A. Tavakoli, D. Rosset, and M-O. Renou, Enabling Compu- [25] W. K. Wootters and B. D. Fields, Optimal state-determination tation of Correlation Bounds for Finite-Dimensional Quantum by mutually unbiased measurements, Ann. Phys. 191, 363 Systems via Symmetrization, Phys. Rev. Lett. 122, 070501 (1989). (2019) [26] R. B. A. Adamson and A. M. Steinberg, Improving Quantum [44] P. Mironowicz and M. Pawłowski, Experimentally feasi- State Estimation with Mutually Unbiased Bases, Phys. Rev. ble semi-device-independent certification of four-outcome Lett. 105, 030406 (2010). positive-operator-valued measurements, Phys. Rev. A 100, [27] A. Ambainis, A. Nayak, A. Ta-Shma, U. Vazirani, Dense quan- 030301(R) (2019). tum coding and a lower bound for 1-way quantum automata, [45] A. Tavakoli, M. Smania, T. Vértesi, N. Brunner, and M. Bouren- Proceedings of the 31st Annual ACM Symposium on Theory nane, Self-testing non-projective quantum measurements in of Computing (STOC’99), pp. 376-383, 1999. prepare-and-measure experiments, arXiv:1811.12712 [28] A. Tavakoli, A. Hameedi, B. Marques, and M. Bourennane, [46] M. Smania, P. Mironowicz, M. Nawareg, M. Pawłowski, A. Ca- Quantum Random Access Codes Using Single d-Level Sys- bello, and M. Bourennane, Experimental device-independent tems, Phys. Rev. Lett. 114, 170502 (2015) certification of a symmetric, informationally complete, positive [29] E. A. Aguilar, J. J. Borkała, P. Mironowicz, and M. Pawłowski, operator-valued measure, arXiv:1811.12851 Connections between Mutually Unbiased Bases and Quantum [47] J. Shang, A. Asadian, H. Zhu, and O. Gühne, Enhanced entan- Random Access Codes, Phys. Rev. Lett. 121, 050501 (2018). glement criterion via symmetric informationally complete mea- [30] A. Tavakoli, J. Kaniewski, T. Vértesi, D. Rosset, and N. surements, Phys. Rev. A 98, 022309 (2018). Brunner, Self-testing quantum states and measurements in [48] J. Bae, B. C. Hiesmayr, and D. McNulty, Linking entanglement the prepare-and-measure scenario, Phys. Rev. A 98, 062307 detection and state tomography via quantum 2-designs, New J. (2018). Phys. 21 013012 (2019). [31] M. Farkas and J. Kaniewski, Self-testing mutually unbiased [49] C. A. Fuchs and R. Schack, Quantum-Bayesian coherence, Rev. bases in the prepare-and-measure scenario, Phys. Rev. A 99, Mod. Phys. 85, 1693 (2013). 032316 (2019). [50] D. M. Appleby, C. A. Fuchs, and H. Zhu, Group theoretic, lie [32] D. Gottesman, Class of quantum error-correcting codes satu- algebraic and Jordan algebraic formulations of the sic existence rating the quantum Hamming bound, Phys. Rev. A 54, 1862 problem, Quantum Inf. Comput. 15, 61 (2015). (1996). [51] M. Appleby, S. Flammia, G. McConnell, and J. Yard, SICs and [33] A. R. Calderbank, E. M. Rains, P. W. Shor, and N. J. A. Sloane, Algebraic Number Theory, Found Phys 47, 1042 (2017). Quantum Error Correction and Orthogonal Geometry, Phys. [52] A. J. Scott, and M. Grassl, SIC-POVMs: A new computer study, Rev. Lett. 78, 405 (1997). J. Math. Phys. 51, 042203 (2010) [34] C. Spengler, M. Huber, S. Brierley, T. Adaktylos, and B. C. [53] A. J. Scott, SICs: Extending the list of solutions, Hiesmayr, Entanglement detection via mutually unbiased bases, arXiv:1703.03993 Phys. Rev. A 86, 022311 (2012). [54] C. A. Fuchs, M. C. Hoang, and B. C. Stacey, The SIC Question: 15

History and State of Play, Axioms 21, 6 (2017). [77] E. Haapasalo, Robustness of incompatibility for quantum de- [55] N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, and S. vices, Journal of Physics A: Mathematical and Theoretical 48, Wehner, Bell nonlocality, Rev. Mod. Phys. 86, 419 (2014). (25) 255303 (2015). [56] I. Šupic,´ and J. Bowles, Self-testing of quantum systems: a re- [78] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Quantum cryp- view, arXiv:1904.10042 tography, Rev. Mod. Phys. 74, 145 (2002). [57] D. Ostrev and T. Vidick, The structure of nearly-optimal quan- [79] L. Masanes, S. Pironio, and A. Acín, Secure device- tum strategies for the CHSH (n) XOR games, Quantum Infor- independent quantum key distribution with causally indepen- mation & Computation 16, 1191 2016. dent measurement devices, Nature Communications 2, 238 [58] A. Coladangelo, K. T. Goh and V. Scarani, All pure bipartite (2011). entangled states can be self-tested, Nature Communications 8, [80] T. Franz, F. Furrer, and R. F. Werner, Extremal quantum corre- 15485 (2017). lations and cryptographic security, Phys. Rev. Lett. 106, 250502 [59] J. Kaniewski, I. Šupic,´ J. Tura, F. Baccari, A. Salavrakos, and (2011). R. Augusiak, Maximal nonlocality from maximal entangle- [81] M. Navascués, S. Pironio, and A. Acín, Bounding the Set of ment and mutually unbiased bases, and self-testing of two-qutrit Quantum Correlations, Phys. Rev. Lett. 98, 010401 (2007). quantum systems, Quantum 3, 108 (2019). [82] D. Rosset, SymDPoly: symmetry-adapted moment re- [60] S. Sarkar, D. Saha, J. Kaniewski, and R. Augusiak, Self-testing laxations for noncommutative polynomial optimization, quantum systems of arbitrary local dimension with minimal arXiv:1808.09598 number of measurements, arXiv:1909.12722 [83] Y. Cai, J-D. Bancal, J. Romero, and V. Scarani, A new device- [61] M. J. Kewming, S. Shrapnel, A. G. White, and J. independent dimension witness and its experimental implemen- Romero, Hiding Ignorance Using High Dimensions, tation Journal of Physics A: Mathematical and Theoretical 49, https://arxiv.org/abs/1903.09487 305301 (2016) [62] B. Hensen et. al., Loophole-free Bell inequality violation us- [84] J. F. Sturm, Using SeDuMi 1.02, A Matlab toolbox for op- ing electron spins separated by 1.3 kilometres, Nature 526, 682 timization over symmetric cones, Optimization Methods and (2015). Software 11, 625 (1999). [63] L. K. Shalm, Strong Loophole-Free Test of Local Realism, [85] N. Gisin, Bell inequalities: many questions, a few answers, Phys. Rev. Lett. 115, 250402 (2015). arXiv:quant-ph/0702021 [64] M. Giustina, et. al., Significant-Loophole-Free Test of Bell’s [86] A. Tavakoli and N. Gisin, Platonic solids and fundamental tests Theorem with Entangled Photons, Phys. Rev. Lett. 115, 250401 of quantum mechanics, (in preparation). (2015). [87] S. Pironio, A. Acín, S. Massar, A. Boyer de la Giroday, D. N. [65] W. Rosenfeld, D. Burchardt, R. Garthoff, K. Redeker, N. Or- Matsukevich, P. Maunz, S. Olmschenk, D. Hayes, L. Luo, T. A. tegel, M. Rau, and H. Weinfurter, Event-Ready Bell Test Using Manning, and C. Monroe Random numbers certified by Bell’s Entangled Atoms Simultaneously Closing Detection and Local- theorem, Nature 464, 1021 (2010). ity Loopholes, Phys. Rev. Lett. 119, 010402 (2017). [88] G. M. D’Ariano, P. L. Presti, and P. Perinotti, Classical ran- [66] S.-W. Ji, J. Lee, J. Lim, K. Nagata, and H.-W. Lee, Multisetting domness in quantum measurements, J. Phys. A: Math. Gen. 38, Bell inequality for qudits, Phys. Rev. A 78, 052103 (2008). 5979 (2005). [67] Y.-C. Liang, C.-W. Lim, and D.-L. Deng, Reexamination of a [89] https://replab.github.io multisetting Bell inequality for qudits, Phys. Rev. A 80, 052116 [90] D. Rosset, F. Montealegre-Mora, J-D. Bancal, RepLAB: a (2009). computational/numerical approach to representation theory, [68] J. Lim, J. Ryu, S. Yoo, C. Lee, J. Bang, and J. Lee, Gen- arXiv:1911.09154. uinely high-dimensional nonlocality optimized by complemen- [91] http://sdpa.sourceforge.net tary measurements, New J. Phys. 12, 103012 (2010). [92] M. Navascués, S. Pironio, and A. Acín, SDP relaxations [69] H. Bechmann-Pasquinucci and N. Gisin, Bell inequality for for non-commutative polynomial optimization, Handbook on quNits with binary measurements, Quantum Inf. Comput. 3, semidefinite, conic and polynomial optimization. International 157 (2003). series in operations research & management science 166, 601 [70] J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, (2012). Proposed Experiment to Test Local Hidden-Variable Theories, [93] M. Horodecki, P. Horodecki, and R. Horodecki, Separability Phys. Rev. Lett. 23, 880 (1969). of mixed states: necessary and sufficient conditions, Physics [71] S. Brierley, S. Weigert, and I. Bengtsson, All Mutually Unbi- Letters A. 223, 1–8 (1996) ased Bases in Dimensions Two to Five, Quantum Info. & Comp. [94] S. Boyd and L. Vandenberghe, Convex optimization, Cam- 10, 0803 (2010). bridge university press, 2004 [72] C. Jebarathinam, J-C. Hung, S-L. Chen, and Y-C. Liang, Maxi- [95] M. D. Choi, Completely positive linear maps on complex matri- mal violation of a broad class of Bell inequalities and its impli- ces, Linear algebra and its applications, 10(3), 285-290 (1975) cation on self-testing, Phys. Rev. Research 1, 033073 (2019). [96] A. Jamiołkowski, Linear transformations which preserve trace [73] J. Kaniewski, A weak form of self-testing, arXiv:1910.00706 and positive semidefiniteness of operators, Reports on Mathe- [74] D. S. Tasca, P. Sánchez, S. P. Walborn, and Ł. Rudnicki, Mu- matical Physics, 3(4), 275-278 (1972) tual unbiasedness in coarse-grained continuous variables, Phys. [97] S. Designolle, M. Farkas, and J. Kaniewski, Incompatibility ro- Rev. Lett. 120, 040403 (2018). bustness of quantum measurements: a unified framework, New [75] M. Krishna and K. R. Parthasarathy, An Entropic Uncertainty J. Phys. 21, 113053 (2019). Principle for Quantum Measurements, Indian Journal of Statis- [98] J. Kaniewski, M. Tomamichel, and S. Wehner, Entropic uncer- tics 64, (3) 842 (2002). tainty from effective anticommutators, Phys. Rev. A 90, 012332 [76] T. Heinosaari, T. Miyadera, and M. Ziman, An invitation to (2014). quantum incompatibility, Journal of Physics A: Mathematical and Theoretical 49, (12) 123001 (2016). 16

Appendix A: Bell inequalities for mutually unbiased bases

In this appendix we fill in some details on the Bell inequalities for MUBs. We start by deriving the local and quantum bounds and proving the device-independent certification result stated in the main text. Then, we proceed to show that no stronger characterisation of Bob’s measurement can be obtained from the maximal violation of our Bell inequality and, moreover, that the maximal violation is achieved by a single probability point.

1. Proof of the local and quantum values (Theorem II.1)

MUB a We begin by proving the quantum bound of the Bell functional for MUBs (Sd ). We denote Alice’s POVMs by {Ax}, Bob’s POVMs by {Pb} (for y = 1) and {Qb} (for y = 2) and the shared state by |ψi (without loss of generality we assume that the measurements are projective and the shared state is pure). For the moment, we focus on the first term contributing the the Bell MUB functional, namely Rd defined in Eq. (2). In a quantum model, we have

MUB X Rd = hψ|Ax ⊗ (Px1 − Qx2 ) |ψi, (A1) x

2 1 2 where the summation goes over x = x1x2 ∈ [d] and the observable Ax is defined as Ax ≡ Ax − Ax. In what follows, we will omit the tensor notation when Alice’s or Bob’s action is the identity. Applying the Cauchy–Schwarz inequality to every term in the summand of Eq. (A1) gives q MUB X p 1 2 2 Rd ≤ hψ|Ax + Ax|ψi hψ| (Px1 − Qx2 ) |ψi, (A2) x

2 1 2 where we have used the fact that for projective measurements (Ax) = Ax + Ax. In the next step we again use the Cauchy– P √ √ pP pP Schwarz inequality but in a different form: for si, ri ≥ 0 it holds that i si ri ≤ i si i ri with equality if and only if ∀i : si = k · ri for some proportionality constant k. This leads us to the bound s s MUB X 1 2 X 2 Rd ≤ hψ|Ax + Ax|ψi hψ| (Px1 − Qx2 ) |ψi. (A3) x x

We denote the sum under the first square-root by t. Also, we use projectivity and completeness to write

X 2 X (Px1 − Qx2 ) = Px1 + Qx2 − {Px1 ,Qx2 } = 2 (d − 1) 11. (A4) x x

MUB Then, we can return to the Bell functional Sd and bound it by r p 1 d − 1 SMUB ≤ 2(d − 1)t − t. (A5) d 2 d

To maximise the right-hand-side over t ≥ 0 we differentiate with respect to t to find a unique extremum at t = 2d. Re-inserting this value into Eq. (A5) returns the quantum bound given in Eq. (7). MUB To derive the classical bound on Sd given in Eq. (6) recall that it suffices to optimise over deterministic strategies. Moreover, once the strategy of Bob is fixed, finding the optimal strategy of Alice is easy. If Bob outputs b = u1 for y = 1 and b = u2 for y = 2, the Bell functional becomes r X 1 d − 1 X SMUB = (δ − δ ) hψ|A1 − A2 |ψi − hψ|A1 + A2 |ψi. (A6) d x1,u1 x2,u2 x x 2 d x x x x

2 2 We define R± = {x ∈ [d] |δx1,u1 − δx2,u2 = ±1} and R0 = [d] \ (R+ ∪ R−). By expanding the above expression for MUB 1 Sd into the separate sums over R+, R− and R0 it becomes clear that the optimal choice of Alice is to choose Ax = 11 and 2 ⊥ 2 1 ⊥ Ax = Ax = 0 (always output a = 1) when x ∈ R+, choose Ax = 11 and Ax = Ax = 0 (always output a = 2) when x ∈ R− ⊥ 1 2 and choose Ax = 11 and Ax = Ax = 0 (always output a =⊥) when x ∈ R0. Since |R±| = d − 1, this leads to the classical bound in Eq. (6). 17

2. Device-independent certification (Theorem III.1)

In this section we show what can be deduced about the measurements of Bob and the shared state based only on observing the maximal violation. In the last part we show that the condition obtained for Bob’s measurement is complete, i.e. it cannot be strengthened in any way. To simplify the notation we assume that the marginal states of Alice and Bob are full-rank (in any case no information can be deduced outside of the support of the state). Moreover, since we do not aim to certify the measurements of Alice we can without loss of generality assume that they are projective. For Bob, on the other hand, we do not make such an assumption and projectivity is rigorously deduced. In the arguments below we assume that the state shared between Alice and Bob is pure. However, if Alice and Bob share a mixed state we simply purify it using an additional register and apply the arguments below to the purification. Since the purification register remains untouched throughout the argument, it is clear that the same conclusions hold if Alice and Bob share a mixed state.

a. Measurements of Bob

MUB In the previous section we have derived an upper bound on the quantum value of the Bell functional Rd . Since the resulting bound is tight, our argument must be tight at every step. By examining each step of the argument we can deduce certain relations that must be satisfied by any quantum realisation that produces the maximal violation. MUB Eq. (A2) is obtained by applying the Cauchy–Schwarz inequality to the Bell functional Rd in Eq. (A1). Saturating the Cauchy–Schwarz inequality implies that for all x we have

Ax|ψi = µx (Px1 − Qx2 ) |ψi, (A7)

for some complex number µx. Left-multiplying both sides by hψ|(Px1 −Qx2 ), one deduces that µx is real and non-negative. The non-negativity stems from the fact that we have previously used that hψ|Ax ⊗ (Px1 − Qx2 ) |ψi ≤ |hψ|Ax ⊗ (Px1 − Qx2 ) |ψi|. Also, Eq. (A7) implies that

2 2 2 hψ|(Ax) |ψi = µxhψ| (Px1 − Qx2 ) |ψi. (A8) The fact that the second application of the Cauchy–Schwarz inequality, which leads to Eq. (A3), is tight implies that 2 1 2 2 hψ|(Ax) |ψi = hψ|Ax + Ax|ψi = νhψ| (Px1 − Qx2 ) |ψi for some constant ν > 0. This implies that µ1 = µ2 = ... = µd2 ≡ µ. Finally, note that Eq. (A4) holds if and only if all the measurements of Bob are projective and since we used it to derive our upper bound, we conclude that all the measurements of Bob must be projective. Summing Eq. (A8) over x we obtain

t = 2µ2(d − 1), (A9)

P 2 where t ≡ xhψ|(Ax) |ψi. Just after Eq. (A5) we found that the optimal value of t is given by t = 2d, which implies

r d µ = . (A10) d − 1 Thus, we have established the useful relation

r d A |ψi = (P − Q ) |ψi. (A11) x d − 1 x1 x2

Since the measurements of Alice are projective, the spectra of Ax only contain the values {+1, −1, 0} and, hence, the observ- 3 ables must satisfy (Ax) = Ax. Using this in Eq. (A11) gives

r d  d 3/2 (P − Q ) |ψi = (P − Q )3 |ψi. (A12) d − 1 x1 x2 d − 1 x1 x2

Note that we have managed to eliminate the operators of Alice from the equation. Therefore, we can trace out Alice’s system and subsequently right-multiply by the inverse of Bob’s local state (which we assume to be full-rank). This leaves us with d P − Q = (P − Q )3 , (A13) x1 x2 d − 1 x1 x2 18 which using projectivity can be simplified to

Px1 − Qx2 = d (Px1 Qx2 Px1 − Qx2 Px1 Qx2 ) . (A14)

Summing over x1 we obtain X 11 = d Px1 Qx2 Px1 . (A15)

x1

Since {Px1 } are orthogonal, this implies that

Px1 = dPx1 Qx2 Px1 , (A16) which is the desired relation. Analogously, summing Eq. (A14) over x2 leads to

Qx2 = dQx2 Px1 Qx2 . (A17)

b. The shared state

MUB Here we show that if Alice and Bob observe the maximal quantum value of Sd , then there exist local operations which allow them to extract a maximally entangled state of local dimension d. More specifically, if |ψi ∈ HA ⊗ HB is the state shared d d between Alice and Bob, then we explicitly construct isometries VA : HA → C ⊗ HA and VB : HB → C ⊗ HB such that max (VA ⊗ VB)|ψi = |ψd i ⊗ |ψauxi. (A18)

d d As usual these isometries are constructed out of the measurement operators: {Ax}x∈[d]2 for Alice and {Pj}j=1 and {Qk}k=1 for Bob. d Let us start with the construction on Bob’s side. Bob starts by applying an isometry R : HB → C ⊗ HB defined as X R = |ji ⊗ Pj. (A19) j

d d Note that all the summations in this section go over [d]. Then, he applies a unitary S : C ⊗ HB → C ⊗ HB defined as X S = |kihk| ⊗ Uk, (A20) k where X Uk = d PjQ1Pj+k. (A21) j

Note that the integer j +k in the subscript is taken modulo d with the possible values in {1, 2, . . . , d}. The fact that the operators d {Uk}k=1 are indeed unitaries is a direct consequence of Eqs. (A16) and (A17). In fact, they correspond to a cyclic shift of the measurement operators {Pj}:

† UkPjUk = Pj−k. (A22) The combined extraction procedure on Bob’s side reads: X X VB = SR = |ji ⊗ UjPj = d |ji ⊗ PdQ1Pj. (A23) j j

To construct an isometry on Alice’s side we first construct operators which on act on Alice’s side analogous to how Pj and Uj act on Bob’s side. Summing Eq. (A11) over one of the indices implies that 1 X P |ψi = 11 + µ−1 A
|ψi, (A24) x1 d x x2 1 X Q |ψi = 11 − µ−1 A
|ψi (A25) x2 d x x1 19 and recall that r = pd/(d − 1). This motivates us to define the following operators on Alice’s side:

1 −1 X
Pex1 = 11 + µ Ax , (A26) d x2 1 −1 X
Qex2 = 11 − µ Ax . (A27) d x1 The cross relations

(Pex1 ⊗ 11)|ψi = (11 ⊗ Px1 )|ψi, (A28)

(Qex2 ⊗ 11)|ψi = (11 ⊗ Qx2 )|ψi. (A29) ensure that the new operators of Alice satisfy the same algebraic relations as the old operators of Bob. For instance to show projectivity note that

(P ⊗ )|ψi = ( ⊗ P )|ψi = ( ⊗ P 2 )|ψi = (P 2 ⊗ )|ψi. ex1 11 11 x1 11 x1 ex1 11 (A30) Tracing out the system of Bob gives

P ρ = P 2 ρ . ex1 A ex1 A (A31) −1 Right-multiplying by ρA (recall the full-rank marginal assumption) leads to P = P 2 . ex1 ex1 (A32)

Summing over x1 in Eq. (A28) gives X ( Pex1 ⊗ 11)|ψi = |ψi. (A33) x1

−1 Tracing over Bob’s system and right-multiplying by ρA implies X Pex1 = 11. (A34) x1 To see that they satisfy relations analogous to Eqs. (A16) note that

(Pex1 ⊗ 11)|ψi = (11 ⊗ Px1 )|ψi = d(11 ⊗ Px1 Qx2 Px1 )|ψi = d(Pex1 ⊗ Px1 Qx2 )|ψi (A35)

= d(Pex1 Qex2 ⊗ Px1 )|ψi = d(Pex1 Qex2 Pex1 ⊗ 11)|ψi (A36) and therefore

Pex1 = dPex1 Qex2 Pex1 . (A37) By symmetry they also satisfy

Qex2 = dQex2 Pex1 Qex2 . (A38) This implies that X Uek = d PejQe1Pej+k (A39) j are valid unitaries on HA. Moreover, it is easy to check that

† (Uek ⊗ 11)|ψi = (11 ⊗ Uk )|ψi. (A40) Now we are ready to define the local isometry on Alice’s side. Again, it consists of two parts X Re = |ji ⊗ Pej, (A41) j X Se = |kihk| ⊗ Uek (A42) k 20 and the combined extraction isometry on Alice’s side reads X VA = SeRe = |ji ⊗ UejPej. (A43) j Applying the local isometries to the initial state gives X |ψouti = (VA ⊗ VB)|ψi = |jki ⊗ (UejPej ⊗ UkPk)|ψi. (A44) jk Since

(Pej ⊗ Pk)|ψi = (11 ⊗ PkPj)|ψi = δjk(11 ⊗ Pj)|ψi, (A45) the cross terms necessarily vanish: X |ψouti = |jji ⊗ (Uej ⊗ UjPj)|ψi. (A46) j Moreover, Eqs. (A40) and (A22) imply that

† (Ufj ⊗ UjPj)|ψi = (11 ⊗ UjPjUj )|ψi = (11 ⊗ Pd)|ψi, (A47) which gives √ max |ψouti = |ψd i ⊗ d(11 ⊗ Pd)|ψi, (A48) max where |ψd i is the standard maximally entangled state of local dimension d. Since |ψouti must be a normalised state, we immediately deduce that 1 hψ|11 ⊗ P |ψi = . (A49) d d

However, it is intuitively clear that our choice of Pd is arbitrary. A slightly different definition of Uk in Eq. (A21) would lead to the same conclusion for an arbitrary Px1 , while swapping the two measurements implies the same for all Qx2 . Therefore, as a side result of this argument we conclude that the maximal violation necessarily implies that the marginal distributions on Bob are uniform, i.e.: 1 hψ|11 ⊗ P |ψi = hψ|11 ⊗ Q |ψi = (A50) x1 x2 d for all x1, x2.

c. The condition obtained for Bob’s measurements is complete

MUB In AppendixA2a we have shown that if Bob’s measurements are capable of producing the maximal violation of Sd , they must satisfy

Pa = dPaQbPa and Qb = dQbPaQb (A51) for all a, b ∈ [d]. To show that no stronger characterisation of Bob’s measurements is possible based only on the observed Bell violation, we show that any pair of measurements acting on a finite-dimensional Hilbert space which satisfy these relations can MUB be used to produce the maximal violation of Sd . 2 2 By summing the equations in Eq. (A51) over b and a respectively, the completeness relation implies Pa = Pa and Qb = Qb . Hence, Bob’s measurements are projective. Moreover, from Ref. [92] we know that Eq. (A51) implies that all the measurement operators have equal traces, i.e. for all a, b we have

tr (Pa) = tr (Qb) = n. (A52) for some integer n. Denoting the dimension of the Hilbert space by D, the completeness relation gives

d X D = tr (11) = tr (Pa) = dn. (A53) a=1 21

Let us now define Kab = Pa − Qb. Expanding and applying relations (A51) lead to d K = K3 . (A54) ab d − 1 ab p This implies that the possible eigenvalues of Kab belong to {0, ± (d − 1)/d}. However, from Eq. (A52) it follows that tr (Kab) = 0, which means that there are as many positive eigenvalues of Kab as there are negative ones. In order to find the number of such pairs of eigenvalues, we evaluate d − 1 tr K2
= tr (P + Q − {P ,Q }) = 2n − tr ({P ,Q }) = 2n − 2 tr (P Q P ) = 2n , (A55) ab a b a b a b a b a d where we have used that tr(PaQb) = tr(PaQbPa) and the relations (A51). Hence, Kab has n pairs of non-zero eigenvalues. MUB Now we are ready to construct a quantum realisation which achieves the maximal quantum value of Sd using the measure- ments of Bob discussed above. We assume that the system of Alice is of the same dimension D, that Alice and Bob share the |ψmaxi A = pd/(d − 1)KT A maximally entangled state D and define Alice’s observables as x x1x2 . Notably, the eigenvalues of x MUB come from {0, ±1}, so it is a valid observable. The Bell functional Rd then reads r r X d X 1 d X p RMUB = hψmax|A ⊗K |ψmaxi = hψmax|11⊗(K )2|ψmaxi = tr (K )2
= 2 d(d − 1), d D x x1x2 D d − 1 D x1x2 D D d − 1 x1x2 x x x (A56) max T max where we have used that for any linear operator O we have O ⊗ 11|ψD i = 11 ⊗ O |ψD i, the fact that the local state of Bob is 11/D, and the equations (A55) and (A53). Moreover, it is easy to check that X X d p γ hψmax|(A )2 ⊗ 11|ψmaxi = γ tr (K )2
= d(d − 1). (A57) d D x D d D(d − 1) x1x2 x x In conclusion, we arrive at

MUB MUB X max 2 max p Sd = Rd − γd hψD |(Ax) ⊗ 11|ψD i = d(d − 1), (A58) x which concludes the proof.

3. Maximal quantum violations for MUBs imply a unique probability distribution

In this section we show that the relations derived in AppendixA2 are sufficient to reconstruct the entire probability distri- bution. This implies that the maximal violation is achieved by a unique probability point. In this section we only explicitly compute the probabilities which involve the first two outcomes of Alice. Clearly, the probabilities including the third outcome are determined by normalisation. Recall that in Eq. (A11) we established that 1 2
Ax|ψi = Ax − Ax |ψi = µ (Px1 − Qx2 ) |ψi, (A59) where µ = pd/(d − 1). This immediately implies that

2 1 2
2 2 (Ax) |ψi = Ax + Ax |ψi = µ (Px1 − Qx2 ) |ψi. (A60) By taking the sum and difference of Eq. (A59) and Eq. (A60), we obtain µ A1 |ψi = [(µ + 1) P + (µ − 1) Q − µ{P ,Q }] |ψi x 2 x1 x2 x1 x2 µ (A61) A2 |ψi = [(µ − 1) P + (µ + 1) Q − µ{P ,Q }] |ψi. x 2 x1 x2 x1 x2 This allows us to write down the probabilities in terms of expectation values involving only Bob’s operators: µ hψ|A1 ⊗ P |ψi = (µ + 1)δ hP i + µ(1 − δ ) − 1hQ P i − µhP Q P i
, (A62) x u 2 x1u x1 x1u x2 u x1 x2 u µ hψ|A2 ⊗ P |ψi = (µ − 1)δ hP i + µ(1 − δ ) + 1hQ P i − µhP Q P i
, (A63) x u 2 x1u x1 x1u x2 u x1 x2 u µ hψ|A1 ⊗ Q |ψi = (µ − 1)δ hQ i + µ(1 − δ ) + 1hP Q i − µhQ P Q i
, (A64) x u 2 x2u x2 x2u x1 u x2 x1 u µ hψ|A2 ⊗ Q |ψi = (µ + 1)δ hQ i + µ(1 − δ ) − 1hP Q i − µhQ P Q i
, (A65) x u 2 x2u x2 x2u x1 u x2 x1 u 22 where h·i denotes the expectation value with respect to |ψi. In the previous section we have already showed that hPui = hQui = 1 d for all y. To compute the remaining terms we take advantage of the extraction isometries proposed before. Intuitively, we manage to replace the expectation values of the original measurement operators on the original unknown states by the expectation values of the extracted measurement operators on the maximally entangled state. More specifically, we use the fact that since † VBVB = 11, for any linear operator O on Bob’s side we have

† † † † hOi = tr(OρB) = tr(VBVBOVBVBρB) = tr(VBOVB · VBρBVB). (A66)

In the previous section we have shown that

† VBρBVB = 11 ⊗ PdρBPd. (A67)

Then, Eq. (A23) implies that

† 2 X VBPuQvVB = d |uihk| ⊗ PdQ1PuQvPkQ1Pd, (A68) k which leads to 1 1 hP Q i = tr(V P Q V † · V ρ V † ) = hP i = . (A69) u v B u v B B B B d d d2

∗ 2 Clearly, we also have hQvPui = hPuQvi = 1/d . Similarly, we have

† 2 VBPuQvPwVB = d |uihw| ⊗ PdQ1PuQvPwQ1Pd, (A70) which leads to δ δ hP Q P i = tr(V P Q P V † · V ρ V † ) = uw hP i = uw . (A71) u v w B u v w B B B B d d d2 To compute the expectation values we have used a particular extraction. If we know consider an extraction procedure which swaps the roles of the first and second measurement of Bob, by symmetry we will conclude that

δ hQ P Q i = uw . (A72) u v w d2 Having computed all the necessary terms we can simply write down the probabilities:   q  1 1 + d−1 if x = u, 1  2d d 1 hψ|Ax ⊗ Pu|ψi = 1  q d−1   2d(d−1) 1 − d otherwise.   q  (A73) 1 1 − d−1 if x = u, 2  2d d 1 hψ|Ax ⊗ Pu|ψi = 1  q d−1   2d(d−1) 1 + d otherwise. and   q  1 1 − d−1 if x = u, 1  2d d 2 hψ|Ax ⊗ Qu|ψi = 1  q d−1   2d(d−1) 1 + d otherwise.   q  (A74) 1 1 + d−1 if x = u, 2  2d d 2 hψ|Ax ⊗ Qu|ψi = 1  q d−1   2d(d−1) 1 − d otherwise.

In particular, it is easy to check that

1 hψ|A1 |ψi = hψ|A2 |ψi = . (A75) x x d 23

Appendix B: Mutually unbiased measurements

In this appendix, we analyse the structure of mutually unbiased measurements (MUMs). As a reminder, we repeat the definition:

d d Definition B.1. Two d-outcome measurements {Pa}a=1 and {Qb}b=1 acting on the Hilbert space H are mutually unbiased if

Pa = dPaQbPa and Qb = dQbPaQb, (B1) for all a and b. In the following, we define three natural subclasses of MUMs, introduce technical tools for analysing their structures, and through low-outcome number examples we deduce how these subclasses relate to each other.

1. Three relevant subclasses

d d Let P = {Pa}a=1 and Q = {Qb}b=1 be a pair of d-outcome MUMs acting on H. d Definition B.2. We say that P and Q are mutually unbiased bases (MUBs) if H = C and the measurement operators√ are rank-one projectors Pa = |uaihua|, Qb = |vbihvb|. Note that the MUM conditions in Eq. (B1) imply that |hua|vbi| = 1/ d. L d L j Definition B.3. We say that P and Q are a direct sum of mutually unbiased bases if H = j C and Pa = j Pa ,Qb = L j j j j Qb, where for every j the pair P and Q are mutually unbiased bases. In the following, we will denote this class by MUB⊕.

Definition B.4. We say that P and Q are MUB-extractable if there exists a completely positive unital map Λ: B(H) → B(Cd) such that the measurements defined as

0 0 Pa = Λ(Pa) and Qb = Λ(Qb) (B2) are mutually unbiased bases. In the following, we will denote this class by MUBext. It follows directly from the above definitions that

MUB ( MUB⊕ ⊆ MUBext ⊆ MUM, (B3) where the first inclusion is trivially seen to be strict. In the remainder of this appendix, we show that in general all of the above inclusions are strict.

2. Technical tools

In this section we introduce some technical tools to analyse the structure of MUMs. First, following Ref. [92], we derive a canonical form of MUMs in which they are fully characterised by a collection of unitary operators. Then, we provide a necessary and sufficient condition for MUMs to be unitarily equivalent to a direct sum of MUBs in terms of these unitaries. Lastly, we derive a generic lemma on the extractability of arbitrary sets of Hermitian operators via completely positive unital maps. In the subsequent section, we apply these techniques to analyse the inclusions within the MUM subclasses for outcome numbers d = 2, 3, 4, 5. In this appendix we use H to denote a separable Hilbert space, B(H) to denote the set of bounded operators acting on H and BH (H) to denote the set of bounded Hermitian operators acting on H.

a. Canonical form of mutually unbiased measurements

d d Let us take a pair of MUMs {Pa}a=1 and {Qb}b=1 on a separable Hilbert space H. That is, measurements that satisfy the relations in Eq. (B1), namely

∀a, b : Pa = dPaQbPa and Qb = dQbPaQb. (B4)

Following Ref. [92] we provide a characterisation of such a measurement pair. 24

First,√ note that these conditions imply projectivity, which can be seen by summing over the middle term. Then, defining Oab = dPaQb, it is easy to see that

† OabOab = Pa, (B5) † OabOab = Qb. (B6)

This means that all the projectors are isomorphic, i.e. either all Pa,Qb are finite-rank (and then tr Pa = tr Qb = n for all a, b for P some fixed n ∈ N) or none of them is. Let Ha denote the subspace on which Pa projects. The completeness relation a Pa = 11 implies that

d M H' Ha. (B7) a=1 However, the fact that all these Hilbert spaces are isomorphic allows us to write

0 d H'H ⊗ C (B8) for some other (potentially infinite-dimensional but still separable) Hilbert space H0. Then, the first measurement reads

Pa = 11 ⊗ |aiha|, (B9)

d d where {|ai}a=1 is an orthonormal basis on C . The second measurement can be written as 1 X Q = Xb ⊗ |jihk| (B10) b d jk jk

b 0 † b b † for some operators Xjk ∈ B(H ). Since Qb = Qb, we must have that Xjk = [Xkj] . Moreover, it is easy to show that all the b Xjk are unitary. Note that

2 d PjQbPkQbPj = dPjQbPj = Pj = 11 ⊗ |jihj|. (B11)

On the other hand, a direct calculation gives

2 b b d PjQbPkQbPj = XjkXkj ⊗ |jihj|. (B12)

b b † b b † b † b Since Xkj = [Xjk] , we obtain Xjk[Xjk] = 11, and by symmetry [Xjk] Xjk = 11. The first MUM condition PjQbPj = Pj/d implies that

b Xjj = 11 (B13) for all j and b. The second MUM condition has an interesting implication: QbPjQb = Qb/d leads to

b b b Xjk = XjaXak (B14)

b for all j, k, a, b. In other words, the entire projector Qb is determined by only d of the Xjk operators. For instance, we can write

b b b Xjk = Xj1X1k (B15)

b and recall that X11 = 11. The structure derived above allows us to introduce a unitary transformation on H. Let

X 1 U ≡ X1j ⊗ |jihj|. (B16) j

† Clearly, UPaU = Pa, and 1 X Q0 ≡ UQ U † = X1 Xb X1 ⊗ |jihk|. (B17) b b d 1j jk k1 jk 25

It is easy to see that

0 Q1 = 11 ⊗ |vihv|, (B18) where

d 1 X |vi = √ |ji (B19) d j=1

0 is a uniform superposition of all the basis states. In other words, this unitary transformation fixes the form of Q1. 0 Now we characterise the remaining Qb. Let

b 1 b 1 Yjk ≡ X1jXjkXk1. (B20)

b b b b b b These are still unitary and it holds for these operators as well that Yjj = 11 and Yjk = Yj1Y1k. Let us denote Vj ≡ Yj1, and therefore 1 X Q0 = V b(V b)† ⊗ |jihk|. (B21) b d j k jk

1 b 0 0 0 From the previous arguments we have that Vj = V1 = 11 for all j, b. The orthogonality constraint QbQb0 = 0 for b 6= b implies

X b † b0 0 (Vj ) Vj = 0 ∀b 6= b , (B22) j

P 0 whereas the completeness relation b Qb = 11 gives

X b b † Vj (Vk ) = δjkd 11. (B23) b

The following two propositions, whose results appeared originally in Ref. [92], summarise the observations we have made so far.

d d Proposition B.5. Let {Pa}a=1 and {Qb}b=1 be two d-outcome mutually unbiased measurements on a separable Hilbert space H. Then, the Hilbert space H is isomorphic to H0 ⊗ Cd, for some Hilbert space H0, and the measurement operators can be written as

Pa = 11 ⊗ |aiha|, 1 X Q = V b(V b)† ⊗ |jihk|, b d j k jk b b † b † b Vj (Vj ) = (Vj ) Vj = 11 ∀j, b, 1 b (B24) Vj = V1 = 11 ∀j, b, X b † b0 0 (Vj ) Vj = 0 ∀b 6= b , j X b b † Vj (Vk ) = δjkd 11 ∀j, k. b

b We will refer to the representation of {Pa} and {Qb} in terms of {Vj } as the canonical form.

b. Condition for equivalence to direct sum of MUBs

In the following, we show a necessary and sufficient condition for a pair of MUMs to be unitarily equivalent to a direct sum of MUBs.

d d Proposition B.6. For a pair of MUMs {Pa}a=1 and {Qb}b=1 the following statements are equivalent: 26

b 1. If we represent {Pa} and {Qb} in the canonical form, then all the {Vj } matrices commute:

b b0 0 0 [Vj ,Vj0 ] = 0 ∀j, j , b, b . (B25)

2. The measurements {Pa} and {Qb} correspond to a direct sum of MUBs.

b Proof. The fact that (2) =⇒ (1) is clear, so let us focus on (1) =⇒ (2). From Eq. (B25) it follows that all the Yjk operators commute, i.e. that

b b0 [Yjk,Yj0k0 ] = 0 (B26)

0 0 0 0 for all j, j , k, k , b, b . This implies that one can find a basis on H denoted by {|eni}n such that

b X jk,b Yjk = λn |enihen|, (B27) n

jk,b with |λn | = 1. Then X Qb = |enihen| ⊗ Tn,b, (B28) n where 1 X T ≡ λjk,b|jihk|. (B29) n,b d n jk

Since Qb is Hermitian, so must be the operators Tn,b, and since Qb is projective, the operators Tn,b are also projectors. In fact, b jj,b one can compute the trace to verify that they are rank-one projectors. Since Yjj = 11, we have that λn = 1, and

1 X tr T = λjj,b = 1. (B30) n,b d n j

1 d d We also have that ha|Tn,b|ai = d , and therefore {|aiha|}a=1 and {Tn,b}b=1 form a pair of MUBs in dimension d. By looking at Eqs. (B24) and (B28) we immediately see that {Pa} and {Qb} can be written as direct sums of MUBs. 

c. Condition for non-extractability

In this section we derive a condition guaranteeing that a pair of MUMs cannot be transformed into a pair of MUBs under the action of a completely positive unital map. This condition can be understood as a certificate that the particular pair of MUMs does not belong to the class MUBext defined earlier. Let us start with a more general technical statement. In the following we use the fact that for a Hermitian bounded operator M its spectrum, denoted by spec(M), is a bounded and closed subset of R and hence max{spec(M)} is well-defined.

n n Lemma B.7. Let {Ak}k=1 ⊂ BH (HA) be a set of bounded Hermitian operators on HA, and {Bk}k=1 ⊂ BH (HB) be a set of bounded Hermitian operators on HB such that dim HB < ∞. Then, if

n  X T o X 2 dim HB · max spec Ak ⊗ Bk < tr Bk, (B31) k k then there does not exist a completely positive unital map Λ: B(HA) → B(HB) such that Λ(Ak) = Bk for all k = 1, . . . , n. Proof. The existence of the above unital map can be written as the semidefinite programming feasibility problem [94]

C ∈ BH (HA ⊗ HB) C ≥ 0 (B32) trA C = 11B  T
 trA C Ak ⊗ 11B = Bk ∀k, 27 due to the Choi–Jamiołkowski isomorphism [95, 96]. Let us define Hermitian dual variables X ∈ BH (HA ⊗HB), Y ∈ BH (HB) and Zk ∈ BH (HB) for the above constraints, and define the Lagrangian function   X h   T
 i L(X,Y, {Zk}) ≡ sup tr(XC) + tr [Y (11B − trA C)] + tr Zk Bk − trA C Ak ⊗ 11B , (B33) C∈BH (HA⊗HB ) k which is guaranteed to be real. We also define the dual problem

L(X,Y, {Zk}) < 0 (B34) X ≥ 0.

The primal in Eq. (B32) and the dual are weak alternatives, that is, they cannot be both feasible (there do not exist variables C, X, Y and Zk satisfying all the constraints in both Eqs. (B32) and (B34)), because in that case we would have

X h   T
 i 0 > L(X,Y, {Zk}) ≥ tr(XC) + tr [Y (11B − trA C)] + tr Zk Bk − trA C Ak ⊗ 11B ≥ 0, (B35) k which is a contradiction. Therefore, if we find a feasible point for the dual in Eq. (B34), then the primal in Eq. (B32) is infeasible. Let us rewrite the Lagrangian in Eq. (B33) as   h X T
i X L(X,Y, {Zk}) = sup tr C X − 11A ⊗ Y − Ak ⊗ 11B (11A ⊗ Zk) + tr Y + tr(ZkBk) C∈B (H ⊗H ) H A B k k (B36) 0 X ≡ sup tr(CX ) + tr Y + tr(ZkBk), C∈BH (HA⊗HB ) k

0 P T
where we have defined X = X − 11A ⊗ Y − k Ak ⊗ Zk and used the fact that the dual map of the partial trace is ∗ 0 trA(.) = 11A ⊗ (.). In order to have L(X,Y, {Zk}) < +∞, we need to set X = 0, because there is no restriction imposed on C in the dual problem. Therefore, an equivalent formulation of the dual feasibility problem in Eq. (B34) is X tr Y + tr(ZkBk) < 0 k (B37) X T
11A ⊗ Y + Ak ⊗ Zk ≥ 0. k

We choose the ansatz Y = y11B and Zk = −zBk with y, z ∈ R, and substitute it into Eq. (B37), which gives

X 2 y · dim HB − z · tr Bk < 0 k (B38) X T
y11 − z · Ak ⊗ Bk ≥ 0. k

P T
Satisfying the second constraint in general requires y ≥ 0 (specifically if k Ak ⊗ Bk is not full rank), and therefore we also need z ≥ 0 in order to satisfy the first constraint. In order to get the lowest value in the first constraint, it is desirable to satisfy the second inequality with equality, which leads to

n  X T o y = z · max spec Ak ⊗ Bk . (B39) k Plugging this into Eq. (B38) gives   n  X T o X 2 z · dim HB · max spec Ak ⊗ Bk − tr Bk < 0 k k (B40) z ≥ 0, which is feasible whenever

n  X T o X 2 dimHB · max spec Ak ⊗ Bk < tr Bk. (B41) k k

 28

y y=1,...,n Remark B.8. Consider two sets of n projective measurements with m outcomes, {Ab }b=1,...,m ⊂ BH (HA) and y y=1,...,n {Bb }b=1,...,m ⊂ BH (HB). Since for positive semidefinite operators max{spec(M)} = kMk, where k.k is the operator norm, in this case the criterion in Eq. (B31) reads

X y T y (Ab ) ⊗ Bb < n. (B42) y,b

P y T y Using the triangle inequality and the fact that every b(Ab ) ⊗ Bb is a projection, we have that

X y T y X X y T y (Ab ) ⊗ Bb ≤ (Ab ) ⊗ Bb = n. (B43) y,b y b

The saturation of this inequality is equivalent to the existence of a state |ψi ∈ HA ⊗ HB such that

X y T y hψ| (Ab ) ⊗ Bb |ψi = 1 ∀y. (B44) b Therefore, Eq. (B31) for two sets of n projective measurement is equivalent to the non-existence of a state |ψi such as in Eq. (B44).

3. Examples

In this section, using the above techniques, we show that for outcome numbers d = 2 (3), every MUM pair is unitarily equivalent to a direct sum of MUBs in dimension 2 (3). Therefore, for d = 2 and 3, MUB⊕ = MUBext = MUM. However, we also show that this is not the case for d = 4 and 5, where we show explicit examples of MUM pairs that are not MUB-extractable. This shows that in general MUBext ( MUM.

a. Outcome numbers 2 and 3

Proposition B.9. For d = 2 and d = 3, every pair of mutually unbiased measurements can be written as a direct sum of d-dimensional MUBs. Proof. From Eq. (B24) it is clear that for every pair of MUMs we have that

1 b Vj = V1 = 11 ∀b, j, X b Vj = 0 ∀b 6= 1, j (B45) X b Vj = 0 ∀j 6= 1. b

b 1 1 2 2 b For d = 2 this fixes all Vj , that is, V1 = V2 = V1 = 11, whereas V2 = −11. Then all Vj commute, and by Proposition B.6 the measurements are direct sums of 2-dimensional MUBs. 1 1 1 2 3 2 For the d = 3 case, we have that V1 = V2 = V3 = V1 = V1 = 11. Let us denote V2 = V . Then from Eq. (B45) it follows 2 3 3 b that V3 = V2 = −11 − V and V3 = V , and again all the matrices {Vj } commute. 

b. Outcome numbers 4 and 5

5 5 Let us now construct two 5-outcome MUMs {Pa}a=1 and {Qb}b=1 in dimension 10, such that they are not MUB-extractable. 2 5 We will define the operators Pa and Qb formally on the space B(C ⊗ C ), and we will denote the qubit Pauli operators by X, Y and Z. We define the Pa operators as

Pa = 112 ⊗ |aiha|, (B46) 5 5 where {|ai}a=1 is the computational basis on C , and the first Q operator as 5 1 X Q1 = 112 ⊗ |vihv|, |vi = √ |ji. (B47) 5 j=1 29

For the next three Q operators, we define unitaries that will transform Q1 into Q2, Q3 and Q4: 5 X b Ub = Uj ⊗ |kihk|, b = 2, 3, 4, (B48) j=1 where √ √ 2 2 2 1 3 2 1 3 2 U1 = Z,U2 = X,U3 = − X + Y,U4 = − X − Y,U5 = −Z, √ 2 2 2 2 √ 1 3 1 3 3 3 3 3 3 (B49) U1 = Z,U2 = − X − Y,U3 = −Z,U4 = X,U5 = − X + Y, 2 2 √ √ 2 2 1 3 1 3 U 4 = Z,U 4 = −Z,U 4 = − X − Y,U 4 = − X + Y,U 4 = X 1 2 3 2 2 4 2 2 5 b (note that these unitaries are not the same as the Vj in Eq. (B24)). Using these unitaries, we define † Qb = UbQ1Ub , b = 2, 3, 4, (B50) and finally,

Q5 = 1110 − Q1 − Q2 − Q3 − Q4. (B51) 5 5 Proposition B.10. The measurements {Pa}a=1 and {Qb}b=1 defined in Eqs. (B46), (B47), (B50) and (B51) are mutually unbiased, but they are not MUB-extractable. Proof. It is straightforward to check that these measurements satisfy the relations in Eq. (B4), and are therefore MUMs (see the attached Mathematica file “dim5.nb”). Now we will show, using Lemma B.7, that there does not exist a completely positive 10 5 unital map Λ: B(C ) → B(C ) such that Λ(Pa) = Aa and Λ(Qb) = Bb, where Aa and Bb are projectors onto a pair of MUBs in dimension 5. From Ref. [71], we know that up to a global unitary transformation and the reordering of the elements of {Bb}, every pair of MUBs in dimension 5 can be written as † Aa = |aiha|,Bb = F5AbF5 , (B52) where F5 is the Fourier matrix in dimension five, defined by its elements

1 (a−1)(b−1) 2πi ha|F5|bi = √ ω , a, b = 1,..., 5, ω = e 5 . (B53) 5 10 5 According to Remark B.8 and Eq. (B44) therein, a completely positive unital map Λ: B(C ) → B(C ) such that Λ(Pa) = Aa 10 5 and Λ(Qb) = Bb does not exist, if there does not exist a state |ψi ∈ C ⊗ C , such that X T X T hψ| Pa ⊗ Aa|ψi = hψ| Qb ⊗ Bb|ψi = 1. (B54) a b 10 5 Note that due to the freedom in permuting the elements of {Bb}, we need to check whether a state |ψi ∈ C ⊗ C exists such that X T X T hψ| Pa ⊗ Aa|ψi = hψ| Qb ⊗ Bσ(b)|ψi = 1 (B55) a b for every permutation σ ∈ S5 on the set {1, 2, 3, 4, 5}. P T In order to rule out the existence of such a state, first notice that the operator a Pa ⊗ Aa =: P is a projection. Therefore, if a state |ψi such as in Eq. (B55) exists, then we have that P|ψi = |ψi, and therefore

X T hψ|P Qb ⊗ Bσ(b)P|ψi = 1. (B56) b

However, using the fact that for any operator M, kMk∞ ≤ kMk2, where k·kp is the Schatten p-norm, we have that

X T X T X T hψ|P Qb ⊗ Bσ(b)P|ψi ≤ P Qb ⊗ Bσ(b)P ≤ P Qb ⊗ Bσ(b)P ∞ 2 b b b v u ! (B57) u X T X T = ttr P Qb ⊗ Bσ(b)P Qb0 ⊗ Bσ(b0)P < 1 ∀σ ∈ S5, b b0 30 which is straightforward to verify (see the attached Mathematica file “dim5.nb”).  4 4 Let us also provide an explicit example of a pair of 4-outcome MUMs {Pa}a=1 and {Qb}b=1 in dimension 8, such that they are not MUB-extractable. Similarly to the previous example, we write

Pa = 112 ⊗ |aiha|, 4 1 X (B58) Q = 11 ⊗ |vihv|, |vi = |ji, 1 2 2 j=1 and we define U2 that will transform Q1 into Q2:

4 X 2 U2 = Uj ⊗ |kihk|, (B59) j=1 where 1 1 1 1 U 2 = √ (X + Y + Z),U 2 = √ (X − Y − Z),U 2 = √ (−X + Y − Z),U 2 = √ (−X − Y + Z). (B60) 1 3 2 3 3 3 4 3 Using these unitaries, we define

† Q2 = U2Q1U2 . (B61) Next, let us define  1 0 0 −1 −1 0 0 1   0 1 1 0 0 −1 −1 0     0 1 1 0 0 −1 −1 0  1 −1 0 0 1 1 0 0 −1 Q =   , (B62) 3 −1 0 0 1 1 0 0 −1 4    0 −1 −1 0 0 1 1 0     0 −1 −1 0 0 1 1 0  1 0 0 −1 −1 0 0 1 and finally,

Q4 = 118 − Q1 − Q2 − Q3. (B63)

4 4 Proposition B.11. The measurements {Pa}a=1 and {Qb}b=1 defined in Eqs. (B58), (B61), (B62) and (B63) are mutually unbiased, but they are not MUB-extractable. Proof. It is straightforward to check that these measurements satisfy the relations in Eq. (B4), and are therefore mutually unbi- ased (see the attached Mathematica file “dim4.nb”). Now we will show, using Lemma B.7, that there does not exist a completely 8 4 positive unital map Λ: B(C ) → B(C ) such that Λ(Pa) = Aa and Λ(Qb) = Bb, where Aa and Bb are projectors onto a pair of MUBs in dimension 4. From Ref. [71], we know that up to a global unitary transformation and the reordering of the elements of {Bb}, every pair of MUBs in dimension 4 can be written as

† Aa = |aiha|,Bb(x) = F4(x)AbF4(x) , x ∈ [0, 2π), (B64) where F4(x) is the one-parameter family of complex Hadamard matrices in dimension 4, defined as 1 1 1 1  1 1 1 −1 −1 F (x) =   x ∈ [0, 2π). (B65) 4 2 1 −1 ieix −ieix 1 −1 −ieix ieix

8 4 According to Remark B.8 and Eq. (B42) therein, a completely positive unital map Λ: B(C ) → B(C ) such that Λ(Pa) = Aa and Λ(Qb) = Bσ(b)(x) does not exist, if

X T X T Pa ⊗ Aa + Qb ⊗ Bσ(b)(x) < 2, (B66) ∞ a b 31 and we need to check this condition for all σ ∈ S4 permutations and all values of x ∈ [0, 2π). This can be done numerically up to machine precision by computing the largest eigenvalue of the above operator. Fig.7 contains the largest eigenvalue, also maximised over σ ∈ S4, for 10000 different values of x ∈ [0, 2π) (also see the attached Matlab files “dim4_plot.m” and “dim4_example_plot” (written for Octave) to generate the plot). It is apparent that the norm is always strictly smaller than 2, and hence the numerical evidence is convincing.

1.93

1.92

1.91 λ 1.9

1.89

1.88 0 π / 2 π 3π / 2 2π x

FIG. 7: Maximal eigenvalue of the operator in Eq. (B66) for 10000 different values of the MUB parameter x ∈ [0, 2π), each maximised over σ ∈ S4.



From the above examples, it is clear that in general the set MUM is strictly larger than the set MUBext, which is in turn strictly larger than the set MUB. Finally, let us consider a direct sum of a pair of MUBs with a pair of MUMs that cannot be written as a direct sum of MUBs. This gives a pair of measurements that is not a direct sum of MUBs, but that can be mapped to MUBs via a completely positive unital map. This shows that the set MUBext is strictly larger than the set MUB⊕. All the above considerations lead to the following classification of MUMs (also see Fig.8):

MUB ( MUB⊕ ( MUBext ( MUM, (B67) where in general all the inclusions are strict.

4. Incompatibility robustness

In Ref. [97] five measures of incompatibility robustness have been considered. In particular these measures have been evalu- ated for MUBs in arbitrary dimension d. In this appendix we show that for measurements acting on a finite-dimensional Hilbert space the algebraic relations given in Eq. (B4) are sufficient to guarantee precisely the same value as for MUBs for all five measures. This implies that for the generalised incompatibility robustness MUMs are among the most incompatible pairs of measurements with d-outcomes. Explaining the concept of incompatibility robustness is beyond the scope of this work, so we restrict ourselves to giving ex- plicit constructions and arguments necessary to prove our claims. We are extensively using the language and notation introduced 32

FIG. 8: Classification of mutually unbiased measurements. Note that these classes partially collapse (MUB⊕ = MUM) for outcome numbers 2 and 3, but they are strictly different for outcome numbers 4 and 5. in Ref. [97]. To prove that a pair of measurements gives a certain value of incompatibility robustness we must provide an explicit construction of a joint measurement and argue that no higher value of incompatibility robustness is possible. In the rest of this appendix we first specify a construction and finally argue that it saturates the upper bounds derived in Ref. [97]. In a nutshell, the reason why the constructions proposed for MUBs work for measurements satisfying the algebraic relations given in Eq. (B4) is the fact that in these constructions at any point we only consider a single measurement operator from the first measurement and a single operator from the second measurement. We have shown before that in this case operators satisfying the algebraic relations given in Eq. (B4) are indistinguishable from MUBs. What turns out to be crucial is that the MUM conditions completely determine the spectrum of the operator Pa + Qb. In AppendixB2a we showed that if a pair of d-outcome MUMs exists in a Hilbert space H, then we must have H'H0 ⊗ Cd for some other Hilbert space H0 and there exists a unitary U : H → H0 ⊗ Cd such that † † UPaU = 11 ⊗ |aiha| and UQ1U = 11 ⊗ |vihv|, (B68) d where {|ji}d is an orthonormal basis on d and |vi = √1 P |ji. Clearly, computing the spectrum of P + Q reduces j=1 C d j=1 a 1 d to computing the spectrum of a rank-two operator acting on C . Finally, note that the choice of Q1 as the projector that should take a particularly simple form after applying the unitary was arbitrary and we can easily find a unitary which achieves the same goal for any Qb. From this we conclude that n o 1 + √1 , 1 − √1 for d = 2,  2 2 spec(Pa + Qb) = n o (B69) 1 + √1 , 1 − √1 , 0 for d ≥ 3.  d d d d n Construction: Let {Pa}a=1 and {Qb}b=1 be a pair of d-outcome measurements acting on C which satisfies the algebraic re- d lations given in Eq. (B4) (in particular, they must be projective). Consider the joint measurement given by operators {Gab}a,b=1 defined as 1 √
Gab = √ Pa + Qb + d{Pa,Qb} . (B70) 2(d + d)

To verify that these are positive semidefinite note that we can explicitly compute their spectrum. Since {Pa,Qb} = (Pa + 2 Qb) − (Pa + Qb) and we already know the spectrum of Pa + Qb we immediately conclude that n 1 o spec(G ) = , 0 . (B71) ab d P It is easy to verify that they are also normalised, i.e. ab Gab = 11. Computing the marginals gives X 1  √  1 1  11 G = √ dP + 11 + 2 dP = 1 + √ P + √ . (B72) ab a a 2 a b 2(d + d) d + 1 2(d + d) 33

This implies that the depolarising, random and probabilistic incompatibility robustness ηd, ηr, ηp of these two measurements satisfy 1 1  ηd, ηr, ηp ≥ 1 + √ . (B73) 2 d + 1

Moreover, using the fact that 11 ≥ Pa we obtain √ X d + 2 d + 1 1 1  G ≥ √ P = 1 + √ P , (B74) ab a 2 a b 2(d + d) d which implies that the generalised incompatibility robustness ηg satisfies 1 1  ηg ≥ 1 + √ . (B75) 2 d For the jointly-measurable incompatibility robustness we have to provide an explicit construction of a subnormalised jointly measurable noise. For d = 2 we choose √ 3 − 2 2 H˜ = (11 − 2G ), (B76) ab 2 ab whose positivity follows immediately from Eq. (B71). This immediately implies that √ ηjm ≥ 2( 2 − 1). (B77)

For d ≥ 3 let

1 − γd h d i H˜ = 11 + (P + Q )(P + Q − 211) , (B78) ab d(d − 2) d − 1 a b a b where γ = 1 (1 + √1 ). To see that H˜ ≥ 0 it is sufficient to observe that its spectrum can be computed from the spectrum of d 2 d ab Pa + Qb. A direct computation gives

X 1 − γd H˜ = (11 − P ), (B79) ab d − 1 a b which implies that 1 1  ηjm ≥ 1 + √ . (B80) 2 d Upper bounds: The upper bounds we use are collected in Table I in terms of quantities specified in Eqs. (18) and (19) of Ref. [97], so let us first compute these quantities. Since the measurements are projective and since all the measurement operators d r p 2 must have the same trace we immediately deduce that f = 2 and g = g = g = d . The last two quantitities λ and µ can be read off directly from the spectra given in Eq. (B69): 1 λ = max λmax(Pa + Qb) = 1 + √ , (B81) a,b d ( 1 − √1 for d = 2, jm 2 g = min λmin(Pa + Qb) = (B82) a,b 0 for d ≥ 3, where λmax(M) and λmin(M) denote the maximal and minimal eigenvalues of M, respectively. Plugging these quantities into the upper bounds stated in Table I of Ref. [97] shows that the lower bounds derived above are in fact tight. Finally, let us show that the MUB value for the generalised incompatibility robustness coincides with the lowest value achiev- able by any pair of d-outcome measurements.

nA nB Proposition B.12. Given an arbitrary pair of POVMs, {Aa}a=1 and {Bb}b=1 acting on a separable Hilbert space, their generalised incompatibility robustness satisfies  √ √  1 nA + nB + 2 ηg ≥ 1 + √ √ . (B83) 2 nA + nB + nA + nB 34

Proof. First notice that ηg is monotonic under pre-processing of (i.e. applying a completely positive unital map on) the mea- nA nB surement pair [97]. Therefore, for any pair of POVMs {Aa}a=1 and {Bb}b=1, their generalised robustness is lower bounded by nA nB the robustness of the pair of projective measurements {Pa}a=1 and {Qb}b=1 obtained by the Naimark dilation of the original POVMs. Let us construct a joint measurement for the projective measurements, 1 √ √ Gab = √ √ [Pa + Qb + ( nA + nB){Pa,Qb} + nAPaQbPa + nBQbPaQb] 2(nA + nB + nA + nB)

1  √ † √ √ † √  = √ √ (Pa + nBPaQb) (Pa + nBPaQb) + (Qb + nAQbPa) (Qb + nAQbPa) ≥ 0. 2(nA + nB + nA + nB) (B84) P It is easy to see that ab Gab = 11, and performing a partial sum over b gives ! X 1 √ √ X Gab = √ √ nBPa + 11 + 2( nA + nB)Pa + nAPa + nB QbPaQb 2(nA + nB + nA + nB) b b  √ √  1 √ √ 1 nA + nB + 2 ≥ √ √ [nA + nB + 2( nA + nB) + 2] Pa = 1 + √ √ Pa, 2(nA + nB + nA + nB) 2 nA + nB + nA + nB (B85) P where the inequality follows from 11 ≥ Pa and nB b QbPaQb ≥ Pa. The latter results from the fact that for all vectors |ψi

X X X 2 X 2 X 2 hψ|nB QbPaQb|ψi = nB hψ|QbPaPaQb|ψi = nB PaQb|ψi = 1 PaQb|ψi b b b b0 b 2 2 (B86) X X 2 ≥ 1 · kPaQb|ψik ≥ k PaQb|ψik = kPa|ψik = hψ|Pa|ψi, b b where we used the Cauchy–Schwarz and the triangle inequalities. Similarly, it holds that  √ √  X 1 nA + nB + 2 G ≥ 1 + √ √ Q , (B87) ab 2 n + n + n + n b a A B A B which concludes the proof.  Corollary B.13. An arbitrary pair of d-outcome MUMs is among the most incompatible d-outcome measurement pairs under the generalised incompatibility robustness measure.

Appendix C: Bell inequalities for SICs

In this appendix, we elaborate on details concerning the Bell inequalities for SICs. We derive the quantum and no-signaling bounds for the simplified Bell inequality for SICs and then proceed to derive the local and quantum bounds for the (uncon- strained) Bell inequality for SICs. Then, we prove that a maximal violation of this inequality certifies that Bob’s measurements are OP-SICs.

1. Quantum correlations and no-signaling correlations in marginally constrained Bell scenarios for SICs

SIC In this section we prove tight bounds on the maximal quantum and no-signaling violations of the Bell functional Rd defined in Eq. (27) under the marginal constraints given in Eq. (28). Before we proceed let us prove the following technical result. n Proposition C.1. Let {Bu}u=1 be a set of n projectors (for n ≥ 2) acting on a Hilbert space H and let |ψi ∈ H be a normalised vector. Then, if n 1 X hψ|B |ψi = q (C1) n u u=1 for some q ∈ [0, 1], then X hψ|{Bu,Bv}|ψi ≥ f(q, n) ≡ qn(qn − 1). (C2) u6=v 35

n Proof. First note that since all the quantities appearing in the problem are invariant under permutations of {Bu}u=1, for the purpose of deriving bounds we can restrict our analysis to the uniform case in which for every u we have

hψ|Bu|ψi = q (C3) and for every pair u 6= v we have

hψ|{Bu,Bv}|ψi = 2t (C4) for some real number t. Now consider a moment matrix Γ defined as Γij = hψ|SiSj|ψi where the list of monomials reads S = {11,B1,B2,...,Bn}. Clearly, Γ is positive semidefinite but it might have complex entries, so it is more convenient to T consider its symmetrised version Γsym = (Γ + Γ )/2, which reads 1 q q q . . . q q q t t . . . t   q t q t . . . t Γsym = q t t q . . . t . (C5)   ......  ......  q t t t . . . q

To take advantage of the positivity of Γsym we take advantage of the Schur-complement condition. Consider a real Hermitian block matrix  AB X = , (C6) BT C where A > 0 is positive definite. Then, the Schur-complement condition states that X ≥ 0 if and only if C − BTA−1B ≥ 0. In our case we take the first row/column against the remaining n rows/columns, which means that Γsym ≥ 0 is equivalent to

C − BTA−1B = n(t − q2)|vihv| + (q − t)11, (C7) n √1 P where |vi = n j=1 |ji is the uniform vector. The positivity of this operator implies that

n(t − q2) + (q − t) ≥ 0, (C8) and therefore q(qn − 1) t ≥ . (C9) n − 1 Performing the summation over u 6= v leads to the final statement of the proposition. 

a. The quantum bound

We can without loss of generality assume that the optimal shared state is pure and denote it by |ψi. Similarly, we can without loss of generality take the optimal measurements of both Alice and Bob to be projective and denote the complete sets of a b projectors by {Ax} and {By} respectively. Hence, in quantum theory, we have

SIC X Rd = hψ|Ax ⊗ (Bx1 − Bx2 ) |ψi, (C10) x1

1 2 where we have introduced the observable Ax = Ax − Ax for Alice and recall that x = x1x2. For simplicity let us define the vectors

|αxi = Ax ⊗ 11|ψi (C11)

|βxi = 11 ⊗ (Bx1 − Bx2 ) |ψi. (C12) This allows us to write the Bell functional in a simple form which obeys a straightforward upper bound via the Cauchy–Schwarz inequality

SIC X X X p p Rd = hαx|βxi ≤ |hαx|βxi| ≤ hαx|αxi hβx|βxi. (C13) x1

To proceed further, we note that the marginal constraints (28) in quantum theory read 2 ∀x : hψ| A1 + A2
⊗ 11|ψi = , (C14) x x d 1 ∀y : hψ|11 ⊗ B |ψi = . (C15) y d

In what follows, we will for simplicity write marginal expressions hψ|A⊗11|ψi = hψ|A|ψi and similarly for marginal expressions on Bob’s side. One straightforwardly sees that for projective measurements the inner product hαx|αxi is identical to the left-hand side of the marginal constraint (C14), whereas the inner product hβx|βxi features two terms which are determined by the marginal constraint (C15). We therefore have 2 hα |α i = , (C16) x x d 2 hβ |β i = − hψ|{B ,B }|ψi. (C17) x x d x1 x2 Inserting this into Eq. (C13) we obtain √ 2 X p RSIC ≤ 2 − dhψ|{B ,B }|ψi. (C18) d d x1 x2 x1

d2
where N = 2 is the number of terms in the sum. To bound the sum under the square root we use Proposition C.1 which implies that

X 2 hψ|{Bx1 ,Bx2 }|ψi ≥ f(1/d, d ) = d(d − 1). (C20)

x1

Plugging this bound into Eq. (C19) implies

Q SIC p Rd ≤ d(d − 1) d(d + 1), (C21) which is precisely the result stated in the main text.

b. The no-signaling bound

SIC In order to find the no-signaling bound of Rd , subject to the constraints (28), we first derive its algebraically maximal value and then saturate this value with an explicit no-signaling model. Consider a specific choice of inputs x and y such that y = x1. Since Alice has three possible outcomes and Bob has two possible outcomes, we have six variables pab = p (a, b|x, y = x1). They must obey positivity, normalisation and the marginal constraints of Alice and Bob, i.e.

pab ≥ 0, X pab = 1, a,b 2 p + p + p + p = , 11 1⊥ 21 2⊥ d 1 p + p + p = . (C22) 11 21 ⊥1 d 37

SIC Note that the probabilities of winning and losing correspond to p11 and p21, respectively. The maximal contribution to Rd is made by maximising p11 − p21 under the above constraints. This means p11 = 1/d and p21 = 0. An analogous argument for the inputs x and y = x2 leads to p11 = 0 and p21 = 1/d. Thus,

X  1 1  RSIC = + = d d2 − 1
. (C23) d d d x1

When the inputs are x and y = x2 we instead choose   1 0 1 p = 1 0  . (C25) d 0 d − 2

SIC For the input combinations that do not contribute to Rd , i.e. when Alice receives x and Bob receives y∈ / {x1, x2}, we choose   1 1 1 p = 1 1  . (C26) 2d 0 2(d − 2)

It is straightforward to check that these distributions satisfy the marginal constraints (28), the no-signaling constraints and saturate the algebraic bound.

2. Bell inequalities for SICs (proof of Theorem V.1)

We first prove the quantum bound and then proceed to prove the classical bound.

a. Quantum bound

SIC We can recycle our earlier maximisation of Rd , but this time without the marginal constraints (28). Following the calculation in Eq. (C13) one arrives at

SIC X p 1 2 p Rd ≤ hψ|Ax + Ax|ψi hψ|Bx1 + Bx2 |ψi − hψ|{Bx1 ,Bx2 }|ψi. (C27) x1

1/2 SIC √  X  Rd ≤ s r − hψ|{Bx1 ,Bx2 }|ψi , (C28) x1

X 1 2 s ≡ hψ|Ax + Ax|ψi, x1

x1

X 2 X r = hψ| (Bx1 + Bx2 ) |ψi = (d − 1) hψ|Bx1 |ψi, (C30)

x1

SIC Returning to our Bell functional of interest, namely Sd , we have q  2 2  sr d (d − 1) − r β SSIC ≤ − α s − d r ≡ F (r, s), (C32) d d2 − 1 d d2 − 1 where the coefficients are specified by r 1 − δd,2 d d − 2p α = β = d(d + 1). (C33) d 2 d + 1 d 2 2 2 2 2 Our goal now is to find the maximise F (r, s) over r ∈ [0, d (d − 1)] and s ∈ [0, d (d − 1)/2]. For d √= 2 the marginal terms vanish and we immediately see that the optimal values are given by ropt = sopt = 6 and F (ropt, sopt) = 2 6. For d ≥ 3 we relax the problem and maximise over r, s ≥ 0. Standard differentiation techniques yield ∂F ∂F  =! 0 and =! 0 ⇒ r = s = d d2 − 1
, (C34) ∂r ∂s opt opt which falls inside the optimisation region. It is easy to check that dp F (r , s ) = d (d + 1). (C35) opt opt 2 To check that no higher value can be achieved at the boundary note that whenever either r = 0 or s = 0 we necessarily have F (r, s) ≤ 0. Plugging this value into Eq. (C32) combined with the bound derived for d = 2 gives

Q d + 2δd,2 p SSIC ≤ d (d + 1). (C36) d 2 As stated in the main text this bound can be saturated if there exists a set of SIC projectors in dimension d.

b. The local bound

SIC Here we derive the local bound of Sd . To this end, it is sufficient to consider all deterministic strategies of Alice and Bob. 2 We focus on the deterministic strategy of Bob. We can represent his strategy as a list ~b ∈ {1, ⊥}d , where the y-th element 2 encodes the output associated to measurement setting y. Hence, Bob has 2(d ) possible deterministic strategies. However, due SIC to the symmetries of the Bell functional, the maximal local value of Sd achievable for a given strategy of Bob is the same as that achievable when his strategy ~b is permuted into the strategy ~b0 = (1,..., 1, ⊥,..., ⊥). In other words, only the number of ~ SIC “1s“ in b is relevant for the maximal value of Sd . This can be seen from the fact that the Bell functional is invariant under a permutation of Bob’s d2 inputs (provided analogous permutations of Alice’s input tuple x and output a). Thus, we need only to consider strategies of Bob in which the N first elements of ~b are ones, and the remaining d2 − N elements are ⊥. Finding the maximum over N ∈ {0, 1, . . . , d2} gives the tight local bound. This allows us to write the Bell functional in a local model as   X βd SSIC = hψ|A |ψi [δ(x ≤ N) − δ(x ≤ N)] − [δ(x ≤ N) + δ(x ≤ N)] − α hψ|A1 + A2 |ψi , (C37) d x 1 2 d2 − 1 1 2 d x x x1

(N) 2 Tk ≡ {(x1, x2) ∈ Pairs(d )|δ(x1 ≤ N) + δ(x2 ≤ N) = k}, (C38)

2 (N) (N) (N) 2 for k ∈ {0, 1, 2} and N ∈ {0, 1, . . . , d }. Clearly, the sets {T0 ,T1 ,T2 } constitute a partitioning of the set Pairs(d ). Hence 2   X X kβd SSIC = hψ|A |ψi [δ(x ≤ N) − δ(x ≤ N)] − − α hψ|A1 + A2 |ψi . (C39) d x 1 2 d2 − 1 d x x k=0 (N) (x1,x2)∈Tk 39

(N) (N) Notice that if (x1, x2) ∈ T1 , then it must hold that δ(x1 ≤ N) − δ(x2 ≤ N) = 1. Also, when (x1, x2) ∈ T0 or (N) (x1, x2) ∈ T2 , then δ(x1 ≤ N) − δ(x2 ≤ N) = 0. Thus, we can further simplify the above expression to

2   X X kβd SSIC = hψ|A |ψiδ − − α hψ|A1 + A2 |ψi . (C40) d x k,1 d2 − 1 d x x k=0 (N) (x1,x2)∈Tk

Our goal now is to optimise over the measurement operators of Alice, which only involves the first and third term, and let us consider the three values of k separately. If k = 0 or k = 2 this contribution is never positive, so it is optimal to choose 1 2 ⊥ 1 2 ⊥ Ax = Ax = 0 and Ax = 11. If k = 1 it is beneficial to choose Ax = 11 and Ax = Ax = 0 because 1 − αd > 0. Plugging in the optimal choice of measurements of Alice gives

 β  2β SSIC = |T (N)| 1 − α − d − |T (N)| d . (C41) d 1 d d2 − 1 2 d2 − 1

(N) (N) The size of T1 and T2 are easily determined as follows. The number of ways of choosing a positive integer no larger than N is N, and the number of ways of choosing a positive integer larger than N but no larger than d2 is d2 − N. Hence, (N) 2 |T1 | = N(d − N). Similarly, the number of ways of choosing two distinct positive integers no larger than N is N(N − 1)/2. (N) Hence, |T2 | = N(N − 1)/2. This leaves us with

SIC 2  2  Sd = −N (1 − αd) + N d (1 − αd) − βd N  √ √ √ √  (C42) = √ d d − 2d2 d + d + 1 2d2 − 2N
+ d (N + 2) , 2 d + 1 where we have taken d ≥ 3. Now we must only find the optimal value of N ∈ {0, 1, . . . , d2}. To this end, we differentiate the right-hand side with respect to N and find that the maximum is achieved for √   d 2 + d − 2d2 + 2dpd(d + 1) N = √ √ . (C43) 4 d + 1 − 2 d

In general, this is evidently not an integer. Hence, to find the optimal integer choice of N, we first show that N ≤ d. Simple manipulations allow us to write the statement N ≤ d as p 2d2 − 3d − 2 ≥ 2(d − 2) d(d + 1). (C44)

Squaring both sides and simplifying reduces this to (d−2)2 ≥ 0, which is evidently true. Next, we show that N ≥ d−1. Again, simple manipulations allow us to write the statement N ≥ d − 1 as r d + 1 2d2 − 3d ≤ (2d2 − 4d + 4) . (C45) d

Squaring both sides, multiplying by d and simplifying leads to

0 ≤ 7d3 − 16d + 16, (C46) which is true for all d ≥ 0. Thus we conclude that d − 1 ≤ N ≤ d. To show that N = d constitutes a better solution that SIC SIC N = d − 1 we show that Sd (N = d) − Sd (N = d − 1) ≥ 0. Thanks to Eq. (C42) this reduces to showing that

3d3 + 2d2 − 13d + 4 ≥ 0, (C47) which is true for all d ≥ 2. Thus, we conclude that the optimal choice is N = d. Inserting N = d in Eq. (C42) returns the local bound in Eq. (35). Notably, the case of d = 2 can be obtained by analogously following the above procedure. However, the corresponding Bell scenario is of sufficiently small scale so that the classical bound is arguably even easier obtained by brute-force consideration of all deterministic strategies. 40

3. Device-independent certification for SICs (proof of Theorem V.2)

In this appendix we provide a proof of Theorem V.2, which essentially reduces to deriving explicit conditions under which the argument presented in the first part of this appendix is tight and combining them to produce the desired form. Note that the proof technique is quite similar to the one used in AppendixA2a. SIC In AppendixC2a we have shown how to derive a tight bound on the maximal quantum value of the Bell functional Sd (see Eq. (C36)). In the first step we applied the Cauchy–Schwarz inequality to obtain Eq. (C27). This can only be tight if the vectors are aligned, i.e. for every x we have

Ax|ψi = µx(Bx1 − Bx2 )|ψi (C48)

2 for some positive real number µx. Moreover, here we have used the fact that for all y we have hψ|By |ψi ≤ hψ|By|ψi. If the marginal state of Bob is full-rank, then this bound is tight only when all the measurement operators By are projective. The next use of Cauchy–Schwarz inequality, which leads to Eq. (C28), can only give a tight result if for all x we have

1 2
hψ|Ax + Ax|ψi = ν hψ|Bx1 + Bx2 |ψi − hψ|{Bx1 ,Bx2 }|ψi (C49) for some fixed real positive number ν. In fact, this number can be computed by summing over x. Then, if we recall that the maximal value can only be achieved when the quantities r and s defined in Eq. (C29) take the values given in Eq. (C34) we 2 immediately conclude that ν = (d + 1)/d. However, it is clear by comparing Eq. (C48) and Eq. (C49) that µx = ν, which implies that for all x we have r d + 1 A |ψi = (B − B )|ψi. (C50) x d x1 x2

3 Since we assume that the measurements of Alice are projective, we have (Ax) = Ax. Applying this to Eq. (C50), tracing out Alice’s system and right-multiplying by the marginal of Bob, we conclude that for all x1 < x2 we have

Bx1 − Bx2 − (d + 1)(Bx1 Bx2 Bx1 − Bx2 Bx1 Bx2 ) = 0. (C51)

2 In the following we will use x1 and x2 as summation indices for double sums over x1 < x2 and y for single sums over [d ]. The optimality condition derived in Eq. (C34) implies that

X 1 X hψ|B |ψi = hψ|B + B |ψi = d (C52) y d2 − 1 x1 x2 y x1

x1

tr(KρB) = d. (C55)

Moreover, since

2 X X K = By + {Bx1 ,Bx2 }, (C56)

y x1

2 2 tr(K ρB) = d + d(d − 1) = d . (C57)

This means that the Cauchy–Schwarz

| tr(X†Y )|2 ≤ tr(X†X) tr(Y †Y ) (C58) 41

1/2 1/2 for X = KρB and Y = ρB holds with equality, which implies that

1/2 1/2 KρB = zρB (C59)

−1/2 for some complex number z such that |z| = d. Right-multiplying by ρB (again we take advantage of the full-rank assumption) leads to K = z 11. Now it is clear that z must in fact be real and positive and so z = d and K = d 11. This is the first result of Theorem V.2. d2 To prove the second part we go back to Eq. (C51). Since the operators {By}y=1 are projectors, we can use Jordan’s lemma which states that any pair of projectors can be simultaneously block-diagonalised such that the blocks are of size either 1 × 1 or 2 × 2. Moreover, it is known that the non-trivial blocks (up to a unitary rotation) form a 1-parameter family. By applying the relation given in Eq. (C51) to a particular pair of projectors Bx1 and Bx2 for x1 < x2, we conclude that the Hilbert space of Bob decomposes as HB 'HB1 ⊕ HB2 ⊕ HB3 and the operators read

Bx1 = (P ⊗ 11) ⊕ 0 ⊕ 11, (C60)

Bx2 = (Q ⊗ 11) ⊕ 0 ⊕ 11, (C61) where 1 P = (11 + cos θ Z + sin θ X), (C62) 2 1 Q = (11 + cos θ Z − sin θ X) (C63) 2 √ for cos θ = 1/ d + 1, sin θ = pd/(d + 1) and X and Z are the 2 × 2 Pauli matrices. Note that at this point we know nothing about the dimensions of HB1 , HB2 and HB3 , but we clearly see that Bx1 and Bx2 are isomorphic (in particular, either tr Bx1 and tr Bx2 are both finite and equal to each other or they are both infinite). Moreover, note that for any pair x1 < x2 the space decomposes into three subspaces, but these subspaces depend on the specific pair, i.e. the subspace HB1 for (x1, x2) = (0, 1) is different from the subspace HB1 for (x1, x2) = (0, 2).

The final goal is to show that for all x1 < x2 we have dim HB3 = 0, i.e. that the projectors Bx1 and Bx2 are in fact of the form

Bx = (P ⊗ 11) ⊕ 0, 1 (C64) Bx2 = (Q ⊗ 11) ⊕ 0. This immediately implies that

Bx1 = (d + 1)Bx1 Bx2 Bx1 and Bx2 = (d + 1)Bx2 Bx1 Bx2 , (C65) which is precisely the second result of Theorem V.2. Let us first show that this result holds when the expectation values of the projectors By and the anticommutators {Bx1 ,Bx2 } are distributed uniformly. In the second step we show that this conclusion holds even without the uniformity assumption. Let us for now assume that for all y we have 1 tr(B ρ ) = (C66) y B d and for all x1 < x2 we have 2 tr({B ,B }ρ ) = . (C67) x1 x2 B d(d + 1) Then, we immediately see that 2 tr (B − B )2ρ  = tr(B + B − {B ,B }ρ ) = . (C68) x1 x2 B x1 x2 x1 x2 B d + 1 Moreover, a direct calculation shows d (B − B )2 = (sin θX)2 ⊗ 11 ⊕ 0 ⊕ 0 = 11 ⊗ 11 ⊕ 0 ⊕ 0. (C69) x1 x2 d + 1

Let Π be a projector on HB1 :

Π = 11 ⊗ 11 ⊕ 0 ⊕ 0. (C70) 42

Then, we have 2 tr(Πρ ) = . (C71) B d

On the other hand the fact that tr(Bx1 ρB) = tr(Bx2 ρB) implies that

tr(X ⊗ 11 ⊕ 0 ⊕ 0 ρB) = 0. (C72)

This allows us to rewrite tr(ByρB) = 1/d as 1  tr cos θ Z ⊗ 11 ⊕ 0 ⊕ 11 ρ = 0. (C73) 2 B Let us now show that

tr(Z ⊗ 11 ⊕ 0 ⊕ 0 ρB) = 0. (C74)

Define d σ ≡ (11 ⊗ Π)|ψihψ|(11 ⊗ Π), (C75) AB 2

d which is a normalised state because tr σAB = 2 tr(ΠρB) = 1. Now we take advantage of the fact that if we have two Hermitian operators X,Y satisfying E2 = F 2 = 11 and {E,F } = 0, then on any normalised state τ the expectation values must satisfy (see Ref. [98] for an elementary proof)

tr(Eτ)2 + tr(F τ)2 ≤ 1. (C76)

In our case we set   E ≡ Ax ⊗ (X ⊗ 11) ⊕ 0 ⊕ 0 , (C77) F ≡ 11 ⊗ (Z ⊗ 11) ⊕ 0 ⊕ 0 (C78) and τ = σAB. To verify that tr(Eτ) = 1 note that   d tr A ⊗ (X ⊗ 11) ⊕ 0 ⊕ 0 σ = hψ|A ⊗ (X ⊗ 11) ⊕ 0 ⊕ 0|ψi (C79) x AB 2 x r d d d + 1 = hψ|A ⊗ (B − B )|ψi = hψ|11 ⊗ (B − B )2|ψi = 1, (C80) 2 sin θ x x1 x2 2 sin θ d x1 x2 where we have used the fact that sin θ = pd/(d + 1). This immediately implies that tr(F τ) = 0 and therefore Eq. (C74) holds. Combining Eqs. (C73) and (C74) gives

tr(0 ⊕ 0 ⊕ 11 ρB) = 0. (C81)

Since we are assuming that ρB is full-rank, this implies that dim HB3 = 0.

In the last part we argue that this conclusion holds even without the uniformity assumption. To do so note that dim HB3 = 0 is equivalent to the operator Bx1 + Bx2 not having an eigenvalue of 2. We show that every quantum realisation can be transformed into a symmetrised realisation which satisfies the uniformity condition. Moreover, as the symmetrised operators inherit their spectra from the original ones, we can deduce that the original measurement operators of Bob do not have an eigenvalue of 2. Suppose we are given a quantum realisation on HA ⊗ HB given by the state ρAB (with ρB being full-rank) and the operators 2 Ax,By, which achieves the maximal violation. For σ being a permutation of [d ] consider the measurement operators given by

σ By ≡ Bσ(y), (C82) ( σ Aσ(x1)σ(x2) if σ(x1) < σ(x2), Ax ≡ (C83) −Aσ(x2)σ(x1) otherwise.

It is straighforward to check that these operators also achieve the maximal violation on the state ρAB. Now by taking a convex 2 combination over all permutations, we construct a symmetrised quantum realisation. We label the permutations of [d ] by σj, 43

2 N N where j ∈ {1, 2,...,N} and N = (d )!. The symmetrised realisation acts on C ⊗ C ⊗ HA ⊗ HB, where we have added two N-dimensional registers, one for each party, to serve as classical shared randomness. The symmetrised realisation reads

N 1 X ρ0 ≡ |jihj| ⊗ |jihj| ⊗ ρ , (C84) AB N AB j=1 N 0 X σ Ax ≡ |jihj| ⊗ Ax, (C85) j=1 N 0 X σ By ≡ |jihj| ⊗ By . (C86) j=1

The symmetrised realisation still satisfies the condition that the marginal of Bob is full-rank and, moreover, all the expectation 0 0 values are uniform. Therefore, the operators B1 and B2 must be of the form given in Eq. (C64), which in particular implies that 0 0 the eigenvalue of 2 does not belong to the spectrum of B1 + B2. On the other hand, it is easy to see that

0 0 [ spec(B1 + B2) = spec(Bx1 + Bx2 ), (C87) x1

which implies that the original operators Bx1 and Bx2 must also be of the form given in Eq. (C64).