# Experimentally Certified Transmission of a Quantum Message through an
Untrusted and Lossy Quantum Channel via Bell’s Theorem

Simon Neves  Sorbonne Université, CNRS, LIP6, 4 Place Jussieu, Paris F-75005,
France  Laura dos Santos Martins  Sorbonne Université, CNRS, LIP6, 4 Place
Jussieu, Paris F-75005, France  Verena Yacoub  Sorbonne Université, CNRS,
LIP6, 4 Place Jussieu, Paris F-75005, France  Pascal Lefebvre  Sorbonne
Université, CNRS, LIP6, 4 Place Jussieu, Paris F-75005, France  Ivan Šupić
Sorbonne Université, CNRS, LIP6, 4 Place Jussieu, Paris F-75005, France
Damian Markham  Sorbonne Université, CNRS, LIP6, 4 Place Jussieu, Paris
F-75005, France  Eleni Diamanti  Sorbonne Université, CNRS, LIP6, 4 Place
Jussieu, Paris F-75005, France

###### Abstract

Quantum transmission links are central elements in essentially all protocols
involving the exchange of quantum messages. Emerging progress in quantum
technologies involving such links needs to be accompanied by appropriate
certification tools. In adversarial scenarios, a certification method can be
vulnerable to attacks if too much trust is placed on the underlying system.
Here, we propose a protocol in a device independent framework, which allows
for the certification of practical quantum transmission links in scenarios
where minimal assumptions are made about the functioning of the certification
setup. In particular, we take unavoidable transmission losses into account by
modeling the link as a completely-positive trace-decreasing map. We also,
crucially, remove the assumption of independent and identically distributed
samples, which is known to be incompatible with adversarial settings. Finally,
in view of the use of the certified transmitted states for follow-up
applications, our protocol moves beyond certification of the channel to allow
us to estimate the quality of the transmitted quantum message itself. To
illustrate the practical relevance and the feasibility of our protocol with
currently available technology we provide an experimental implementation based
on a state-of-the-art polarization entangled photon pair source in a Sagnac
configuration and analyze its robustness for realistic losses and errors.

Introduction

The ability to send and receive quantum information is at the heart of the
rapidly developing quantum technologies. Transmitting quantum information over
quantum networks promises unparalleled efficiency and security Wehner  _et
al._ (2018), as well as new functionalities such as the delegation of quantum
computation Fitzsimons (2017) and quantum sensing Shettell and Markham (2022).
Within quantum computers themselves we will need to input, share and
distribute quantum information to different parts, particularly important for
architectures relying on multiple quantum processors Awschalom and et al.
(2021); Saleem  _et al._ (2021). The reliable transmission of quantum
information is thus an essential building block for future quantum
technologies, and, as such, we must be very sure of its working. When the
physical devices used to test and use these quantum channels are trusted, this
question can be answered by standard quantum channel authentication Barnum
_et al._ (2002), and there are various approaches to this end, from those
requiring incredibly expensive entangled resources Barnum  _et al._ (2002);
Dupuis  _et al._ (2012); Broadbent  _et al._ (2013), to those more achievable,
but at cost to security scaling Markham and Marin (2015); Markham and Krause
(2020); Zhu and Hayashi (2019); Takeuchi  _et al._ (2019). In this work, we
consider a much stronger requirement, where some or all devices used are not
trusted, in a so-called device independent setting. This will be a crucial
step for testing the transmission through quantum channels for future
applications.

Device independence uses Bell-like correlations to imply correct behaviour of
quantum hardware, without the need to understand or trust their inner workings
Colbeck (2011); Acín  _et al._ (2007), that is, independently of the physical
device used. It is motivated by the inevitable situation where the user of a
quantum technology is not necessarily the one who built all the hardware and
does not necessarily want to trust it to behave as specified. It has first
been applied in quantum information to prove security in quantum key
distribution devices, thus making them secure against potential hardware
hacks. It has then expanded in many directions, including random number
generation Pironio  _et al._ (2010), verification of quantum computation
Reichardt  _et al._ (2013), and more Baccari  _et al._ (2020); Šupić and
Brunner (2022). The application to quantum channels is relatively recent
Sekatski  _et al._ (2018) (but see also Magniez  _et al._ (2005)), however
there are some important missing elements in order to obtain useful
certification.

Here, we address the main remaining obstacles to certify the transmission of
quantum information in the device independent framework. First, in our
approach we explicitly take into account loss. This is particularly important
in optical implementations (which is the most natural choice for quantum
channels). It is not addressed in current schemes Sekatski  _et al._ (2018);
Magniez  _et al._ (2005), which effectively assume that any loss is innocent;
this is somewhat against the goals of device independence and opens a security
loophole if the loss is controlled by malicious parties. Second, we remove the
assumption that each time a channel is used, it is done so in an independent,
uncorrelated way, known as identical independent distribution (IID). This
assumption similarly makes us vulnerable in terms of security so should be
avoided in general. Third, we certify the transmission of quantum information
itself. Previous works assume IID, that loss is not malicious, and they
certify that the channel that was used during the test was good but without a
statement on actual transmitted quantum information Sekatski  _et al._ (2018).
We develop the treatment of loss as a non trace preserving channel, bounding
the diamond fidelity between an untrusted channel and an ideal one. We use
this to build protocols certifying a transmitted quantum message using this
channel. Our protocols are secure in the one-sided device independent setting
(where the sender’s devices are fully trusted, but not the receiver’s), and
also in the fully device independent setting when IID is assumed on the
source; in both cases no IID needs to be assumed on the uses of the channel.

We also demonstrate the feasibility of our protocol and experimentally
validate the main elements of one-sided device independent certified
transmission with an implementation exploiting a high-quality entangled photon
source with polarization encoding obtained in a Sagnac configuration. This
allows us to explore the behavior of the minimum fidelity that we can certify
for realistic losses in honest channels and confirm the robustness of the
protocol against simulated errors introduced by dishonest channels.

Results

Certification protocol. In our framework, a player Alice wishes to send a
qubit state from Hilbert space $\mathscr{H}_{i}$ to Bob, through a local
unitary quantum channel $\mathscr{E}_{0}$. This quantum message is possibly
entangled with another system of Hilbert space $\mathscr{S}$ of arbitrary
dimension, so the global state reads
${\rho_{i}\in\mathscr{L}(\mathscr{H}_{i}\otimes\mathscr{S})}$. The channel
takes any qubit from $\mathscr{L}(\mathscr{H}_{i})$ to another qubit from
$\mathscr{L}(\mathscr{H}_{o})$, with output global state
${\rho_{o}=(\mathscr{E}_{0}\otimes\mathds{I})[\rho_{i}]=(U\otimes\mathds{I})\rho_{i}(U^{\dagger}\otimes\mathds{I})}$,
where $U$ is a local unitary and $\mathds{I}$ is the identity. This model
describes a perfect unitary gate in a quantum computer, quantum transmission
link (carried on through quantum teleportation or a simple optical fiber) or
quantum memory. Without loss of generality, we take $U=\mathds{I}$ and
$(\mathscr{E}_{0}\otimes\mathds{I})[\rho_{i}]=\rho_{i}$, as this case
encompasses all unitaries in a device independent scenario Sekatski  _et al._
(2018). This channel is called the reference channel.

In real world situations, the channel would be lossy, noisy, or even operated
by a malicious party Eve. Also, Alice and Bob normally do not have access to
isolated qubit spaces, but operate with physical systems such as photons or
atoms, displaying other degrees of freedom. This way, without further
assumptions, Alice and Bob have access to a completely positive trace-
decreasing (CPTD) map $\mathscr{E}$, i.e. a probabilistic channel, that sends
density operators from an input Hilbert space $\mathscr{H}_{\mathscr{A}_{1}}$
to positive operators of trace smaller than 1 on an output Hilbert space
$\mathscr{H}_{\mathscr{B}}$. This channel is called the _physical channel_.
Alice also possesses a source of bipartite states $\Phi_{i}$ shared between
$\mathscr{H}_{\mathscr{A}_{1}}$ and a secondary Hilbert space
$\mathscr{H}_{\mathscr{A}_{2}}$, that we call the probe input state. She can
send one part of $\Phi_{i}$ through the channel $\mathscr{E}$, resulting in
the probe output state $\Phi_{o}$, shared with Bob:

$\Phi_{o}=(\mathscr{E}\otimes\mathds{I})[\Phi_{i}]/t(\mathscr{E}|\Phi_{i}),$
(1)

where
$t(\mathscr{E}|\Phi_{i})=\textrm{Tr}(\mathscr{E}\otimes\mathds{I})[\Phi_{i}]$
is the transmissivity of $\mathscr{E}$ which a priori depends on the input
state, as it does in polarizing channels for instance. For more details on
this relatively new notion, the reader can refer to SUPP. MAT. A. Finally, the
players can measure states with 2-outcome positive operator-valued measures
(POVMs) $\\{M^{\mathscr{P}}_{l|q}\\}_{l=0,1}$ where
$\mathscr{P}=\mathscr{A}_{1},\mathscr{A}_{2}$ or $\mathscr{B}$ indicating the
Hilbert space on which the measurement is acting, and $q$ indicates which POVM
is measured, see Eqs. (9) to (12) below. Fig. 1 illustrates our setting.

Figure 1: Sketch of the problem. Alice’s goal is to send a qubit, potentially
part of a larger system, in state $\rho_{i}$, through an untrusted quantum
channel $\mathscr{E}$ (green path). To do so, she sometimes tests the channel
by sending half an entangled state (blue path). Alice and Bob can then measure
the output state $\Phi_{o}$, to assess how close the action of the physical
channel $\mathscr{E}$ is to an ideal reference channel $\mathscr{E}_{0}$ on
the transmitted state $\rho_{i}$.

In an adversarial scenario, Alice and Bob wish to draw device independent
conclusions, meaning they make no assumption whatsoever on the states or the
measurements. In particular, physical Hilbert spaces are of arbitrarily big
dimensions, which include all degrees of freedom of the physical systems and
possible entanglement with the rest of the universe. In this way, players can
only certify objects up to local isometries, which associate finite-dimension
qubit spaces $\mathscr{H}_{i}$ and $\mathscr{H}_{o}$, to these infinite-
dimension physical spaces $\mathscr{H}_{\mathscr{A}_{1}}$,
$\mathscr{H}_{\mathscr{A}_{2}}$, $\mathscr{H}_{\mathscr{B}}$. As a device
independent procedure, self-testing is actually "blind" to local isometries
such that it does not certify a single state, but a whole equivalence class of
quantum states mutually related by locally isometric transformations. As shown
in Sekatski  _et al._ (2018), similar conclusions can be drawn in order to
device-independently test the equivalence between the physical channel
$\mathscr{E}\otimes\mathds{I}$ and the reference operation
$\mathscr{E}_{0}\otimes\mathds{I}$. Note, however, that as a quantum channel
is associated to two Hilbert spaces (one in input and the other in output),
two isometries are involved in order to extract a qubit-to-qubit channel from
a physical channel. This way, the input isometry brings a qubit input state to
a physical state that can be fed into the physical channel, while the output
isometry extracts a qubit state from the physical channel’s output state.
However, this formalism, in principle, only applies to completely positive
trace-preserving (CPTP) maps. In our case, a trace-decreasing physical channel
only returns a state with a certain probability, such that it can only be
compared to the reference channel multiplied by a constant $t\leq 1$. Then,
one can only make a statement about equivalence between the physical and
reference channels, when considering rounds in which the transmission was
successful. We capture this intuition with the following definition.

######  Definition 1 (Self-testing of a CPTD map).

Let us consider a physical channel
${\mathscr{E}:\mathscr{H}_{\mathscr{A}_{1}}\longrightarrow\mathscr{H}_{\mathscr{B}}}$.
With two local isometries
${\Gamma_{i}:\mathscr{H}_{\mathscr{A}_{1}}\otimes\mathscr{H}_{i}\longrightarrow\mathscr{H}_{\mathscr{A}_{1}}\otimes\mathscr{H}_{i}^{ext}}$
(encoding map) and
${\Gamma_{o}:\mathscr{H}_{\mathscr{B}}\longrightarrow\mathscr{H}_{o}\otimes\mathscr{H}_{o}^{ext}}$
(decoding map), and an ancillary state
${\rho_{\mathscr{A}_{1}}\in\mathscr{L}(\mathscr{H}_{\mathscr{A}_{1}})}$, we
can define an extracted qubit channel $\mathscr{E}_{i,o}$ as:

$\mathscr{E}_{i,o}:\rho\in\mathscr{L}(\mathscr{H}_{i})\longrightarrow\textrm{Tr}_{ext}\bigl{(}(\Gamma_{o}\circ\mathscr{E}\circ\Gamma_{i})[\rho_{\mathscr{A}_{1}}\otimes\rho\>]\bigr{)},$
(2)

where the trace is taken over $\mathscr{H}_{i}^{ext}$ and
$\mathscr{H}_{o}^{ext}$ 111The identity channel on $\mathscr{H}_{i}^{ext}$ is
omitted in (2) for more clarity.. The self-testing equivalence between a
probabilistic channel $\mathscr{E}$ and the reference channel
$\mathscr{E}_{0}$ is established if there exists $t\in]0;1]$ giving:

$\mathscr{E}_{i,o}=t\mathscr{E}_{0}.$ (3)

The reader can refer to SUPP. MAT. A.2 for more details on the lossy channels’
equivalence classes. In experiments, we can never perfectly certify
$\mathscr{E}$, therefore we quantify the ability of this probabilistic channel
to implement the deterministic channel $\mathscr{E}_{0}$ by generalizing the
diamond fidelity to probabilistic quantum channels:

$\displaystyle\mathscr{F}_{\diamond}^{\Gamma_{i,o}}(\mathscr{E},\mathscr{E}_{0})$
$\displaystyle=\mathscr{F}_{\diamond}(\mathscr{E}_{i,o},\mathscr{E}_{0})$ (4)
$\displaystyle=\inf_{{\lvert\phi\rangle}}F((\mathscr{E}_{i,o}\otimes\mathds{I})[\phi]/t(\mathscr{E}_{i,o}|\phi),(\mathscr{E}_{0}\otimes\mathds{I})[\phi]),$

where
$F(\rho,\sigma)=\textrm{Tr}\bigl{(}\sqrt{\rho^{1/2}\sigma\rho^{1/2}}\bigr{)}^{2}$
is the Ulhmann fidelity for quantum states, and the lower bound is taken over
all pure states ${\lvert\phi\rangle}$ from $\mathscr{H}_{i}^{\otimes 2}$ such
that $t(\mathscr{E}_{1}|\phi)\neq 0$ and $t(\mathscr{E}_{2}|\phi)\neq 0$. Note
that the left state is normalized by the transmissivity. Consequently,
contrary to CPTP maps fidelities,
$\mathscr{F}_{\diamond}(\mathscr{E}_{i,o},\mathscr{E}_{0})=1$ does not imply
$\mathscr{E}_{i,o}=\mathscr{E}_{0}$, but only that there exists $t\in]0,1]$
such that $\mathscr{E}_{i,o}=t\mathscr{E}_{0}$, meaning that the channels are
equivalent in the sense of our definition. Physically speaking, these two
channels output the same states, under the condition those were not lost. The
diamond fidelity is particularly useful here, as it can be interpreted as the
minimum probability that $\mathscr{E}\otimes\mathds{I}$ successfully
implements the operation $\mathscr{E}_{0}\otimes\mathds{I}$ on any state,
under the condition that a state successfully passes through the channel. The
main goal of our protocol is therefore to certify that fidelity.

For that purpose, let us consider the situation where Alice can certify the
probe input state $\Phi_{i}$ up to two local isometries
$\Gamma^{A_{1}/\mathscr{A}_{2}}:\mathscr{H}_{\mathscr{A}_{1}/\mathscr{A}_{2}}\longrightarrow\mathscr{H}_{\mathscr{A}_{1}/\mathscr{A}_{2}}\otimes\mathscr{H}_{i}$
with the following fidelity to a maximally entangled state:

$F^{i}=F\bigl{(}(\Lambda^{\mathscr{A}_{1}}\otimes\Lambda^{\mathscr{A}_{2}})[\Phi_{i}],\Phi_{+}\bigr{)},$
(5)

where $\Phi_{+}$ is a maximally-entangled state (for instance
${\lvert\Phi_{+}\rangle}=\tfrac{{\lvert 00\rangle}+{\lvert
11\rangle}}{\sqrt{2}}$) and
$\Lambda^{j}[\cdot]=\textrm{Tr}_{j}(\Gamma^{j}[\cdot])$. We next consider the
situation that Alice and Bob are able to certify the probe output state
$\Phi_{o}$ up to local isometries $\Gamma^{\mathscr{A}_{2}}$ and
$\Gamma^{\mathscr{B}}:\mathscr{H}_{\mathscr{B}}\longrightarrow\mathscr{H}_{\mathscr{B}}\otimes\mathscr{H}_{o}$
with the following fidelity:

$F^{o}=F\bigl{(}(\Lambda^{\mathscr{B}}\otimes\Lambda^{\mathscr{A}_{2}})[(\mathscr{E}\otimes\mathds{I})[\Phi_{i}]]/t(\mathscr{E}|\Phi_{i}),(\mathscr{E}_{0}\otimes\mathds{I})[\Phi_{+}]\bigr{)}.$
(6)

Given Eqs. (5) and (6), we show in SUPP. MAT. D.2 that there exist isometries
$\Gamma_{i},\Gamma_{o}$ such that Alice and Bob are able to lower bound the
diamond fidelity on the corresponding extracted channel $\mathscr{E}_{i,o}$:

$\mathscr{F}_{\diamond}(\mathscr{E}_{i,o},\mathscr{E}_{0})\geq
1-4\sin^{2}\Bigl{(}\arcsin\bigl{(}C^{i}/t(\mathscr{E}|\Phi_{i})\bigr{)}+\arcsin
C^{o}\Bigr{)},$ (7)

where $C^{j}=\sqrt{1-F^{j}}$ are sine distances associated to their
corresponding fidelities Rastegin (2006). In this way, checking the input and
output fidelities allows us to assess the fidelity of the channel itself. This
bound generalizes what is shown in Sekatski  _et al._ (2018) to probabilistic
channels. It also uses the diamond fidelity, which informs on the behavior of
the channel on any state, instead of the Choi-Jamiołkowski fidelity, which
only informs on the behavior of the channel on a maximally entangled state.

This bound gives the direction for estimating the fidelity of a quantum
channel. The idea is to evaluate the fidelity $F^{i}$ of the probe input state
to a Bell state, then send one part of that probe state through the channel
Alice wishes to send $\rho_{i}$ through, and finally evaluate the fidelity
$F^{o}$ of the corresponding output state to the same Bell state. Such
procedure is possible using recent self-testing results Unnikrishnan and
Markham (2020), but requires a very large number of experimental rounds in the
absence of the IID assumption, as both input and output probe states require
certification. We significantly decrease that number by making the IID
assumption on the probe state, or by leaving its full characterization to
Alice’s responsibility. Still, as we make no IID assumption on the channel,
optimal security cannot be reached by first testing that channel, and only
then using it to send the message state $\rho_{i}$, as Eve may change the
channel’s expression in the last moment. Our protocol works around this
problem by allowing Alice to hide the message $\rho_{i}$ among a large number
of probe states, at a random position unknown to Eve. In that case, we show in
SUPP. MAT. D.5 that the bound (7) holds for the average channel
$\bar{\mathscr{E}}_{i,o}$ over the whole protocol. Then the _transmission
fidelity_ between the output quantum message
$\bar{\rho}_{o}=(\bar{\mathscr{E}}_{i,o}\otimes\mathds{I})[\rho_{i}]/t(\bar{\mathscr{E}}|\rho_{i})$
and the input quantum message $\rho_{i}$ is certified:

$F(\rho_{i},\bar{\rho}_{o})\geq\mathscr{F}_{\diamond}(\bar{\mathscr{E}}_{i,o},\mathds{I}).$
(8)

As long as the message’s position among the probe states remains hidden, we
can use $\bar{\rho}_{o}$ to describe accurately any statistics that would
occur when processing the output state of the protocol, and estimate the
quality of an actual transmitted state, instead of a verification of a channel
only (see SUPP. MAT. D.1 for more details).

In SUPP. MAT. C we give detailed protocols where we apply these ideas to test
a transmitted quantum message under the device independent (DI) and one-sided
device independent (1sDI) scenarios. For the purpose of our demonstration, we
focus on an one-sided device independent scenario. A summary of the protocol
in this case is given in Fig. 2 (for a detailed recipe, the reader can refer
to the Supplementary Material). Here, Alice’s measurement setup is trusted,
such that her Hilbert spaces are qubit spaces
$\mathscr{H}_{\mathscr{A}_{1}}=\mathscr{H}_{\mathscr{A}_{2}}=\mathscr{H}_{i}$,
her isometries are trivial
$\Gamma_{i}=\Gamma^{\mathscr{A}_{1}}=\Gamma^{\mathscr{A}_{2}}=\mathds{I}$, and
she performs measurements in the Pauli $X$ and $Z$ bases:

$\displaystyle A_{0}=M^{\mathscr{A}_{2}}_{0|0}-M^{\mathscr{A}_{2}}_{1|0}=Z,$
(9) $\displaystyle
A_{1}=M^{\mathscr{A}_{2}}_{0|1}-M^{\mathscr{A}_{2}}_{1|1}=X.$ (10)

Figure 2: Protocol sketch in a one-sided device independent scenario: Alice
prepares $N$ copies of the probe state $\Phi_{i}$, and sends them through the
untrusted channel $\mathscr{E}$ that varies with time, as well as $\rho_{i}$
at a random secret position $r$. Some states are lost such that Bob only
receives a fraction of them. Alice tells Bob the value of $r$. If $\rho_{i}$
was lost, then the protocol aborts. Otherwise, Bob stores $\rho_{i}$ and,
together with Alice, tests the violation of the steering inequality with the
output probe states. They deduce the average channel’s quality over the
protocol, which informs on the probability that the message $\rho_{i}$ was
accurately transmitted to Bob, up to isometries.

This fits a variety of scenarios where Alice is a powerful server, trying to
provide states to a weaker client, Bob, whose measurement apparatus is still
untrusted. For that reason, Bob’s observables, defined as:

$\displaystyle B_{0}=M^{\mathscr{B}}_{0|0}-M^{\mathscr{B}}_{1|0},$ (11)
$\displaystyle B_{1}=M^{\mathscr{B}}_{0|1}-M^{\mathscr{B}}_{1|1},$ (12)

are _a priori_ unknown. In order to bound $F^{o}$, Alice and Bob use self-
testing through steering Šupić and Hoban (2016). Namely, the maximal violation
of the steering inequality Cavalcanti  _et al._ (2009):

$\beta=|\langle A_{0}B_{0}\rangle+\langle A_{1}B_{1}\rangle|\leq\sqrt{2},$
(13)

self-tests the maximally entangled pair of qubits. We then combine recent
self-testing results Unnikrishnan and Markham (2020) with further finite
statistics methods in a non-IID setting and with a lossy channel, in order to
estimate $F^{o}$ in bound (7) with high confidence, when a close-to-maximal
violation $\beta=2-\epsilon$ is measured:

$F^{o}\geq 1-\alpha f(\epsilon,K)\simeq 1-\alpha\epsilon,$ (14)

with $f$ a function of $\epsilon$ and the number $K$ of states measured by
Alice and Bob during the protocol (see Eq. (27) in Methods), and $\alpha=1.26$
Unnikrishnan and Markham (2020). This outlines the protocol: by sending $N$
characterized probe states through the channel, Alice and Bob estimate $F_{o}$
and thus the diamond fidelity between the extracted channel and the identity
channel, and therefore the transmission fidelity of an unknown state
$\rho_{i}$, as a function of $N$, $\epsilon$, and the number $K$ of
transmitted states.

Experimental implementation. In order to test the feasibility of our protocol,
we perform a proof-of-principle experiment based on photon pairs, emitted at
telecom wavelength via type-II spontaneous parametric down-conversion (SPDC)
in a periodically-poled KTP crystal (ppKTP). Photons are entangled in
polarization thanks to a Sagnac interferometer Fedrizzi  _et al._ (2007),
encoding in this way a close-to-maximally entangled pair of qubits. Details of
the setup are given in Fig. 3.

Figure 3: Experimental setup for photonic certified quantum communication
through an unstrusted channel. Photon pairs are generated via type-II SPDC, in
a ppKTP crystal ($30\text{\,}\mathrm{m}\mathrm{m}$-long,
$46.2\text{\,}\mathrm{\SIUnitSymbolMicro m}$ poling period), and entangled in
polarization in a Sagnac interferometer. The source is pumped with a
$770\text{\,}\mathrm{n}\mathrm{m}$ continuous laser. Signal and idler photons
are emitted around $1540\text{\,}\mathrm{nm}$, separated from the pump by a
dichroic mirror, and from each other by the polarizing beam splitter (PBS) of
the interferometer. They are then coupled into single-mode fibers, and sent to
the different players. The idler photon is both used as Alice’s part of the
maximally-entangled pair and to herald the probe state. The signal photon is
sent to Bob through the untrusted lossy channel. A variable optical attenuator
(VOA) allows to simulate an honest channel with a tunable amount of loss. The
biphoton state is measured with polarization analyzers, each made of two
waveplates (WPs), a fibered PBS, and $>80\%$-efficiency Superconducting
Nanowire Single-Photon Detectors (SNSPDs). The WPs are mounted on motorized
stages, allowing to both regularly randomize the measurement basis and
implement dishonest channels. Detection events are then sent to a fast
coincidence counter which gathers all the data required in order to evaluate
the quantum correlations and channel’s transmissivity.

The states emitted by the source are characterized at each iteration of the
protocol via quantum state tomography James  _et al._ (2001), without
inserting any untrusted quantum channel (green box in Fig. 3). Polarization
analyzers (PA) are trusted for that task, as it is performed by Alice. This
way we measured a fidelity of the probe’s polarization state to a Bell state
of $\overline{F^{i}}=99.20\%\pm 0.02\%$ on average over all protocol attempts,
with a maximum reached fidelity of $F^{i}=99.43\%\pm 0.05\%$. We then send the
probe states through an untrusted quantum channel. For this first
demonstration we use a variable optical attenuator (VOA) in order to simulate
a lossy but honest channel that requires certification. Detecting an idler
photon in Alice’s PA heralds a signal photon being sent through the quantum
channel, which is then detected in Bob’s PA. In each protocol attempt, the
transmissivity is identified as the probability that Bob detects a state,
knowing Alice heralded that state, and is also known as the heralding
efficiency $\eta_{s}$:

$t(\mathscr{E}|\Phi_{i})\simeq\eta_{s}=R_{si}/R_{i},$ (15)

where $R_{si}$ is the pair detection rate and $R_{i}$ the idler detection
rate. We measure the pairs in random bases $A_{0}B_{0}$ or $A_{1}B_{1}$, and
evaluate a close-to-maximum violation of steering inequality
$\beta=2-\epsilon$, with an average deviation ${\overline{\epsilon}=1.42\cdot
10^{-2}}$, and a minimum deviation measured in a protocol
$\epsilon_{\min}=1.32\cdot 10^{-2}$.

For each protocol attempt we set a different transmissivity of the VOA, such
that $\eta_{s}$ ranges from $21.9\%$ to $47.3\%$, the maximum value
corresponding to the replacement of the VOA by a simple fiber connector.
Following the 1sDI setting, Alice trusts her devices, so we are allowed to
take losses originating from her equipment as trusted. However, the
experimental set up makes it difficult to distinguish between the source of
losses. To allow for all cases we consider that a certain fraction of the
losses is not induced by the channel itself, but by other components which are
characterized by Alice, as part of the source. Such losses are considered
homogeneous and trusted, so the channel reads

$\mathscr{E}=(1-\lambda_{c})\mathscr{E}^{\prime},$ (16)

with $\lambda_{c}$ the amount of losses that is trusted and state-independent,
and $\mathscr{E}^{\prime}$ a quantum channel that is strictly equivalent to
$\mathscr{E}$ by definition, and therefore returns the same output states; see
Fig. 4. In that case we can certify $\mathscr{E}^{\prime}$ instead of
$\mathscr{E}$, and evaluate the transmissivity in bound (7) as

$t(\mathscr{E}^{\prime}|\Phi_{i})=t(\mathscr{E}|\Phi_{i})/(1-\lambda_{c})=\eta_{s}/(1-\lambda_{c}).$
(17)

This tightens the bound compared to the naive approach where all losses are
attributed to the channel. Adopting this interpretation is quite realistic,
considering that Alice preforms a full characterization of the probe states,
which potentially includes a lower bound on the coupling losses. In the most
paranoid scenario, we can always set $\lambda_{c}=0$ we attribute all loss
(including Alice’s coupling and detection losses) to the quantum channel.

Figure 4: Schematic decomposition of the untrusted channel $\mathscr{E}$, into
an equivalent channel $\mathscr{E}^{\prime}$ that the protocol effectively
certifies, and a trusted channel, corresponding to the characterized and
homogeneous losses $\lambda_{c}$ trusted by Alice.

We show the results of our implementations in Fig. 5. Thanks to our close-to-
maximum violation of steering inequality and relatively high coupling
efficiency, we are able to certify the transmission of an unknown qubit state
through the untrusted channel, with a non-trivial transmission fidelity
$F(\rho_{i},\rho_{o})>50\%$. This is true even when Alice attributes all
losses to the channel, _i.e._ $\lambda_{c}=0$, for channels with the highest
transmissivities. The certified fidelity increases as Alice trusts a larger
amount of homogeneous losses $\lambda_{c}$, reaching $F(\rho_{i},\rho_{o})\geq
77.1\%\pm 0.6\%$ when she assumes a maximum value $\lambda_{c}=0.526$ and the
channel is close to lossless. In any case, the certified fidelity decreases as
the channel gets more lossy, as a direct consequence of bound (7),
highlighting the difficulties of certifying lossy channels. This gives further
motivation to assume that a fraction of the losses is trusted, in order to
certify, for example, long-distance quantum communications. In our
implementation, assuming maximum trusted losses $\lambda_{c}=0.526$, we could
certify a non-trivial transmission fidelity $F(\rho_{i},\rho_{o})>50\%$, for
total transmissivities as low as $t(\mathscr{E}|\Phi_{i})=\eta_{s}\simeq
0.263$, while such certification was possible only for $\eta_{s}\gtrsim 0.44$
with no trusted losses $\lambda_{c}=0$.

Figure 5: Minimum fidelity $F(\rho_{i},\rho_{o})$ certified via our protocol
as a function of the measured heralding efficiency, tuned with a VOA, and for
different trusted losses $\lambda_{c}$ (colored curves). The curves are
plotted by taking the average fidelity of the probe state to a Bell state
$\overline{F_{i}}$, and the average of the deviation from maximum violation
$\epsilon$, over all protocol attempts. Experimental results deviate from
these curves, as $F^{i}$ and $\epsilon$ vary between experiments. Errors
induced by the finite statistics are directly subtracted from the certified
fidelity, as detailed in Methods (see Eqs. (28) and (29) in particular). Error
bars include effects induced by the unbalance in detectors’ efficiency and the
propagation of errors on $F^{i}$. We also display the fidelity
$F(\rho_{i},\rho_{o})$ measured via quantum state tomography, for
$\rho_{i}=\Phi_{i}$.

In order to fully demonstrate the protocol, one should send a single quantum
message $\rho_{i}$ through the channel, hidden among the probe states. The
value of that state does not matter in our implementation as we do not use it
in a later protocol, so we choose $\rho_{i}=\Phi_{i}$ and consider that a
random copy of the probe state is actually the quantum message. To show the
correctness of our protocol, we then perform a tomography of the corresponding
transmitted message $\rho_{o}$ after the channel, and evaluate a transmission
fidelity of $F(\rho_{i},\rho_{o})=99.79\%\pm 0.02\%$ on average over all
protocol attempts, with a minimum value of $F(\rho_{i},\rho_{o})=98.7\%\pm
0.5\%$. This is far higher than the values certified by our protocol, as
displayed on Fig. 5, which shows the state was indeed properly transmitted.
Note that, in this case, the channel and measurement stations are trusted
during the tomography of $\rho_{o}$, as it is performed outside of the
protocol. This allows us to measure numerous copies of $\rho_{o}$, which is
necessary for a full characterization of the state. In order to show that the
correctness of our certification protocol would hold for other quantum
messages $\rho_{i}$, we perform a full-process tomography of the quantum
channel Bongioanni  _et al._ (2010), and lower-bound the fidelity between the
physical channel and the identity
$\mathscr{F}_{\diamond}(\mathscr{E},\mathds{I})\geq 94\%\pm 3\%$. We expect
this bound to be far from tight, as it is evaluated using the equivalence
between diamond and Choi-Jamiołkowski distances Choi (1975) (see Lemma 2 in
Methods). Still, the fidelity is greatly above the values certified by our
protocol, showing the certification procedure is indeed valid for any quantum
message $\rho_{i}$.

The resilience of the protocol is further shown by experimentally simulating
examples of dishonest channels. Let us first recall that the operator of the
channel has no information on the position of the quantum message $\rho_{i}$
before the end of the protocol. This way, a typical attack consists in
applying a disruptive transformation with small probability, hoping it will be
applied to $\rho_{i}$ and stay undetected by Alice and Bob. Here we consider
such a transformation to be a bit flip and/or a phase flip. For this
experimental demonstration, we remove the VOA and consider that all losses are
trusted. Note that performing a phase flip is equivalent to turning Bob’s
first measurement $B_{0}$ into $-B_{0}$:

$B_{0}=M^{\mathscr{B}}_{0|0}-M^{\mathscr{B}}_{1|0}\longrightarrow-
B_{0}=M^{\mathscr{B}}_{1|0}-M^{\mathscr{B}}_{0|0}.$ (18)

Similarly, a bit flip is equivalent to turning Bob’s second measurement
$B_{1}$ into $-B_{1}$. Thus, we perform these flips in practice by randomly
changing the waveplate angles in order to get the opposite measurement bases.
This simulates dishonest channels of the form:

$\displaystyle\mathscr{E}_{p,q}[\rho]=(1-p)(1-q)\rho+p(1-q)X\rho X$ (19)
$\displaystyle+pqY\rho Y+(1-p)qZ\rho Z,$

with $p$ the bit flip probability and $q$ the phase flip probability.

Figure 6: Minimum fidelity $F(\rho_{i},\rho_{o})$ certified via our protocol,
for malicious channels $\mathscr{E}_{p,q}$, where $p$ is the probability of
applying gate $X$ and $q$ is the probability of applying gate $Z$. Here we
measured a probe state fidelity to a Bell state of $F^{i}=99.16\%\pm 0.04\%$,
and we trust a maximum amount of losses $\lambda_{c}=0.526$.

The certification results are displayed in Fig. 6, for different bit and phase
flip probabilities. These show that our implementation is quite sensitive to
these attacks, such that a flip probability of $0.01$ induces a collapse of
$16\%$ of the certified fidelity, and we only certify
$F(\rho_{i},\rho_{o})\geq 58\%$. The certified fidelity falls below the
trivial value $50\%$ for flip probabilities as low as $0.017$. In this way,
any attempt of Eve to disrupt the input state $\rho_{i}$ with such a method
can only succeed with very small probabilities $p,q<0.02$, or it will be
detected by Alice and Bob.

Discussion

In this work, we have provided a protocol to certify the transmission of a
qubit through an untrusted and lossy quantum channel, by probing the latter
with close-to-maximally entangled states and witnessing non-classical
correlations at its output. In the DI case these are Bell correlations, in the
1sDI they are steering correlations. Our theoretical investigations rely only
on assumptions made on the probe state’s source and the sender’s measurement
apparatus (in the case of 1sDI), while relaxing assumptions made on the
quantum channel and the receiver’s measurement apparatus. This setting proves
to be an interesting trade-off between realistic experimental conditions and
reasonable cryptographic requirements. It also embodies a practical scenario
in which a strong server provides a weaker receiver with a quantum bit.

Compared to previously proposed verification procedures, our protocol not only
certifies the probed channels, but also an unmeasured channel through which a
single unknown state can be sent. As quantum measurements deteriorate the
quantum states, this task can only be performed at the price of measuring a
huge amount of probe states, which limits the repeatability of the protocol
with current technology. Until further theoretical considerations or
technological improvements provide higher repeatability, our protocol can
still serve as a practical primitive for other single-shot protocols that
require a single quantum state, such as the recently demonstrated quantum weak
coin-flipping Neves  _et al._ (2023); Bozzio  _et al._ (2020).

Our proof-of-principle implementation shows the correctness of this
certification procedure, and its feasibility with current technology. This way
we could certify non-trivial transmission fidelities for a wide range of
losses induced by the channel, by making some mild but realistic assumptions,
such as the characterization of a fraction of trusted losses, induced for
instance by the coupling of probe states inside optical fibers. By
implementing random bit and phase flips, we could show that even a small
probability attempt to disrupt the quantum information degrades the certified
transmission fidelity, and is therefore detected by the players.

Future developments could demonstrate the feasibility of a fully device
independent version of our protocol, in which Alice’s measurement or even the
probe states’ source are not trusted. Such a protocol could be achieved by
linking the probe state quality to that of the corresponding output state, or
by making the IID assumption on the probe state’s source. Also, more
investigation on quantum-memory-based attacks could give a sharper idea on the
possibilities of deceiving the certification procedure.

Our work opens the way to certification of a wide variety of more
sophisticated lossy quantum channels. In particular, the rapid improvements of
quantum technologies could soon provide possible applications of this protocol
to the authentication of quantum teleportation, memories or repeaters.

Methods

Two Useful Lemmas. The proof of bound (7) relies on two lemmas, which give
fundamental results on lossy quantum channels, and that we provide here.

######  Lemma 1 (Extended Processing Inequality).

For any probabilistic channel $\mathscr{E}$ (CPTD), and any input states
$\rho_{i}$ and $\sigma_{i}$, the following inequality holds for the sine
distance $C(\rho,\sigma)=\sqrt{1-F(\rho,\sigma)}$:

$C(\rho_{i},\sigma_{i})\geq t\cdot C(\rho_{o},\sigma_{o}),$ (20)

where $\rho_{o}=\mathscr{E}[\rho_{i}]/t(\mathscr{E}|\rho_{i})$ and
$\sigma_{o}=\mathscr{E}[\sigma_{i}]/t(\mathscr{E}|\sigma_{i})$ are the output
states of the channel, and $t=t(\mathscr{E}|\rho_{i})$ or
$t=t(\mathscr{E}|\sigma_{i})$.

This first lemma generalizes to CPTD maps the well-known fidelity processing
inequality $F(\rho,\sigma)\leq F(\mathscr{E}[\rho],\mathscr{E}[\sigma])$,
which holds for any CPTP map $\mathscr{E}$.

######  Lemma 2 (Channel’s Metrics Equivalence).

For any probabilistic channel $\mathscr{E}_{1}$, and any $\mathscr{E}_{2}$
that is proportional to a deterministic channel (CPTP map), both acting on
$\mathscr{L}(\mathscr{H}_{i})$, we have the following inequalities:

$\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})\leq\mathscr{C}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})\leq\dim\mathscr{H}_{i}\times\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2}),$
(21)

where the $\mathscr{C}_{J}$, resp. $\mathscr{C}_{\diamond}$, are the Choi-
Jamiołkowski, resp. diamond, sine distances of probabilistic quantum channels:

$\displaystyle\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})=C\Bigl{(}\dfrac{(\mathscr{E}_{1}\otimes\mathds{I})[\Phi_{+}]}{t(\mathscr{E}_{1}|\Phi_{+})},(\mathscr{E}_{2}\otimes\mathds{I})[\Phi_{+}]\Bigr{)},$
(22)
$\displaystyle\mathscr{C}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})=\sup_{{\lvert\phi\rangle}}C\Bigl{(}\dfrac{(\mathscr{E}_{1}\otimes\mathds{I})[\phi]}{t(\mathscr{E}_{1}|\phi)},(\mathscr{E}_{2}\otimes\mathds{I})[\phi]\Bigr{)}.$
(23)

This lemma shows the equivalence between Choi-Jamiołkowski and diamond
distances, which is fundamental when trying to link the behaviour of the
channel on a maximally-entangled state, to its behaviour on any quantum state.
We also use this lemma in order to bound the diamond fidelity after performing
a full process tomography of the channel, by evaluating the more
straightforward Choi-Jamiołkowski fidelity.

Note that both these lemmas also apply to the trace distance
$D(\rho,\sigma)=\tfrac{1}{2}\textrm{Tr}|\rho-\sigma|$, and are proven in SUPP.
MAT. B.1 and B.2.

Protocol Security. In our protocol, the quantum channel is allowed to evolve
through time, with some potential memory of the experiment’s past history.
This way we define the channel $\mathscr{E}_{k|[k-1]}$, where
$[k-1]=k-1,k-2,...,1$, that operates on the $k$-th state sent by Alice through
the protocol. In particular, Alice sends the quantum message $\rho_{i}$ at a
random position $r$ through channel $\mathscr{E}_{r|[r-1]}$. We then define
the expected channel over the protocol:

$\bar{\mathscr{E}}=\frac{1}{N+1}\sum_{k=1}^{N+1}\mathscr{E}_{k|[k-1]}.$ (24)

As $\rho_{i}$ is sent at a random position that stayed concealed from the
channel’s operator, the expected transmitted message is
$\bar{\rho}_{o}=(\bar{\mathscr{E}}\otimes\mathds{I})[\rho_{i}]/t(\bar{\mathscr{E}}|\rho_{i})$.
As long as $r$ stays hidden and random, any measurement performed on the
transmitted message later after the protocol would follow the same statistics
as if it was performed on $\bar{\rho}_{o}$ (see SUPP. MAT. D.1 for more
details). This way, we derive the protocol security by applying bound (7) to
the average channel $\bar{\mathscr{E}}$, in order to bound the fidelity of
$\bar{\rho}_{o}$ to $\rho_{i}$, up to isometry. In particular, the output
probe state fidelity to a maximally entangled state now reads

$\displaystyle
F^{o}=F\bigl{(}(\Lambda^{\mathscr{B}}\otimes\Lambda^{\mathscr{A}_{2}})[(\mathscr{E}\otimes\mathds{I})[\Phi_{i}]]/t(\bar{\mathscr{E}}|\Phi_{i}),(\mathscr{E}_{0}\otimes\mathds{I})[\Phi_{+}]\bigr{)}.$
(25)

Using recent self-testing results in a non-IID setting Unnikrishnan and
Markham (2020) applied to the output probe state, we show in SUPP. MAT. D that
for any $x>0$, $C^{o}=\sqrt{1-F^{o}}$ can be bounded by two terms, with
confidence of at least ${c_{x}=(1-e^{-x})\cdot(1-2e^{-x})^{2}}$:

$\arcsin C^{o}\leq\arcsin\sqrt{\alpha
f_{x}(\epsilon,K)}+\Delta_{x}(\eta_{s},K),$ (26)

where $K$ is the number of pairs measured by Alice and Bob, $\eta_{s}$ is the
measured heralding efficiency, $\Delta_{x}(\eta_{s},K)$ is an error function
that goes to $0$ for high values of $K$, $\alpha f_{x}$ gives self-testing
bound on the output state, in a non-IID regime, with

$f_{x}(\epsilon,K)=8\sqrt{\dfrac{x}{K}}+\dfrac{\epsilon}{2}+\dfrac{\epsilon+8/K}{2+1/K}\xrightarrow[K\rightarrow+\infty]{}\epsilon,$
(27)

and $\alpha=1.26$. We choose $x=7$ to get a confidence $c_{x}>99.5\%$, and
measure $K\simeq 10^{9}$ copies of the probe state, in order to reach the
asymptotic values, which takes from 1 to 3 hours in our experiments depending
on the channel transmissivity. Note that the error function is due to both the
non-IID regime and the lack of information on channels that do not output any
state. A similar error occurs when we evaluate the transmissivity as the
measured heralding efficiency:

$t(\bar{\mathscr{E}}|\Phi_{i})\gtrsim\tau_{x}(\eta_{s},K),$ (28)

where $\tau_{x}(\eta_{s},K)\simeq\eta_{s}$ for high values of $K$. This way,
the actual bound on the fidelity between the input and output state reads,
with confidence $c_{x}$,

$\displaystyle F(\bar{\rho}_{o},\rho_{i})\geq 1-$
$\displaystyle\>4\cdot\sin^{2}\biggl{(}\arcsin\bigl{(}C^{i}/\tau_{x}\bigr{)}+$
(29) $\displaystyle\hskip 28.45274pt\arcsin\sqrt{\alpha
f_{x}(\epsilon,K)}+\Delta_{x}\biggr{)},$

which includes additive error terms compared to bound (7). In the analysis of
our data, we include these terms that are minimized thanks to the large number
$K$ of states measured for each implementation. Note that the expressions for
all the mentioned functions are detailed in SUPP. MAT. D.4.

Assumptions. For clarity we highlight the assumptions made in our security
analysis.

First, we assume Alice and Bob can communicate via a trusted private classical
channel. It allows the players to agree on their measurement settings, Alice
to send Bob the position $r$ of the quantum message $\rho_{i}$, and Bob to
tell Alice if the states were properly received. This way, the players can
perform measurements on the fly, instead of storing all the states, then
deciding of the measurement bases and finally measuring the states, which
would require one billion of quantum memories with hours-long storage-time.

Secondly, the fair sampling assumption is required on the measurement
apparatus for the self-testing procedure, as we allow a large amount of losses
to be induced by the quantum channel. Alice’s measurement apparatus is
completely trusted and characterized, according to the one-sided device
independent scenario. On Bob’s side, we assume the efficiency of the
measurement apparatus to be independent of the measurement setting $B_{0}$ or
$B_{1}$. If the efficiency depends on the state measured, then we consider
that dependence to be part of the quantum channel. A slight unbalance of
efficiency is allowed between the two different measurement outcomes, and we
show in the SUPP. MAT. E.3 that the error induced by this unbalance is
negligible.

Finally, in keeping with the 1sDI setting, we make the IID assumption on the
probe state source, during each attempt of the protocol. To show the
legitimacy of this assumption in our implementation, we performed a series of
quantum state tomography measurements, during 8 hours, in order to
characterize the fluctuation of the probe state with time. This
characterization shows the probe states are stable at the scale of one
protocol (see SUPP. MAT. E.1 for the detailed results).

Source and Detection. Probe states are generated via type-II SPDC in a ppKTP
crystal combined with a Sagnac interferometer. We maximized the heralding
efficiency $\eta_{s}=R_{si}/R_{i}$, with $R_{i}$ the idler photon detection
rate and $R_{si}$ the pair detection rate, following the method proposed in
Bennink (2010); Bruno  _et al._ (2014). For that purpose, the pump’s spatial
mode and focus as well as the pair’s collection modes, were tuned carefully
when coupling to single-mode fibers, and losses on the signal photon path were
minimized. This way the pump is in a collimated mode at the scale of the
crystal, close to a gaussian mode of waist
$w_{p}\simeq$315\text{\,}\mathrm{\SIUnitSymbolMicro m}$$, which maximizes the
heralding efficiency Guerreiro  _et al._ (2013); Bruno  _et al._ (2014). The
signal photon’s coupling mode has a waist
$w_{s}\simeq$190\text{\,}\mathrm{\SIUnitSymbolMicro m}$$, and the idler
photon’s is $w_{i}\simeq$218\text{\,}\mathrm{\SIUnitSymbolMicro m}$$. We also
used high-efficiency SNSPDs to detect the photons. Losses on the idler photon
were not limiting, so we selected the best components and detectors for the
signal photon. All detection events were recorded by a time tagger, and dated
with picosecond precision. Two detection events were considered simultaneous
when measured within the same $500\text{\,}\mathrm{p}\mathrm{s}$ coincidence
window. In this way, we detect idler photons in Alice’s detectors with a rate
$R_{i}=$600\pm 40\text{\,}\mathrm{kHz}$$ (varying from one protocol attempt to
another), for a brilliance of $\simeq$670\pm
50\text{\,}\mathrm{kHz}\text{\,}{\mathrm{W}}^{-1}\text{\,}{\mathrm{nm}}^{-1}$$.
SNSPDs display dark count rates of $\leq$500\text{\,}\mathrm{Hz}$$, such that
the probability of falsely heralding a probe state is negligible. Finally,
$1\text{\,}\mathrm{nm}$-bandwidth spectral filters were used to limit the
spectrum spread that would otherwise degrade the polarization state because of
birefringence and dispersion in optical fibers.

Quantum State Tomography. We perform quantum state tomographies via linear
regression estimation Qi  _et al._ (2013) and fast maximum likelihood
estimation Smolin  _et al._ (2012). Photon counts are corrected by measuring
relative efficiencies of the detectors. We use this method in order to
reconstruct the probe state $\Phi_{i}$, and to calculate the probe state
fidelity to a maximally entangled state $F^{i}$. For this calculation, we
maximize the fidelity

$F^{i}_{U}=F\bigl{(}(\mathds{I}\otimes U)\Phi_{i}(\mathds{I}\otimes
U^{\dagger}),\Phi_{+}\bigr{)}$ (30)

on a local unitary $U$, to evaluate the maximum fidelity up to isometries, as
defined in Eq. (5).

The uncertainties on the reconstructed states, induced by the photon counting
poissonian statistics as well as by the systematic errors on the measurement
bases, are evaluated by using the Monte Carlo method. This way, we simulate
1000 new data samples within the respective uncertainties distributions and
reconstruct new density matrices from which we evaluate the average fidelity
and standard deviation Altepeter  _et al._ (2005). Slow thermal fluctuation
also induce some uncertainty on the fidelity, as our experiment lasts for a
relatively long period of time. By continuously performing quantum state
tomographies for 8 hours, we are able to evaluate the fluctuations in the
quantum state on time spans of the order of a protocol duration. This way, we
measure an additional $0.02\%$ error on the quantum state fidelities to Bell
states, due to thermal fluctuations. The reader can refer to SUPP. MAT. E.1
for more details on the evaluation of these thermal fluctuations and the drift
of the quantum state through time.

Steering measurement. When testing the violation of steering inequality,
players should in principle pick a random measurement basis between
$A_{0}B_{0}$ and $A_{1}B_{1}$ for each new photon pair. However, because of
technical limitations of our motorized waveplate stages, we only operate this
randomization at a limited rate of $1\text{\,}\mathrm{Hz}$. A fully secure
protocol would therefore require faster electronics and active optical
components.

For the implementation of malicious channels, we perform a 7-hours measurement
run. From this single run we generate the data that could be acquired in the
certification procedure of a variety of channels $\mathscr{E}_{p,q}$, as
defined in Eq. (19). For this run, we randomize the measurement basis, with
equal probabilities between $A_{0}B_{0}$, $A_{1}B_{1}$ (the channel chooses to
act honestly), and $-A_{0}B_{0}$, $-A_{1}B_{1}$ (the channel chooses to
disrupt the state). In order to simulate a larger variety of data samples, we
perform that randomization at a $5\text{\,}\mathrm{Hz}$-rate. We then generate
the data for the certification of channel $\mathscr{E}_{p,q}$, by picking a
random set of samples, with the following proportions:

  * •

$q/2$ in basis $-A_{0}B_{0}$,

  * •

$p/2$ in basis $-A_{1}B_{1}$,

  * •

$(1-q)/2$ in basis $A_{0}B_{0}$,

  * •

$(1-p)/2$ in basis $A_{1}B_{1}$.

The data acquired in basis $-A_{0}B_{0}$ and $-A_{1}B_{1}$ is treated as if it
was acquired in basis $A_{0}B_{0}$ and $A_{1}B_{1}$, respectively, when
calculating the average violation of steering inequality $\beta=|\langle
A_{0}B_{0}\rangle+\langle A_{1}B_{1}\rangle|$.

Note added. While finishing this manuscript we became aware of a related work
by Bock _et al._ Bock  _et al._ (2023).

Acknowledgments We acknowledge useful discussions with Anupama Unnikrishnan
and Massimiliano Smania on self-testing techniques and assistance from
IDQuantique with the single-photon detectors. We also acknowledge financial
support from the European Research Council project QUSCO (E.D.), the PEPR
integrated projects EPiQ ANR-22-PETQ-0007 and DI-QKD ANR-22-PETQ-0009, which
are part of Plan France 2030, and the Marie Skłodowska-Curie grant agreement
No 956071 (AppQInfo).

Author contributions
S.N. developed the theoretical protocols and proofs, together with I.S., D.M.
and E.D. S.N. and E.D. conceived the experimental setup, S.N. developed it,
and S.N., L.M., V.Y. and P.L. performed the protocol implementation. S.N. and
L.M. processed the data. All authors discussed the analysis of the data, and
contributed to writing or proofreading the manuscript. D.M. and E.D.
supervised the project.

## References

  * Wehner  _et al._ (2018) S. Wehner, D. Elkouss, and R. Hanson, Science 362, eaam9288 (2018).
  * Fitzsimons (2017) J. F. Fitzsimons, npj Quantum Information 3, 26 (2017).
  * Shettell and Markham (2022) N. Shettell and D. Markham, Phys. Rev. A 106, 052427 (2022).
  * Awschalom and et al. (2021) D. Awschalom and et al., PRX Quantum 2, 017002 (2021).
  * Saleem  _et al._ (2021) Z. H. Saleem, T. Tomesh, M. A. Perlin, P. Gokhale, and M. Suchara, arXiv:2107.07532 [quant-ph] (2021).
  * Barnum  _et al._ (2002) H. Barnum, C. Crépeau, D. Gottesman, A. Smith, and A. Tapp, in  _The 43rd Annual IEEE Symposium on Foundations of Computer Science, 2002. Proceedings._ (IEEE, 2002) pp. 449–458.
  * Dupuis  _et al._ (2012) F. Dupuis, J. B. Nielsen, and L. Salvail, in  _Advances in Cryptology–CRYPTO 2012: 32nd Annual Cryptology Conference, Santa Barbara, CA, USA, August 19-23, 2012. Proceedings_ (Springer, 2012) pp. 794–811.
  * Broadbent  _et al._ (2013) A. Broadbent, G. Gutoski, and D. Stebila, in  _Advances in Cryptology–CRYPTO 2013: 33rd Annual Cryptology Conference, Santa Barbara, CA, USA, August 18-22, 2013. Proceedings, Part II_ (Springer, 2013) pp. 344–360.
  * Markham and Marin (2015) D. Markham and A. Marin, in  _Information Theoretic Security: 8th International Conference, ICITS 2015, Lugano, Switzerland, May 2-5, 2015. Proceedings 8_ (Springer, 2015) pp. 1–14.
  * Markham and Krause (2020) D. Markham and A. Krause, Cryptography 4, 3 (2020).
  * Zhu and Hayashi (2019) H. Zhu and M. Hayashi, Physical Review A 100, 062335 (2019).
  * Takeuchi  _et al._ (2019) Y. Takeuchi, A. Mantri, T. Morimae, A. Mizutani, and J. F. Fitzsimons, npj Quantum Information 5, 27 (2019).
  * Colbeck (2011) R. Colbeck, arXiv:0911.3814 [quant-ph] (2011).
  * Acín  _et al._ (2007) A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V. Scarani, Phys. Rev. Lett. 98, 230501 (2007).
  * Pironio  _et al._ (2010) S. Pironio, A. Acín, S. Massar, A. B. d. l. Giroday, D. N. Matsukevich, P. Maunz, S. Olmschenk, D. Hayes, L. Luo, T. A. Manning, and C. Monroe, Nature 464, 1021 (2010).
  * Reichardt  _et al._ (2013) B. W. Reichardt, F. Unger, and U. Vazirani, Nature 496, 456 (2013).
  * Baccari  _et al._ (2020) F. Baccari, R. Augusiak, I. Šupić, and A. Acín, Phys. Rev. Lett. 125, 260507 (2020).
  * Šupić and Brunner (2022) I. Šupić and N. Brunner, arXiv:2203.13171 [quant-ph] (2022).
  * Sekatski  _et al._ (2018) P. Sekatski, J.-D. Bancal, S. Wagner, and N. Sangouard, Phys. Rev. Lett. 121, 180505 (2018).
  * Magniez  _et al._ (2005) F. Magniez, D. Mayers, M. Mosca, and H. Ollivier, arXiv:quant-ph/0512111 (2005).
  * Note (1) The identity channel on $\mathscr{H}_{i}^{ext}$ is omitted in (2) for more clarity.
  * Rastegin (2006) A. E. Rastegin, arXiv:quant-ph/0602112 (2006).
  * Unnikrishnan and Markham (2020) A. Unnikrishnan and D. Markham, Phys. Rev. A 102, 042401 (2020).
  * Šupić and Hoban (2016) I. Šupić and M. J. Hoban, New J. Phys. 18, 075006 (2016).
  * Cavalcanti  _et al._ (2009) E. G. Cavalcanti, S. J. Jones, H. M. Wiseman, and M. D. Reid, Phys. Rev. A 80, 032112 (2009).
  * Fedrizzi  _et al._ (2007) A. Fedrizzi, T. Herbst, A. Poppe, T. Jennewein, and A. Zeilinger, Opt. Express 15, 15377 (2007).
  * James  _et al._ (2001) D. F. V. James, P. G. Kwiat, W. J. Munro, and A. G. White, Phys. Rev. A 64, 052312 (2001).
  * Bongioanni  _et al._ (2010) I. Bongioanni, L. Sansoni, F. Sciarrino, G. Vallone, and P. Mataloni, Phys. Rev. A 82, 042307 (2010).
  * Choi (1975) M.-D. Choi, Linear Algebra and its Applications 10, 285 (1975).
  * Neves  _et al._ (2023) S. Neves, V. Yacoub, U. Chabaud, M. Bozzio, I. Kerenidis, and E. Diamanti, Nature Communications 14, 1855 (2023).
  * Bozzio  _et al._ (2020) M. Bozzio, U. Chabaud, I. Kerenidis, and E. Diamanti, Phys. Rev. A 102, 022414 (2020), arXiv: 2002.09005.
  * Bennink (2010) R. S. Bennink, Phys. Rev. A 81, 053805 (2010).
  * Bruno  _et al._ (2014) N. Bruno, A. Martin, T. Guerreiro, B. Sanguinetti, and R. T. Thew, Optics Express 22, 17246 (2014).
  * Guerreiro  _et al._ (2013) T. Guerreiro, A. Martin, B. Sanguinetti, N. Bruno, H. Zbinden, and R. Thew, Opt. Express 21, 27641 (2013).
  * Qi  _et al._ (2013) B. Qi, Z. Hou, L. Li, D. Dong, G. Xiang, and G. Guo, Sci. Rep. 3, 1 (2013).
  * Smolin  _et al._ (2012) J. A. Smolin, J. M. Gambetta, and G. Smith, Phys. Rev. Lett. 108, 070502 (2012).
  * Altepeter  _et al._ (2005) J. B. Altepeter, E. R. Jeffrey, and P. G. Kwiat, Advances in Atomic, Molecular, and Optical Physics 52, 105 (2005).
  * Bock  _et al._ (2023) M. Bock, P. Sekatski, J.-D. Bancal, S. Kucera, T. Bauer, N. Sangouard, B. Christoph, and E. Jürgen, “Calibration-independent certification of a quantum frequency converter,” (2023), arXiv:xxxx.xxxxx [quant-ph] .
  * Nielsen and Chuang (2011) M. A. Nielsen and I. L. Chuang,  _Quantum Computation and Quantum Information: 10th Anniversary Edition_ (Cambridge University Press, 2011).
  * Lütkenhaus  _et al._ (1999) N. Lütkenhaus, J. Calsamiglia, and K.-A. Suominen, Phys. Rev. A 59, 3295 (1999).
  * Gilchrist  _et al._ (2005) A. Gilchrist, N. K. Langford, and M. A. Nielsen, Phys. Rev. A 71, 062310 (2005).
  * Unnikrishnan  _et al._ (2019) A. Unnikrishnan, I. J. MacFarlane, R. Yi, E. Diamanti, D. Markham, and I. Kerenidis, Physical Review Letters 122, 240501 (2019), arXiv: 1811.04729.
  * Clauser  _et al._ (1969) J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, Phys. Rev. Lett. 23, 880 (1969).
  * Unnikrishnan (2019) A. Unnikrishnan,  _Enforcing trust in quantum networks_ , Ph.D. thesis, University of Oxford, University of Oxford (2019).
  * Unnikrishnan and Markham (2019) A. Unnikrishnan and D. Markham, Phys. Rev. A 100, 032314 (2019).
  * Gočanin  _et al._ (2022) A. Gočanin, I. Šupić, and B. Dakić, PRX Quantum 3, 010317 (2022).
  * Šupić and Bowles (2020) I. Šupić and J. Bowles, Quantum 4, 337 (2020).
  * Orsucci  _et al._ (2020) D. Orsucci, J.-D. Bancal, N. Sangouard, and P. Sekatski, Quantum 4, 238 (2020).

## Supplementary Material

In addition to the results presented in the main text, we provide the
following material in order to prove our different theoretical results and
present more experimental details. We also show some interesting theoretical
results related to our study, though they are not essential for its
understanding. The outline for this material is the following.

In appendix A we give some important definitions, including that of general
quantum channels, including lossy channels, equivalence classes of channels,
and channels metrics.

In appendix B we show some new fundamental results, such as Lemma 1, i.e., the
processing inequality of general lossy channels, Lemma 2, i.e., equivalence
inequalities between different metrics of quantum channels, and some useful
result on channels’ transmissivity.

In appendix C we provide the detailed theoretical recipes for channel
certification protocols, in a one-sided device independent and in a fully
device independent. Both these recipes are detailed in the spirit of those
provided in Unnikrishnan and Markham (2020) for authenticated teleportation,
and differ slightly from the protocol that we experimentally implement. In
particular, the former rely on trusted quantum memories for storing all states
sent by Alice, while the latter rely on trusted private classical
communications between Alice and Bob.

In appendix D we use the results of previous paragraphs in order to derive
security bounds for our protocols. We first show bound (7), which relies on
the evaluation of the fidelity of a probe state to a maximally entangled
state, and the fidelity of the corresponding output state after the channel to
the same maximally entangled state. This bounds the fidelity between any state
that outputs a quantum channel and the corresponding unknown input state. In
the second part of that paragraph, we show how to evaluate the two probe
states’ fidelities up to isometries, even when no IID assumption is made and
the state source might be untrusted. This method relies on self-testing of
steering inequalities in a semi-device independent scenario, where Alice’s
measurement setup is trusted. Still, this method requires the measurement of a
large sample of close-to-maximally entangled states, going through a channel
that might evolve through time. In particular, the channel might not have the
same action on the probe states than on the transmitted state. Therefore, we
give some important statistical development in the next part of the paragraph,
in order to bound the errors made on the different evaluated fidelities, due
to finite state sample in a non-IID setting, as well as losses in the
untrusted channel. Finally, we tie up the security proof, combining the
previous parts’ results in order to provide a bound on the expected fidelity
of the transmitted output state to the input state. We then give some way to
generalize that security proof to a fully-device independent setting.

In appendix E, we give additional details on our experimental implementation.
In particular, we provide some developments on the probe state source, such as
the density matrix of a state emitted by that source, and a characterization
of the stability of our source, motivating the IID assumption. We also detail
the results of measurements performed during our implementations of the
protocol, from which we deduce the bound on the transmission fidelity. We also
formalize the fair-sampling assumptions made on the players’ measurement
apparatus, and discuss the influence of a slight unbalance in the detectors
efficiency, which we observe in our experiments.

##  Appendix A Preliminary Definitions

In this study, we use the quantum operations formalism Nielsen and Chuang
(2011), in order to describe as generally as possible the transformations
undergone by quantum states. Such a formalism allows us to include a variety
of processes, such as unitary transformations, quantum measurements and
ancillary inclusion. Although most studies consider only trace-preserving
quantum channels, i.e. lossless channels, our study requires the consideration
of trace-decreasing channels that account for potentially lossy devices. This
section is meant to clarify some important definitions and properties linked
to these channels, as well as discuss the physical reality embodied in these
mathematical objects.

###  A.1 Quantum Channels

A general quantum channel $\mathscr{E}$ is a convex, linear and completely-
positive non-trace-increasing (CPnTI) map, from operators on space
$\mathscr{H}_{i}$ to operators on space $\mathscr{H}_{o}$ i.e.:

  1. 1.

For any sets of probabilities $\\{p_{i}\\}$ and density operators
$\\{\rho_{i}\\}$, the following equality holds:

$\mathscr{E}\bigg{[}\sum_{i}p_{i}\rho_{i}\bigg{]}=\sum_{i}p_{i}\mathscr{E}[\rho_{i}]$
(31)

  2. 2.

For any secondary system of Hilbert space $\mathscr{S}$,
$(\mathscr{E}\otimes\mathds{I}_{\mathscr{S}})[K]$ is positive for any positive
operator $K$ taken in $\mathscr{L}(\mathscr{H}_{i}\otimes\mathscr{S})$. In
particular, $\mathscr{E}$ is completely positive.

  3. 3.

For any operator $K$ acting on $\mathscr{H}_{i}$, we have
$\textrm{Tr}\mathscr{E}[K]\leq\textrm{Tr}K$.

When $\mathscr{E}$ is also trace-preserving (CPTP map), in particular
$\textrm{Tr}\mathscr{E}[\rho]=1$ for any density operator $\rho$, then we call
$\mathscr{E}$ a deterministic or lossless quantum channel. Otherwise, if the
map is trace-decreasing, then there exists a state $\rho$ such that
$\textrm{Tr}\mathscr{E}[\rho]<1$, we call it a probabilistic or lossy quantum
channel. From this definition can be derived the well known Kraus’ theorem,
that gives a complete characterization of quantum channels:

######  Theorem 1 (Kraus’ Theorem).

The map $\mathscr{E}$ from $\mathscr{L}(\mathscr{H}_{i})$ to
$\mathscr{L}(\mathscr{H}_{o})$ is a quantum channel if and only if there exist
a set of operators $\\{K_{j}\\}_{j}$ that map $\mathscr{H}_{i}$ to
$\mathscr{H}_{o}$, such that:

$\mathscr{E}[\rho_{i}]=\sum_{j}K_{j}\rho_{i}K_{j}^{\dagger}$ (32)

and $\sum_{j}K_{j}^{\dagger}K_{j}\leq\mathds{I}$. $\mathscr{E}$ is a
deterministic quantum channel when this condition holds and
$\sum_{j}K_{j}^{\dagger}K_{j}=\mathds{I}$. When
$\sum_{j}K_{j}^{\dagger}K_{j}<\mathds{I}$, the channel is probabilistic.

This theorem gives us an operator-sum representation for quantum channels,
which will be most useful in the following. The operators $\\{K_{j}\\}$ are
refered to as Kraus’ operators of the channel $\mathscr{E}$.

The previous axioms and properties imply that for any density operator
$\rho\in\mathscr{L}(\mathscr{H}_{i}\otimes\mathscr{S})$, with $\mathscr{S}$ an
arbitrary Hilbert space, we have
$0\leq\textrm{Tr}((\mathscr{E}\otimes\mathds{I})[\rho])\leq 1$. This means
that in the most general case, $(\mathscr{E}\otimes\mathds{I})[\rho]$ is not a
density operator. This way, our channel does not operate with absolute
certainty, but returns a state only with a certain probability
$t(\mathscr{E}|\rho)=\textrm{Tr}(\mathscr{E}\otimes\mathds{I})[\rho]$. We call
$t(\mathscr{E}|\rho)$ the transmissivity of channel $\mathscr{E}$. Then for
$t(\mathscr{E}|\rho)\neq 0$ we define the output state:

$\rho_{o}=(\mathscr{E}\otimes\mathds{I})[\rho]/t(\mathscr{E}|\rho)$ (33)

and when $t(\mathscr{E}|\rho)=0$, i.e. no state ever outputs the channel, we
set by convention
$\rho_{o}=\mathds{I}/\dim(\mathscr{H}_{o}\otimes\mathscr{S})$.

Quantum channels are fundamental objects that describe any transformation
undergone by a quantum state. Still, most studies focus on lossless quantum
channels i.e. CPTP maps, such that any state passes the channel with absolute
certainty. In theory, any situation involving a lossy channel can be described
by considering a CPTP map
$\mathscr{E}[\bullet]=\mathscr{E}_{s}[\bullet]\otimes{\lvert
s\rangle\\!\langle s\rvert}+\mathscr{E}_{f}[\bullet]\otimes{\lvert
f\rangle\\!\langle f\rvert}$, with $\mathscr{E}_{s}$ the successful branch and
$\mathscr{E}_{f}$ the failure branch, where the state might be considered as
lost. However in most experimental situations, we generally have no access to
the state when it goes through the failure branch, such that we are only
interested in states sent through the success branch. This means we post-
select states on the success branch, and we only consider the probabilistic
channel $\mathscr{E}_{s}[\rho]={\langle s\rvert}\mathscr{E}[\rho]{\lvert
s\rangle}$. The transmissivity is then the probability that the channel
successfully outputs the input state, so that
$t(\mathscr{E}_{s}|\rho)=\textrm{Tr}\mathscr{E}_{s}[\rho]=\textrm{Tr}(\mathscr{E}[\rho]\mathds{I}\otimes{\lvert
s\rangle\\!\langle s\rvert})$. This way, losses are included in the expression
of the channel itself.

Finally we give a few common examples of probabilistic quantum channels. A
trivial probabilistic quantum channel is $\mathscr{E}=p\cdot\mathds{I}$ with
$p\in\>]0;1]$, that models unbiased losses. In that case the state is simply
transmitted without transformation with probability $p$, or lost with
probability $1-p$. On the contrary, a channel with fully-biased losses would
be a polarizing channel $\mathscr{P}$, with
$\mathscr{P}[\rho]={\lvert\phi\rangle\\!\langle\phi\rvert}\>\rho\>{\lvert\phi\rangle\\!\langle\phi\rvert}$
for any state $\rho$, with ${\lvert\phi\rangle}$ a pure state. In that case
$t(\mathscr{P}|\rho)=1$ if and only if
$\rho={\lvert\phi\rangle\\!\langle\phi\rvert}$. Finally, probabilistic
channels allows us to describe an experiment where one wishes to measure a
POVM $\\{M_{k}\\}_{1\leq k\leq d}$ but only has access to the first $m$
elements, with $m<d$. We can therefore define the following channel:

$\mathscr{E}[\rho]=\sum_{i=1}^{m}M_{k}\rho M_{k}^{\dagger}\otimes{\lvert
k\rangle\\!\langle k\rvert}$ (34)

This example is of particular use for Bell state measurements using linear
optics, where it was shown that one can measure only two elements out of four
Lütkenhaus  _et al._ (1999).

###  A.2 Equivalence Classes of Quantum Channels

Let us consider two channels $\mathscr{E}_{1}$ and $\mathscr{E}_{2}$ that are
proportional to each other, i.e. there exists a factor $p\in\>]0;1]$ such that
$\mathscr{E}_{1}=p\cdot\mathscr{E}_{2}$ (or
$\mathscr{E}_{2}=p\cdot\mathscr{E}_{1}$ which is a symmetric case). Then their
corresponding transmissivities also display the same proportionality
$t(\mathscr{E}_{1}|\rho)=p\cdot t(\mathscr{E}_{2}|\rho)$ for any input state
$\rho$. The two channels therefore output the same states when fed the same
input state:

$\frac{\mathscr{E}_{1}[\rho]}{t(\mathscr{E}_{1}|\rho)}=\frac{p\cdot\mathscr{E}_{2}[\rho]}{p\cdot
t(\mathscr{E}_{2}|\rho)}=\frac{\mathscr{E}_{2}[\rho]}{t(\mathscr{E}_{2}|\rho)}$
(35)

In numerous practical situations, such as those described in this study, we
only consider what happens when the states are not lost, such that we post-
select on the states being detected. This way, two channels $\mathscr{E}_{1}$
and $\mathscr{E}_{2}$ that are proportional to each other actually describe
the same physical situation, and we consider them as equivalent
$\mathscr{E}_{1}\equiv\mathscr{E}_{2}$. This defines mathematical equivalence
classes of channels that outputs the same quantum states. All channels from a
same class can be compared, such that if
$\mathscr{E}_{1}\equiv\mathscr{E}_{2}$, then either
$\mathscr{E}_{1}\geq\mathscr{E}_{2}$ or $\mathscr{E}_{2}\geq\mathscr{E}_{1}$.
In the first case, for instance, we have $t(\mathscr{E}_{1}|\rho)\geq
t(\mathscr{E}_{2}|\rho)$. For any class of channel, we can find a maximal
channel of that class $\mathscr{E}_{max}$ such that
$\mathscr{E}_{max}\geq\mathscr{E}$ for any channel $\mathscr{E}$ of the same
class. That maximal channel is therefore the most transmissive channel, and
there always exists a state $\rho$ that passes the channel with absolute
certainty, i.e. $t(\mathscr{E}_{max}|\rho)=1$.

These equivalence classes are of particular interest in our study, as the
distances we use do not rigorously define metrics for arbitrary quantum
channels, but they do for these classes of quantum channels. They also embody
the fact that when certifying a channel $\mathscr{E}$, one can always consider
a more transmissive but equivalent channel $\mathscr{E}^{\prime}$, with
$\mathscr{E}^{\prime}\geq\mathscr{E}$ and
$\mathscr{E}^{\prime}\equiv\mathscr{E}$. We can then use this more
transmissive channel in order to describe the physical process, which falls
down to assuming a certain amount of losses are trusted, as described in Fig.
4 of the main text.

###  A.3 Metrics of Quantum Channels

We first define the diamond and Choi-Jamiołkowski trace and sine distances
between two channels $\mathscr{E}_{1}$ and $\mathscr{E}_{2}$ acting on a space
$\mathscr{L}(\mathscr{H}_{i})$:

$\displaystyle\mathscr{M}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})$
$\displaystyle=\sup_{{\lvert\phi\rangle}}M\bigl{(}(\mathscr{E}_{1}\otimes\mathds{I})[\phi]/t(\mathscr{E}_{1}|\rho),(\mathscr{E}_{2}\otimes\mathds{I})[\phi]/t(\mathscr{E}_{2}|\rho)\bigr{)}$
(36) $\displaystyle\mathscr{M}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$
$\displaystyle=M\bigl{(}(\mathscr{E}_{1}\otimes\mathds{I})[\Phi_{+}]/t(\mathscr{E}_{1}|\Phi_{+}),(\mathscr{E}_{2}\otimes\mathds{I})[\Phi_{+}]/t(\mathscr{E}_{2}|\Phi_{+})\bigr{)}$
(37)

where $M=D$ or $C$ are the trace and sine distances, $\Phi_{+}$ is a
maximally-entangled state, and the upper bound is taken over pure states
${\lvert\phi\rangle}\in\mathscr{H}_{i}^{\otimes 2}$ such that
$t(\mathscr{E}_{1}|\phi)\neq 0$ and $t(\mathscr{E}_{2}|\phi)\neq 0$ . These
quantities are proper distances only when restricted to deterministic quantum
channels, i.e. CPTP maps, in which case
$M_{J}(\mathscr{E}_{1},\mathscr{E}_{2})=0$ when
$M_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})=0$, or when
$\mathscr{E}_{1}=\mathscr{E}_{2}$. Concerning probabilistic channels, we show
that
$M_{J}(\mathscr{E}_{1},\mathscr{E}_{2})=M_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})=0$
if and only if $\mathscr{E}_{1}\equiv\mathscr{E}_{2}$ and the channels are
equivalent, in the sense we defined in section A.2, meaning they are
proportional to each other.

Proof. If $\mathscr{E}_{1}\equiv\mathscr{E}_{2}$, then there exists
$p\in\>]0;1]$ such that $\mathscr{E}_{1}=p\cdot\mathscr{E}_{2}$ or
$\mathscr{E}_{2}=p\cdot\mathscr{E}_{1}$. Then by definition of
$\mathscr{M}_{\diamond}$ and $\mathscr{M}_{J}$, we trivially have
$\mathscr{M}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})=\mathscr{M}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})=0$.
Now let us assume $\mathscr{E}_{1}$ and $\mathscr{E}_{2}$ are non-zero
channels such that $\mathscr{M}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})=0$, and
let us show that $\mathscr{E}_{1}\equiv\mathscr{E}_{2}$. First, we formulate
the following lemma, implicitly introduced earlier in Sekatski  _et al._
(2018):

######  Lemma 3.

Let ${\lvert\psi\rangle}\in\mathscr{H}^{\otimes 2}$ be a pure 2-qudits state,
with $\dim\mathscr{H}=d$. Then there exists an operator
$K_{\psi}=M_{\psi}U_{\psi}$ on $\mathscr{H}$, with $0<M_{\psi}\leq\mathds{I}$
and $U_{\psi}$ a unitary, such $\mathds{I}\otimes K_{\psi}$ transforms the
maximally-entangled state
${\lvert\Phi_{+}\rangle}=\tfrac{1}{\sqrt{d}}\sum_{i=0}^{d-1}{\lvert
i\rangle}{\lvert i\rangle}$ into ${\lvert\psi\rangle}$ with probability $1/d$,
i.e.:

$(\mathds{I}\otimes
K_{\psi}){\lvert\Phi_{+}\rangle}=\dfrac{1}{\sqrt{d}}{\lvert\psi\rangle}$ (38)

We remind the proof of this lemma, which was detailed in Sekatski  _et al._
(2018). We use the Schmidt decomposition of ${\lvert\psi\rangle}$:

${\lvert\psi\rangle}=\sum_{i=0}^{d-1}\psi_{i}{\lvert i\rangle}{\lvert
i^{\prime}\rangle}$ (39)

where $\\{{\lvert i\rangle}\\}$ and $\\{{\lvert i^{\prime}\rangle}\\}$ are two
orthonormal bases of $\mathscr{H}$. There exists a unitary operator $U_{\psi}$
acting on $\mathscr{H}$ such that:

$(\mathds{I}\otimes
U_{\psi}){\lvert\Phi_{+}\rangle}=\dfrac{1}{\sqrt{d}}\sum_{i=0}^{d-1}{\lvert
i\rangle}{\lvert i^{\prime}\rangle}$ (40)

with $d=\dim\mathscr{H}$. We can then define the operator $M_{\psi}$ that
probabilistically transforms $(\mathds{I}\otimes
U_{\psi}){\lvert\Phi_{+}\rangle}$ into ${\lvert\psi\rangle}$:

$M_{\psi}=\sum_{i=0}^{d-1}\psi_{i}{\lvert i^{\prime}\rangle\\!\langle
i^{\prime}\rvert}$ (41)

Now by we defining the operator $K_{\psi}=M_{\psi}U_{\psi}$, we have:

$(\mathds{I}\otimes
K_{\psi}){\lvert\Phi_{+}\rangle}=\tfrac{1}{\sqrt{d}}{\lvert\psi\rangle}$ (42)

which completes the proof of the lemma.

From here, as we have $\mathscr{M}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})=0$,
then
$M\bigl{(}(\mathscr{E}_{1}\otimes\mathds{I})[\Phi_{+}]/t(\mathscr{E}_{1}|\Phi_{+}),(\mathscr{E}_{2}\otimes\mathds{I})[\Phi_{+}]/t(\mathscr{E}_{2}|\Phi_{+})\bigr{)}=0$
which implies:

$(\mathscr{E}_{1}\otimes\mathds{I})[\Phi_{+}]=\tfrac{t(\mathscr{E}_{1}|\Phi_{+})}{t(\mathscr{E}_{2}|\Phi_{+})}\cdot(\mathscr{E}_{2}\otimes\mathds{I})[\Phi_{+}]$
(43)

For any pure state ${\lvert\psi\rangle}\in\mathscr{H}^{\otimes 2}$ we define
the operator $K_{\psi}$ from Lemma 3, such that $(\mathds{I}\otimes
K_{\psi}){\lvert\Phi_{+}\rangle}=\tfrac{1}{\sqrt{d}}{\lvert\psi\rangle}$. We
can apply that operator on both sides of equation (43):

$(\mathds{I}\otimes
K_{\psi})(\mathscr{E}_{1}\otimes\mathds{I})[\Phi_{+}](\mathds{I}\otimes
K^{\dagger}_{\psi})=\tfrac{t(\mathscr{E}_{1}|\Phi_{+})}{t(\mathscr{E}_{2}|\Phi_{+})}\cdot(\mathds{I}\otimes
K_{\psi})(\mathscr{E}_{2}\otimes\mathds{I})[\Phi_{+}](\mathds{I}\otimes
K^{\dagger}_{\psi})$ (44)

which, since $\mathds{I}\otimes K_{\psi}$ commutes with
$\mathscr{E}_{1}\otimes\mathds{I}$ and $\mathscr{E}_{2}\otimes\mathds{I}$,
implies:

$(\mathscr{E}_{1}\otimes\mathds{I})\biggl{[}(\mathds{I}\otimes
K_{\psi})\Phi_{+}(\mathds{I}\otimes
K^{\dagger}_{\psi})\biggr{]}=\tfrac{t(\mathscr{E}_{1}|\Phi_{+})}{t(\mathscr{E}_{2}|\Phi_{+})}\cdot(\mathscr{E}_{2}\otimes\mathds{I})\biggl{[}(\mathds{I}\otimes
K_{\psi})\Phi_{+}(\mathds{I}\otimes K^{\dagger}_{\psi})\biggr{]}$ (45)

or equivalently:

$(\mathscr{E}_{1}\otimes\mathds{I})[\psi]=\dfrac{t(\mathscr{E}_{1}|\Phi_{+})}{t(\mathscr{E}_{2}|\Phi_{+})}\cdot(\mathscr{E}_{2}\otimes\mathds{I})[\psi]$
(46)

This way, by taking either
$p=\dfrac{t(\mathscr{E}_{1}|\Phi_{+})}{t(\mathscr{E}_{2}|\Phi_{+})}$ or
$p=\dfrac{t(\mathscr{E}_{2}|\Phi_{+})}{t(\mathscr{E}_{1}|\Phi_{+})}$ we have
$(\mathscr{E}_{1}\otimes\mathds{I})[\psi]=p\cdot(\mathscr{E}_{2}\otimes\mathds{I})[\psi]$
or
$(\mathscr{E}_{2}\otimes\mathds{I})[\psi]=p\cdot(\mathscr{E}_{1}\otimes\mathds{I})[\psi]$
for all state ${\lvert\psi\rangle}\in\mathscr{H}^{\otimes 2}$, with
$p\in\>]0;1]$. This gives either $\mathscr{E}_{1}=p\cdot\mathscr{E}_{2}$ or
$\mathscr{E}_{2}=p\cdot\mathscr{E}_{1}$, and therefore
$\mathscr{E}_{1}\equiv\mathscr{E}_{2}$ $\blacksquare$.

As
$\mathscr{M}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})\geq\mathscr{M}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$,
we get the same result when
$\mathscr{M}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})=0$.

The triangular inequality and symmetry of $\mathscr{M}_{J}$ and
$\mathscr{M}_{\diamond}$ come trivially from the distance properties of $C$
and $D$. Therefore, $\mathscr{M}_{J}$ and $\mathscr{M}_{\diamond}$ define
proper distances on classes of non-zero probabilistic channels, that we
defined in the last paragraph.

##  Appendix B Fundamental Properties of Probabilistic Quantum Channels

In this section, we show some fundamental results regarding the behaviour of
probabilistic quantum channels. The most commonly used distance measure for
quantum states is the trace distance
$D(\rho,\sigma)=\tfrac{1}{2}\textrm{Tr}|\rho-\sigma|^{2}$. The Ulhmann’s
Fidelity
$F(\rho,\sigma)=\bigl{(}\textrm{Tr}\sqrt{\sqrt{\rho}\sigma\sqrt{\rho}}\bigr{)}^{2}$
is not a metric in itself, but is often more relevant in our context as it can
be interpreted as the probability that one state is projected on the other,
when the states are purified. Moreover, most self-testing results relate the
violation of Bell inequalities to the fidelity between physical and reference
states. Finally, we can simply define convenient distances from the fidelity,
such as the sine distance $C(\rho,\sigma)=\sqrt{1-F(\rho,\sigma)}$ Gilchrist
_et al._ (2005); Rastegin (2006), or the Bures angle
$A(\rho,\sigma)=\arccos\sqrt{F(\rho,\sigma)}$ Nielsen and Chuang (2011). We
show results for these different functions.

###  B.1 Metrics Monotonicity Under Quantum Channels

Here we give the proof of Lemma 1 from the main text that gives a
generalization of the processing inequality, or so-called metric monotonicity,
to probabilistic quantum channels and the sine distance:

######  Lemma 1 (Extended Processing Inequality).

For any probabilistic channel $\mathscr{E}$ (CPTD), and any input states
$\rho_{i}$ and $\sigma_{i}$, the following inequality holds for the sine
distance $C(\rho,\sigma)=\sqrt{1-F(\rho,\sigma)}$:

$C(\rho_{i},\sigma_{i})\geq t\cdot C(\rho_{o},\sigma_{o}),$ (47)

where $\rho_{o}=\mathscr{E}[\rho_{i}]/t(\mathscr{E}|\rho_{i})$ and
$\sigma_{o}=\mathscr{E}[\sigma_{i}]/t(\mathscr{E}|\sigma_{i})$ are the output
states of the channel, and $t=t(\mathscr{E}|\rho_{i})$ or
$t=t(\mathscr{E}|\sigma_{i})$.

Note that this inequality is also true for the trace distance. We first show
that result for the latter, and then extend it to the sine distance.

Proof. Let us first prove the inequality for the trace distance $D$. We follow
the guidelines of the proof given in Nielsen and Chuang (2011) for CPTP maps.
As $\rho_{i}$ and $\sigma_{i}$ have a symmetric role, let us consider
$t(\mathscr{E}|\rho_{i})\geq t(\mathscr{E}|\sigma_{i})$, without loss of
generality. We can define two Hermitian positive matrices $P$ and $Q$ with
orthogonal support such that $\rho_{i}-\sigma_{i}=P-Q$. Therefore, we have
$\textrm{Tr}(P)-\textrm{Tr}(Q)=\textrm{Tr}(\rho_{i})-\textrm{Tr}(\sigma_{i})=0$
so $\textrm{Tr}(P)=\textrm{Tr}(Q)$. Moreover, $|\rho_{i}-\sigma_{i}|=P+Q$.
This way,

$\displaystyle D(\rho_{i},\sigma_{i})$
$\displaystyle=\dfrac{1}{2}\textrm{Tr}|\rho_{i}-\sigma_{i}|$ (48)
$\displaystyle=\dfrac{1}{2}\bigl{(}\textrm{Tr}(P)+\textrm{Tr}(Q)\bigr{)}=\textrm{Tr}(P)$

There also exists a projector $\Pi$ such that
$D(\rho_{o},\sigma_{o})=\textrm{Tr}\bigr{(}\Pi\cdot(\rho_{o}-\sigma_{o})\bigl{)}$.
Keeping in mind that $\mathscr{E}$ is trace-decreasing, it follows that for
any $t\leq t(\mathscr{E}|\rho_{i})$:

$\displaystyle D(\rho_{i},\sigma_{i})$ $\displaystyle=\textrm{Tr}(P)$
$\displaystyle\geq\textrm{Tr}(\mathscr{E}[P])$
$\displaystyle\geq\textrm{Tr}(\Pi\cdot\mathscr{E}[P])$
$\displaystyle\geq\textrm{Tr}\bigl{(}\Pi\cdot(\mathscr{E}[P]-\mathscr{E}[Q])\bigr{)}$
$\displaystyle=\textrm{Tr}\bigl{(}\Pi\cdot(\mathscr{E}[\rho_{i}]-\mathscr{E}[\sigma_{i}])\bigr{)}$
$\displaystyle=t(\mathscr{E}|\rho_{i})\textrm{Tr}(\Pi\rho_{o})-t(\mathscr{E}|\sigma_{i})\textrm{Tr}(\Pi\sigma_{o})$
$\displaystyle\geq
t(\mathscr{E}|\rho_{i})\textrm{Tr}\bigl{(}\Pi\cdot(\rho_{o}-\sigma_{o})\bigr{)}$
$\displaystyle=t(\mathscr{E}|\rho_{i})\cdot D(\rho_{o},\sigma_{o})$
$\displaystyle\geq t\cdot D(\rho_{o},\sigma_{o})$ (49)

This way, we have in particular $D(\rho_{i},\sigma_{i})\geq t\cdot
D(\rho_{o},\sigma_{o})$ for $t=t(\mathscr{E}|\rho_{i})$ or
$t=t(\mathscr{E}|\sigma_{i})$ $\blacksquare$.

In order to prove the same inequality for the sine distance $C$, let us recall
that we can express that distance between any density operators $\rho,\sigma$,
as a minimization over their purifications ${\lvert r\rangle}$ and ${\lvert
s\rangle}$ respectively: $C(\rho,\sigma)=\min\sqrt{1-{\langle r\rvert
s\rangle}}=\min D({\lvert r\rangle\\!\langle r\rvert},{\lvert
s\rangle\\!\langle s\rvert})$, where the minimization is taken over all the
purifications. This way, we are going to purify the input and output states in
order to extend the inequality from $D$ to $C$. Let us choose two pure states
${\lvert r_{i}\rangle},{\lvert
s_{i}\rangle}\in\mathscr{H}_{i}\otimes\mathscr{P}$ such that
$C(\rho_{i},\sigma_{i})=D({\lvert r_{i}\rangle\\!\langle r_{i}\rvert},{\lvert
s_{i}\rangle\\!\langle s_{i}\rvert})$, with $\mathscr{P}$ a purification space
for $\rho_{i}$ and $\sigma_{i}$. This purifies the input states. Now let us
define the operator $E$ on $\mathscr{H}_{i}\otimes\mathscr{P}$ such that for
any pure state ${\lvert\psi\rangle}$ in that space:

$E{\lvert\psi\rangle}=\sum_{j}(K_{j}\otimes\mathds{I}_{\mathscr{P}}{\lvert\psi\rangle})\otimes{\lvert
e_{j}\rangle}$ (50)

where $\\{K_{j}\\}$ are Kraus operators for $\mathscr{E}$ and $\\{{\lvert
e_{j}\rangle}\\}$ is an orthonormal basis of an ancillary space $\mathscr{A}$.
As $\mathscr{E}$ is trace-decreasing, $E{\lvert\psi\rangle}$ is not
necessarily normalized, but is a pure state when renormalized. This way, we
can define the quantum operation $\tilde{\mathscr{E}}$ such that for any
density operator
$\rho\in\mathscr{L}(\mathscr{H}_{i})\otimes\mathscr{L}(\mathscr{P})$, we have
$\tilde{\mathscr{E}}[\rho]=E\rho E^{\dagger}$. This operation conserves the
purity of pure states, and verifies
$\textrm{Tr}_{\mathscr{A}}(\tilde{\mathscr{E}}[\rho])=\mathscr{E}[\rho]$ for
any density operator $\rho$. This way, $\tilde{\mathscr{E}}[{\lvert
r\rangle\\!\langle r\rvert}]/t(\mathscr{E}|\rho_{i})$, resp.
$\tilde{\mathscr{E}}[{\lvert s\rangle\\!\langle
s\rvert}]/t(\mathscr{E}|\sigma_{i})$, is a purification of
$\mathscr{E}[\rho_{i}]/t(\mathscr{E}|\rho_{i})=\rho_{o}$, resp.
$\mathscr{E}[\sigma_{i}]/t(\mathscr{E}|\sigma_{i})=\sigma_{o}$. This purifies
the output states. Now we only have to apply the extended contractivity of $D$
to the purified states under the quantum operation $\tilde{\mathscr{E}}$, for
$t=t(\mathscr{E}|\rho_{i})$ or $t=t(\mathscr{E}|\sigma_{i})$:

$\displaystyle C(\rho_{i},\sigma_{i})$ $\displaystyle=D({\lvert
r_{i}\rangle\\!\langle r_{i}\rvert},{\lvert s_{i}\rangle\\!\langle
s_{i}\rvert})$ $\displaystyle\geq t\cdot D(\tilde{\mathscr{E}}[{\lvert
r\rangle\\!\langle
r\rvert}]/t(\mathscr{E}|\rho_{i}),\tilde{\mathscr{E}}[{\lvert
s\rangle\\!\langle s\rvert}]/t(\mathscr{E}|\sigma_{i}))$ $\displaystyle\geq
t\cdot\min D({\lvert r_{o}\rangle\\!\langle r_{o}\rvert},{\lvert
s_{o}\rangle\\!\langle s_{o}\rvert})$ (51) $\displaystyle=t\cdot
C(\hat{\rho}_{o},\hat{\sigma}_{o})$

where the minimization is taken over all purifications ${\lvert
r_{o}\rangle}$, resp. ${\lvert s_{o}\rangle}$, of $\rho_{o}$, resp.
$\sigma_{o}$. This shows the inequality for the sine distance $\blacksquare$.

Note that for a trace-preserving quantum operation, $t(\mathscr{E}|\rho)=1$
for any state $\rho$, and we get the well known processing inequality
$D(\rho,\sigma)\geq D(\mathscr{E}[\rho],\mathscr{E}[\sigma])$ or
$F(\rho,\sigma)\leq F(\mathscr{E}[\rho],\mathscr{E}[\sigma])$, indicating this
inequality is tight.

###  B.2 Comparison between Quantum Channels Metrics

Choi-Jamiołkowski and diamond metrics underline different properties of
quantum channels. As pointed out in Gilchrist  _et al._ (2005), the Choi-
Jamiołkowki metrics are linked to average probability of distinguishing two
quantum channels when sending unknown states, while the diamond metrics are
linked to the maximum probability of distinguishing these channels. The same
can be said about our generalized definitions for probabilistic quantum
channels, as long as we condition these probabilities to the detection of a
state. For our protocol’s security, the worst case scenario is more relevant,
which is why diamond distances are preferred. Still, bounding the diamond
distance between two channels with the sole knowledge of their actions on a
maximally-entangled state is of major importance for our study, which is why
we wish to bound diamond distances with their Choi-Jamiołkowski counterparts.
An attempt to show such bounds was done in Sekatski  _et al._ (2018), linking
the diamond trace distance with the Choi-Jamiołkowski sine distance. However,
it does not give a direct bound on the diamond fidelity, which is more
suitable in cryptography in order to evaluate a protocol’s success
probability. In Lemma 2, presented in the Methods, we demonstrate a tight
bound of the diamond sine distance using their Choi-Jamiołkowski sine
distance, without extra information about the channel:

######  Lemma 2 (Channel’s Metrics Equivalence).

For any probabilistic channel $\mathscr{E}_{1}$, and any $\mathscr{E}_{2}$
that is proportional to a deterministic channel (CPTP map), both acting on
$\mathscr{L}(\mathscr{H}_{i})$, we have the following inequalities:

$\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})\leq\mathscr{C}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})\leq\dim\mathscr{H}_{i}\times\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2}){\color[rgb]{0,1,1}\definecolor[named]{pgfstrokecolor}{rgb}{0,1,1}\pgfsys@color@cmyk@stroke{1}{0}{0}{0}\pgfsys@color@cmyk@fill{1}{0}{0}{0},}$
(52)

where the $\mathscr{C}_{J}$, resp. $\mathscr{C}_{\diamond}$, are the Choi-
Jamiołkowski, resp. diamond, sine distances of probabilistic quantum channels:

$\displaystyle\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})=C\Bigl{(}\dfrac{(\mathscr{E}_{1}\otimes\mathds{I})[\Phi_{+}]}{t(\mathscr{E}_{1}|\Phi_{+})},(\mathscr{E}_{2}\otimes\mathds{I})[\Phi_{+}]\Bigr{)}$
(53)
$\displaystyle\mathscr{C}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})=\sup_{{\lvert\phi\rangle}}C\Bigl{(}\dfrac{(\mathscr{E}_{1}\otimes\mathds{I})[\phi]}{t(\mathscr{E}_{1}|\phi)},(\mathscr{E}_{2}\otimes\mathds{I})[\phi]\Bigr{)}$
(54)

Note that once again, the result is also true for trace distances of quantum
channels. We provide the proof of this lemma for both trace and sine
distances.

Proof. We want to show the two following inequalities, for any probabilistic
channel $\mathscr{E}_{1}$ and any deterministic channel $\mathscr{E}_{2}$:

$\displaystyle\mathscr{D}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})\leq\mathscr{D}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})\leq\dim\mathscr{H}_{i}\times\mathscr{D}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$
(55)
$\displaystyle\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})\leq\mathscr{C}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})\leq\dim\mathscr{H}_{i}\times\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$
(56)

The left-side inequalities are straightforwardly following from the definition
of the distances. The right-side comes from the following corollary:

######  Corollary 2.

For any pure state $\rho\in\mathscr{L}(\mathscr{H}_{i}^{\otimes 2})$ and any
pair of probabilistic quantum channels $\mathscr{E}_{1}$ and $\mathscr{E}_{2}$
from $\mathscr{L}(\mathscr{H}_{i})$ to $\mathscr{L}(\mathscr{H}_{o})$, we
have:

$\displaystyle x\cdot
D(\rho_{1},\rho_{2})\leq\dim\mathscr{H}_{i}\times\mathscr{D}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$
(57) $\displaystyle x\cdot
C(\rho_{1},\rho_{2})\leq\dim\mathscr{H}_{i}\times\mathscr{C}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$
(58)

for any
$x\leq\max\bigl{[}\tfrac{t(\mathscr{E}_{1}|\rho)}{t(\mathscr{E}_{1}|\Phi_{+})},\tfrac{t(\mathscr{E}_{2}|\rho)}{t(\mathscr{E}_{2}|\Phi_{+})}\bigr{]}$,
and with
$\rho_{k}=(\mathscr{E}_{k}\otimes\mathds{I})[\rho]/t(\mathscr{E}_{k}|\rho)$.

Let us consider a pure state $\rho={\lvert\psi\rangle\\!\langle\psi\rvert}$
with ${\lvert\psi\rangle}\in\mathscr{H}_{i}\otimes\mathscr{H}_{i}$, and two
probabilistic channels $\mathscr{E}_{1}$ and $\mathscr{E}_{2}$. We define the
corresponding transmissivities $t(\mathscr{E}_{k}|\rho)$ and output states
$\rho_{k}=(\mathscr{E}_{k}\otimes\mathds{I})[\rho]/t(\mathscr{E}_{k}|\rho)$
for $k=1$ and $2$. Using the operator $K_{\psi}$ defined in Lemma 3, the map
$\mathscr{O}$ defined as $\mathscr{O}[\rho]=K_{\psi}\rho K^{\dagger}_{\psi}$
is a valid quantum operation on $\mathscr{L}(\mathscr{H}_{i})$. Furthermore,
$\mathds{I}\otimes\mathscr{O}$ transforms ${\lvert\Phi_{+}\rangle}$ into
${\lvert\psi\rangle}$ with probability $1/\dim\mathscr{H}_{i}$, and commutes
with the channels $\mathscr{E}_{1}\otimes\mathds{I}$ and
$\mathscr{E}_{2}\otimes\mathds{I}$, such that for $k=1$ or $2$ and
$d=\dim\mathscr{H}_{i}$:

$\displaystyle(\mathds{I}\otimes\mathscr{O})[(\mathscr{E}_{k}\otimes\mathds{I})[\Phi_{+}]\>/t(\mathscr{E}_{k}|\Phi_{+})]$
$\displaystyle=\tfrac{1}{d\cdot
t(\mathscr{E}_{k}|\Phi_{+})}(\mathscr{E}_{k}\otimes\mathds{I})[\rho]$ (59)
$\displaystyle=\tfrac{t(\mathscr{E}_{k}|\rho)}{d\cdot
t(\mathscr{E}_{k}|\Phi_{+})}\rho_{k}$ (60)

This way, $\mathds{I}\otimes\mathscr{O}$ transforms the state
$(\mathscr{E}_{k}\otimes\mathds{I})[\Phi_{+}]/t(\mathscr{E}_{k}|\Phi_{+})$
into $\rho_{k}$, with probability $\tfrac{t(\mathscr{E}_{k}|\rho)}{d\cdot
t(\mathscr{E}_{k}|\Phi_{+})}$. This way, using Lemma 1 for extented metrics
monotonicity to the quantum operation $\mathscr{O}\otimes\mathds{I}$, we
deduce the following inequality:

$M((\mathscr{E}_{1}\otimes\mathds{I})[\Phi_{+}]/t(\mathscr{E}_{1}|\Phi_{+}),(\mathscr{E}_{2}\otimes\mathds{I})[\Phi_{+}]/t(\mathscr{E}_{2}|\Phi_{+}))\geq
t\cdot M(\rho_{1},\rho_{2})$ (61)

for any $t\leq\max\bigl{[}\tfrac{t(\mathscr{E}_{1}|\rho)}{d\cdot
t(\mathscr{E}_{1}|\Phi_{+})},\tfrac{t(\mathscr{E}_{2}|\rho)}{d\cdot
t(\mathscr{E}_{2}|\Phi_{+})}\bigr{]}$, and $M=C,D$. The left term is
$\mathscr{M}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$ for
$\mathscr{M}=\mathscr{C}$, and we get inequalities (57) and (58) by taking
$x=t\cdot
d\leq\max\bigl{[}\tfrac{t(\mathscr{E}_{1}|\rho)}{t(\mathscr{E}_{1}|\Phi_{+})},\tfrac{t(\mathscr{E}_{2}|\rho)}{t(\mathscr{E}_{2}|\Phi_{+})}\bigr{]}$,
which shows the corollary. If one of the channels, $\mathscr{E}_{2}$ for
instance, is proportional to a trace-preserving channel, then
$t(\mathscr{E}_{2}|\rho)=t(\mathscr{E}_{2}|\Phi_{+})$ for any $\rho$. This
way, we can take $x=1$, so that the following inequality holds for any pure
state $\rho\in\mathscr{L}(\mathscr{H}_{i}\otimes\mathscr{H}_{i})$:

$M(\rho_{1},\rho_{2})\leq
d\cdot\mathscr{M}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$ (62)

As it holds for any pure state $\rho$, we showed that
$\mathscr{M}_{\diamond}(\mathscr{E}_{1},\mathscr{E}_{2})\leq
d\times\mathscr{M}_{J}(\mathscr{E}_{1},\mathscr{E}_{2})$ for
$\mathscr{M}=\mathscr{C}$ or $\mathscr{D}$, which is the right-side of
inequalities (56) and (55) $\blacksquare$.

The corollary we just showed allows us to bound the deviation of any output
states, with the sole knowledge of the operations actions on a maximally
entangled state, even if both channels are probabilistic. Yet in a lot of
cases, ours in particular, $\mathscr{E}_{2}$ is a reference quantum channel
$\mathscr{E}_{0}$ that is trace-preserving, and we can use the special case
$\mathscr{M}_{\diamond}(\mathscr{E},\mathscr{E}_{0})\leq\dim\mathscr{H}_{i}\times\mathscr{M}_{J}(\mathscr{E},\mathscr{E}_{0})$
from the lemma, which does not require to evaluate any transmissivity.

###  B.3 Bound on Transmissivity

One can evaluate the channel’s transmissivity $t(\mathscr{E}|\rho_{i})$ when
sending the input state $\rho_{i}$, by deriving a bound from the parameters of
the problem, as shown in the following lemma.

######  Lemma 4 (Bound on the transmissivity).

Let $\mathscr{E}$ be a probabilistic quantum channel on
$\mathscr{L}(\mathscr{H}_{i})$, and let us consider two states
$\Phi_{i},\rho_{i}\in\mathscr{L}(\mathscr{H}_{i}^{\otimes 2})$ with $\Phi_{i}$
a close-to-maximally-entangled state. Then the following bound holds:

$|t(\mathscr{E}|\rho_{i})-t(\mathscr{E}|\Phi_{i})|\leq d\cdot
D(\Phi_{i},\Phi_{+})+d\cdot
t(\mathscr{E}|\Phi_{i})\cdot\min_{\mathscr{E}_{0}}D(\Phi_{o},(\mathscr{E}_{0}\otimes\mathds{I})[\Phi_{+}])$
(63)

where $d=\dim\mathscr{H}_{i}$,
$\Phi_{o}=(\mathscr{E}\otimes\mathds{I})[\Phi_{i}]/t(\mathscr{E}|\Phi_{i})$
and the minimization is carried out over all trace-preserving channels
$\mathscr{E}_{0}$.

Using the parameters of our protocols, knowing $D\leq C$, it follows:

$|t(\mathscr{E}|\rho_{i})-t(\mathscr{E}|\Phi_{i})|\leq
2\>C^{i}+2\>t(\mathscr{E}|\Phi_{i})\cdot C^{o}$ (64)

This way, Alice and Bob can predict the abort probability of the protocol from
the parameters, in particular the minimum acceptable transmissivity
$t(\mathscr{E}|\Phi_{i})$ of the channel when sending the probe state (see the
following paragraphs). If the transmissivity is too low, one can try to avoid
aborting the protocol by asking for more copies of $\rho_{i}$. Here we provide
the proof of the lemma.

Proof. Let us first assume
$\rho_{i}={\lvert\psi\rangle\\!\langle\psi\rvert}=\psi$ is a pure state, with
${\lvert\psi\rangle}\in\mathscr{H}_{i}^{\otimes 2}$. This way we can define
the operator $K_{\psi}$ from Lemma 3 such that $(\mathds{I}\otimes
K_{\psi}){\lvert\Phi_{+}\rangle}=\tfrac{1}{\sqrt{d}}{\lvert\psi\rangle}$, with
$d=\dim\mathscr{H}_{i}$. We recall that for any trace-preserving channel
$\mathscr{E}_{0}$ we have
$\textrm{Tr}((\mathscr{E}_{0}\otimes\mathds{I})[\psi])=1$. This way we have:

$\displaystyle|t(\mathscr{E}|\psi)-t(\mathscr{E}|\phi_{i})|$
$\displaystyle=\bigl{|}\textrm{Tr}((\mathscr{E}\otimes\mathds{I})[\psi])-t(\mathscr{E}|\Phi_{i})\textrm{Tr}((\mathscr{E}_{0}\otimes\mathds{I})[\psi]\bigr{|}$
$\displaystyle=d\cdot\bigl{|}\textrm{Tr}((\mathscr{E}\otimes
K_{\psi})[\Phi_{+}])-t(\mathscr{E}|\Phi_{i})\textrm{Tr}((\mathscr{E}_{0}\otimes
K_{\psi})[\Phi_{+}])\bigr{|}$ (65) $\displaystyle\leq
d\cdot\bigl{|}\textrm{Tr}((\mathscr{E}\otimes
K_{\psi})[\Phi_{+}])-\textrm{Tr}((\mathscr{E}\otimes
K_{\psi})[\Phi_{i}])\bigr{|}+d\cdot\bigl{|}\textrm{Tr}((\mathscr{E}\otimes
K_{\psi})[\Phi_{i}])-t(\mathscr{E}|\Phi_{i})\textrm{Tr}((\mathscr{E}_{0}\otimes
K_{\psi})[\Phi_{+}])\bigr{|}.$

We use the fact that
$D(\rho,\sigma)=\max_{0<P\leq\mathds{I}}\textrm{Tr}(P(\rho-\sigma))$ in order
to bound the two terms. The second one is straightforward as
$0<K_{\psi}\leq\mathds{I}$:

$d\cdot\bigl{|}\textrm{Tr}((\mathscr{E}\otimes
K_{\psi})[\Phi_{i}])-t(\mathscr{E}|\Phi_{i})\textrm{Tr}((\mathscr{E}_{0}\otimes
K_{\psi})[\Phi_{+}])\bigr{|}\leq d\cdot t(\mathscr{E}|\Phi_{i})\cdot
D(\Phi_{o},(\mathscr{E}_{0}\otimes\mathds{I})[\Phi_{+}]).$ (66)

For the first term we use Kraus’ theorem on the probabilistic channel
$\mathscr{E}\otimes K_{\psi}$ such that for any
$\rho\in\mathscr{L}(\mathscr{H}_{i}^{\otimes 2})$ we have
${(\mathscr{E}\otimes K_{\psi})[\rho]=\sum_{j}M_{j}\rho M_{j}^{\dagger}}$,
with $0<\sum M_{j}^{\dagger}M_{j}\leq\mathds{I}$. The first term therefore
gives:

$\displaystyle d\cdot\bigl{|}\textrm{Tr}((\mathscr{E}\otimes
K_{\psi})[\Phi_{+}])-\textrm{Tr}((\mathscr{E}\otimes
K_{\psi})[\Phi_{i}])\bigr{|}$
$\displaystyle=d\cdot\bigl{|}\textrm{Tr}\sum_{j}M_{j}(\Phi_{+}-\Phi_{i})M_{j}^{\dagger}\bigr{|}$
$\displaystyle=d\cdot\biggl{|}\textrm{Tr}\biggl{(}\bigl{(}\sum_{j}M_{j}^{\dagger}M_{j}\bigr{)}(\Phi_{+}-\Phi_{i})\biggr{)}\biggr{|}$
(67) $\displaystyle\leq d\cdot D(\Phi_{i},\Phi_{+}).$

This gives the bound:

$|t(\mathscr{E}|\rho_{i})-t(\mathscr{E}|\Phi_{i})|\leq d\cdot
D(\Phi_{i},\Phi_{+})+d\cdot t(\mathscr{E}|\Phi_{i})\cdot
D(\Phi_{o},(\mathscr{E}_{0}\otimes\mathds{I})[\Phi_{+}]).$ (68)

As it is true for any CPTP map $\mathscr{E}_{0}$, we can minimize the bound on
this map, which shows the lemma $\blacksquare$.

##  Appendix C Detailed Theoretical Protocols

In the following we give the details on the theoretical protocol recipes. We
start with two protocols for 1sDI and DI transmission certification where we
assume Bob can use trusted quantum memories in order to store all the states
he receives, before performing the measurements. In fact, these memories can
be replaced by the more reasonable assumption that Alice and Bob share a
common random source (this is indeed a standard trick in trading memory and
communication requirements for shared randomness, see e.g. Unnikrishnan  _et
al._ (2019)). It is the latter protocol that we implement in experiments, as
we perform the measurements on the fly. The method we use in experiment seems
more practical with current photonic technology, which does not allow the
storage of $\simeq 10^{9}$ states for a time span of the a few hours. In
addition, one can consider these quantum memories to be untrusted channels
which require certification. In that sense it also seems more secure to assume
trusted classical communications than trusted quantum memories. Here we still
provide the recipes for theoretical protocols with quantum memories, as they
follow the spirit of the protocol provided in Unnikrishnan and Markham (2020)
for authenticated teleportation. This way, when proving the security, we can
apply the bounds from this previous study in order to certify the output probe
states after our untrusted channel more directly. However the security caries
through all protocols.

###  C.1 One-Sided Device Independent Protocol

This first recipe details the protocol that we study in our paper, when
Alice’s measurement apparatus as well as the probe state source are trusted.
This specifically applies to a scenario where a powerful server Alice wants to
send a quantum message to a weaker receiver Bob through an untrusted quantum
channel.

Note that from step 1.(b) Alice deduces the minimum amount of state she has to
prepare in order to properly certify the channel. If $t$ is overstated and the
channel has a lower tranmissivity, then Alice will not prepare enough probe
states, which will make the protocol abort in step 5. On the contrary if $t$
is understated, then Alice will prepare more probe states than she and Bob
require, which will in fact improve the certification confidence.

The security of the protocol is in principle ensured by the fact that Alice
and Bob only agree on the measurement after Bob receives all the states. The
position of the quantum message $\rho_{i}$ is also broadcasted after all state
are sent through the channel. This way, the channel’s operator has no way of
guessing the position of the message by spying the communications between
Alice and Bob, that can even remain public. As mentioned earlier, in
experiment we rely on private classical communication to hide the position $r$
of state $\rho_{i}$. The full security bound is given in later section D.

Protocol 1: Certified Transmission through a Probabilistic Quantum Channel in
1sDI scenario $1.$ Prior to the protocol: (a) Alice characterizes the probe
state $\Phi_{i}$ emitted by her source and evaluates the quantity $F^{i}$. She
also receives or prepares the quantum message $\rho_{i}$, possibly shared with
an outside party. (b) Alice and Bob agree on parameters $\epsilon,K$, and the
minimum transmissivity $t$ allowed for the channel $\mathscr{E}$, depending on
their requirements and experimental limitations. $2.$ Alice prepares $N=\lceil
K/t\rceil$ copies of the probe state $\Phi_{i}$. $3.$ Alice successively sends
each state through $\mathscr{E}$, including $\rho_{i}$ in a random $r$-th
position, with $r\leq N+1$. $4.$ Bob establishes the set $\mathbb{S}_{P}$ of
states which successfully passed through $\mathscr{E}$, and broadcast it
publicly. $5.$ If $r\notin\mathbb{S}_{P}$ or $|\mathbb{S}/\\{r\\}|<K$, Alice
aborts the protocol. Otherwise, Alice sends $r$ to Bob. $6.$ Alice separates
$\mathbb{S}/\\{r\\}$ into two random sets $\mathbb{S}_{0}$ and
$\mathbb{S}_{1}$. $7.$ For each $k\in\mathbb{S}_{q}$, $q=0,1$: (a) Alice
measures observable $A_{q}$ on her part of the $k$-th state and gets outcome
$a_{k}$. (b) She tells Bob to measure observable $B_{q}$ on his part of the
$k$-th state and he gets outcome $b_{k}$. (c) Alice and Bob calculate their
correlation for round $k$ as $c_{k}=a_{k}b_{k}$. $8.$ Alice and Bob deduce the
average value over all rounds, of $\beta=|\langle A_{0}B_{0}\rangle+\langle
A_{1}B_{1}\rangle|$. $9.$ If $\beta\geq 2-\epsilon$, then Alice successfully
sent the state $\rho_{o}=\mathscr{E}[\rho_{i}]/t(\mathscr{E}|\rho_{i})$ to
Bob, with a certified average fidelity to the target quantum message
$\rho_{i}$, up to isometry.

###  C.2 Fully Device Independent Protocol

While the protocol described in the previous section has high relevance when
devices in one laboratory can be trusted, the completely adversarial scenario
would demand the fully device independent protocol. Theoretically, such
protocol can be formulated, but in the absence on any assumptions about the
functioning of the devices, which should be the case in the fully device-
independent protocol, we argue that the certification procedure would be very
resource-demanding and difficult to perform with available resources. To make
Protocol 1 fully device independent one needs to certify in a device
independent manner the fidelity of probe states $F_{i}$, which in Protocol 1
figures as a parameter.

The input fidelity $F_{i}$ can be estimated by using self-testing methods, in
a similar way like it was done in Protocol 1, with an important difference,
that self-testing would be done through the violation of the CHSH inequality.
However, without any assumptions about the source or the channel, such
protocol would require a very big number of experimental rounds. Namely, if in
Protocol $1$ one has to measure $N$ copies to verify that the channel was
correctly applied to an unknown quantum message $\rho_{i}$, in the fully DI
scenario, to verify $F_{i}$ of a single probe state passing through the
channel, one would have to measure around $N$ additional states. Hence, the
number of experimental rounds would need to be squared, which corresponds to a
very low sample-efficiency of the certification protocol.

One way to simplify the protocol is by assuming that the source is producing
independent and identically distributed copies, i.e. that the source functions
in the IID scenario. In that case, we schematically double the sample size $N$
instead of squaring it. Here we provide the recipe for that certification
protocol, making the IID assumption on the input probe state. In this
framework, our fully device independent protocol simply consists in performing
a very similar protocol to the one presented in the previous section, with one
difference in step 1.(a), related to using the CHSH inequality Clauser  _et
al._ (1969) for certification instead of the steering inequality. In that
version, Alice measures the observables $A_{3},A_{4}$ on the part of the
system she can send through the channel.

The security of this protocol can be derived from that of protocol 1, with
some slight adjustments. First we use another bound for the self-testing of
CHSH inequalities, in a fully device independent and non-IID scenario
Unnikrishnan (2019), in order to certify the output probe state. The input
probe state is also certified via self-testing of CHSH inequality in a fully
device independent scenario, but keeping the IID assumption. We can then plug
the two certified fidelities in our bound (7).

Protocol 2: Certified Transmission through a Probabilistic Quantum Channel in
DI scenario $1.$ Prior to the protocol, Alice and Bob agree on parameters
$\epsilon$, $\eta$, $K$, $M$, and the minimum transmissivity $t$ allowed for
the channel $\mathscr{E}$, depending on their requirements and experimental
limitations. $2.$ Alice prepares $N+M$ copies of the probe state $\Phi_{i}$,
where $N=\lceil K/t\rceil$. She also receives or prepares the quantum message
$\rho_{i}$, possibly shared with an outside party. $3.$ Alice measures $M$
random copies of $\Phi_{i}$, and deduce the value of $E_{i}=|\langle
A_{0}\mathscr{A}_{2}\rangle+\langle A_{0}A_{3}\rangle+\langle
A_{1}\mathscr{A}_{2}\rangle-\langle A_{1}A_{3}\rangle|$. $4.$ If
$\beta_{i}<2\sqrt{2}-\eta$, Alice aborts the protocol. $5.$ Alice successively
sends each state through $\mathscr{E}$, including $\rho_{i}$ in a random
$r$-th position, with $r\leq N+1$. $6.$ Bob establishes the set
$\mathbb{S}_{P}$ of states which successfully passed through $\mathscr{E}$,
and broadcast it publicly. $7.$ If $r\notin\mathbb{S}_{P}$ or
$|\mathbb{S}/\\{r\\}|<K$, Alice aborts the protocol. Otherwise, Alice sends
$r$ to Bob. $8.$ For each $k\in\mathbb{S}_{q}$, $q=0,1$: (a) Alice measures
observable $A_{u}$ on her part of the $k$-th statem with $u=0$ or $1$ at
random. She gets outcome $a_{k}$. (b) Bob measures observable $B_{v}$ on his
part of the $k$-th state, with $v=0$ or $1$ at random. He gets the outcome
$b_{k}$. (c) Alice and Bob calculate their correlation for round $k$ as
$c_{k}=a_{k}b_{k}$. $9.$ Alice and Bob deduce the average value over all
rounds, of $\beta_{o}=|\langle A_{0}B_{0}\rangle+\langle
A_{0}B_{1}\rangle+\langle A_{1}B_{0}\rangle-\langle A_{1}B_{1}\rangle|$. $10.$
If $\beta\geq 2\sqrt{2}-\epsilon$, then Alice successfully sent the state
$\rho_{o}=\mathscr{E}[\rho_{i}]/t(\mathscr{E}|\rho_{i})$ to Bob, with a
certified average fidelity to the target quantum message $\rho_{i}$, up to
isometry.

###  C.3 Practical Protocol

We mentioned that the protocol we implement in our experiment differ slightly
from the theoretical protocols detailed in previous paragraphs, as the latter
rely on Bob being able to store all states he receives from the channel,
before agreeing with Alice to measure them. This imposes a strong assumption
on Bob’s power, which is both impractical for experiments, and unrealistic in
our one-sided device independent scenario that assumes the receiver possesses
as few trusted resources as possible. Thus, although this protocol follows the
recipe from Unnikrishnan and Markham (2020) which allows for the derivation of
the security, we implement a more practical protocol in our experiment. That
protocol assumes a private and trusted classical communication channel, but
does not rely on trusted quantum memories. Here we detail a theoretical
version of that protocol, in a one-sided device independent setting, which
fits more to our implementation. We assume the security to be the equivalent
to that of protocol 1. In addition, as players perform the measurements on the
fly, more assumptions are required in order to distinguish potentially biased
losses from the channel from detection losses. These are detailed in appendix
E.3, and mainly consist in considering detection losses are independent of the
measurement basis, which is a form of fair-sampling assumption.

Protocol 3: Practical Certified Transmission through a Probabilistic Quantum
Channel in 1sDI scenario $1.$ Prior to the protocol: (a) Alice characterizes
the state probe state $\Phi_{i}$ emitted by her source and evaluates the
quantity $F^{i}$. She also receives or prepares the quantum message
$\rho_{i}$, possibly shared with an outside party. (b) Alice and Bob agree on
parameters $\epsilon,K$, and the minimum transmissivity $t$ allowed for the
channel $\mathscr{E}$, depending on their requirements and experimental
limitations. They also share a private random key $r\in[\\![1,N+1]\\!]$, with
$N=\lceil K/t\rceil$. For $k\in[\\![1,N+1]\\!]$: $2.$ If $k\neq r$: (a) Alice
prepares a copy of the probe state $\Phi_{i}$ and sends half of it through
$\mathscr{E}$. (b) Alice and Bob privately agree on a random $q\in\\{0,1\\}$
and measure the observable $A_{q}B_{q}$, with an outcome $c_{k}=a_{k}b_{k}$ if
Bob received a state, or no outcome if the state was lost through the channel.
$3.$ If $k=r$: (a) Alice sends the quantum message $\rho_{i}$ through
$\mathscr{E}$. (b) If Bob does not receive any state, the protocol aborts.
Otherwise, Bob sets the state aside. $4.$ If the number of "no-outcome" events
during step 2.(b) is bigger than $N-K$, then the protocol aborts. $5.$ From
the correlations $\\{c_{k}\\}$, Alice and Bob deduce the average value over
all rounds, of $\beta=|\langle A_{0}B_{0}\rangle+\langle A_{1}B_{1}\rangle|$.
$6.$ If $\beta\geq 2-\epsilon$, then Alice successfully sent the state
$\rho_{o}=\mathscr{E}[\rho_{i}]/t(\mathscr{E}|\rho_{i})$ to Bob, with a
certified average fidelity to the quantum message $\rho_{i}$, up to isometry.

##  Appendix D Protocol Security

When the protocol does not abort, Alice and Bob wish to bound the probability
that it successfully implements the channel
$\mathscr{E}_{0}\otimes\mathds{I}_{i}$ on the input state $\rho_{i}$. With no
IID assumption made on the quantum channel, it is a priori impossible to
predict the transformation undergone by $\rho_{i}$, from the sole measurements
performed on other quantum states. However, statistical arguments on a large
sample of quantum channels allow us to bound the transmission probability with
high confidence, on the condition that the position of the input state
$\rho_{i}$ remains confidential. In the following, we show that bound, using
only the measurements performed during the protocol when sending the probe
states $\Phi_{i}$ through the channel.

First, we define the average quantum channel and quantum states, and show it
describes accurately the result of the protocol. We also deduce relevant
quantities, in term of quantum states and quantum channels fidelities.

Then, we show the certification bound 7, by going through similar guidelines
as the certification bound shown in Sekatski  _et al._ (2018) for CPTP maps,
and using our new fundamental results on probabilistic channels.

Next we show how we can apply the recent results from Unnikrishnan and Markham
(2020) to our protocol, in order to certify a virtual and unmeasured probe
state, thanks to violation of steering inequality in a one-sided device-
independent and non-IID setting, measured on all other probe states.

Then, we show the expressions of error terms on the fidelity of the probe
output state, and on the channel’s transmissivity, due to finite number of
samples in a non-IID setting.

Finally we tie all these results together in order to give the full bound on
the transmission fidelity $F(\rho_{o},\rho_{i})$. We also give the
modification required to that bound in order to certify the transmission
fidelity in protocol 2.

###  D.1 Average Channel and States

During the protocol, Alice sends $N+1$ states through the channel, including
$N$ states, and one copy of $\rho_{i}$. On the $k$-th state, the channel takes
the expression $\mathscr{E}_{k|[k-1]}$. If $\rho_{i}$ is sent through $r$-th
channel, then a state $\rho_{r}$ outputs the channel with probability
$t(\mathscr{E}_{r|[r-1]}|\rho_{i})$. Alice sends the state $\rho_{i}$ at a
random position $r$, meaning it has equal probability to be sent through any
of the channels $\\{\mathscr{E}_{k|[k-1]}\\}_{k=1,...,N+1}$. This way,
assuming the channel’s operator has no way of guessing the position $r$ where
$\rho_{i}$ is sent, then the expected output state is:

$\bar{\rho}_{o}=\dfrac{\sum_{r=1}^{N+1}t(\mathscr{E}_{r|[r-1]}|\rho_{i})\cdot\rho_{r}}{\sum_{r=1}^{N+1}t(\mathscr{E}_{r|[r-1]}|\rho_{i})}=\dfrac{\sum_{r=1}^{N+1}(\mathscr{E}_{r|[r-1]}\otimes\mathds{I})[\rho_{i}]}{\textrm{Tr}\bigl{(}\sum_{r=1}^{N+1}(\mathscr{E}_{r|[r-1]}\otimes\mathds{I})[\rho_{i}]\bigr{)}}=\dfrac{\bigl{(}\tfrac{1}{N+1}(\sum_{r=1}^{N+1}\mathscr{E}_{r|[r-1]})\otimes\mathds{I}\bigr{)}[\rho_{i}]}{\textrm{Tr}\Bigl{(}\bigl{(}\tfrac{1}{N+1}(\sum_{r=1}^{N+1}\mathscr{E}_{r|[r-1]})\otimes\mathds{I}\bigr{)}[\rho_{i}]\Bigr{)}}$
(69)

where we omitted the isometries for more simplicity, i.e.
$\mathscr{E}_{r|[r-1]}$ actually stands for
$\textrm{Tr}_{ext}\bigl{(}(\Gamma_{o}\circ\mathscr{E}_{r|[r-1]}\circ\Gamma_{i})[\rho_{\mathscr{A}_{1}}\otimes\bullet\>]\bigr{)}$.
From here we naturally define the average channel over the protocol:

$\bar{\mathscr{E}}=\dfrac{1}{N+1}\sum_{k=1}^{N+1}\mathscr{E}_{k|[k-1]}$ (70)

which is a physical channel that randomly applies any of the channels
$\\{\mathscr{E}_{k|[k-1]}\\}_{k=1,...,N+1}$. This way the expected output
state of the protocol reads:

$\bar{\rho}_{o}=(\bar{\mathscr{E}}_{i,o}\otimes\mathds{I})[{\rho}_{i}]/t(\bar{\mathscr{E}}_{i,o}|\rho_{i})$
(71)

where
$\bar{\mathscr{E}}_{i,o}=\textrm{Tr}_{ext}\bigl{(}(\Gamma_{o}\circ\bar{\mathscr{E}}\circ\Gamma_{i})[\rho_{\mathscr{A}_{1}}\otimes\bullet\>]\bigr{)}$.
Similarly the expected ouput state when sending the probe state $\Phi_{i}$
reads:

$\bar{\Phi}_{o}=(\bar{\mathscr{E}}\otimes\mathds{I})[{\Phi}_{i}]/t(\bar{\mathscr{E}}|\Phi_{i})$
(72)

such that states are expected to undergo the operation $\bar{\mathscr{E}}$.
Following previous studies lifting the IID assumption Unnikrishnan and Markham
(2019); Gočanin  _et al._ (2022), we aim at certifying the average output
state $\bar{\rho}_{o}$. To support this choice, we can predict the result of a
measurement performed after the protocol, following the idea of Gočanin  _et
al._ (2022). If the state $\rho_{i}$ was sent through the $r$-th channel, then
we can express the probability that it was not lost in the channel
($\checkmark$) and we measure the $k$-th outcome of any POVM
$\\{E_{k}\\}_{k}$:

$\Pr\bigl{(}(\checkmark\cap
k)|r\bigr{)}=t(\mathscr{E}_{r|[r-1]}|\rho_{i})\cdot\textrm{Tr}(E_{k}\cdot\rho_{r})=\textrm{Tr}\bigr{(}E_{k}\cdot(\mathscr{E}_{r|[r-1]}\otimes\mathds{I})[\rho_{i}]\bigl{)}$
(73)

The input state $\rho_{i}$ has equal probability to be sent through any
channel $\\{\mathscr{E}_{r|[r-1]}\\}$, so the probability that, after the
protocol, the state was not lost in the channel ($\checkmark$) and we measure
the $k$-th outcome of the POVM $\\{E_{k}\\}_{k}$ reads:

$\Pr(\checkmark\cap
k)=\dfrac{1}{N+1}\sum_{r=1}^{N+1}\Pr\bigl{(}(\checkmark\cap
k)|r\bigr{)}=\textrm{Tr}\bigr{(}E_{k}\cdot(\bar{\mathscr{E}}_{i,o}\otimes\mathds{I})[{\rho}_{i}]\bigl{)}$
(74)

Similarly, the probability that the state was not lost in the channel reads:

$\Pr(\checkmark)=\dfrac{1}{N+1}\sum_{r=1}^{N+1}\Pr(\checkmark|r)=\dfrac{1}{N+1}\sum_{r=1}^{N+1}t(\mathscr{E}_{r|[r-1]}|\rho_{i})=t(\bar{\mathscr{E}}_{i,o}|\rho_{i})$
(75)

Knowing the protocol succeeded, so the input state was not lost in the
channel, the probability that we measure the $k$-th outcome of the POVM reads:

$\Pr(k|\checkmark)=\dfrac{\Pr(\checkmark\cap
k)}{\Pr(\checkmark)}=\dfrac{\textrm{Tr}\bigr{(}E_{k}\cdot(\bar{\mathscr{E}}_{i,o}\otimes\mathds{I})[{\rho}_{i}]\bigl{)}}{t(\bar{\mathscr{E}}_{i,o}|\rho_{i})}=\textrm{Tr}(E_{k}\cdot\bar{\rho}_{o})$
(76)

This shows that as long as $r$, the position of $\rho_{i}$ among probe states,
remains hidden and random, any measurement performed on the output state later
after the protocol would follow the same statistics as if it was performed on
the expected output state $\bar{\rho}_{o}$. By extension, the fidelity
$F\bigl{(}\bar{\rho}_{o},(\mathscr{E}_{0}\otimes\mathds{I})[\rho_{i}]\bigr{)}$
can be interpreted as the average probability of successfully implementing the
channel $\mathscr{E}_{0}$ on $\rho_{i}$, up to isometry Unnikrishnan and
Markham (2019). In the following, we show how to bound that fidelity using
only the measurements performed during the protocol when sending the probe
states $\Phi_{i}$ through the channel.

###  D.2 Bounding Channel Fidelity with State Fidelities

In the following, we prove the key theoretical result of this study (7), which
allows one to bound the quality of a channel with probe states fidelities to a
maximally-entangled state, up to isometries. More precisely, we show the
following lemma:

######  Lemma 5 (Probabilistic Channel Certification).

Let us consider a deterministic channel $\mathscr{E}_{0}$ from
$\mathscr{L}(\mathscr{H}_{i})$ to $\mathscr{L}(\mathscr{H}_{o})$, a
probabilistic channel $\mathscr{E}$ from
$\mathscr{L}(\mathscr{H}_{\mathscr{A}_{1}})$ to
$\mathscr{L}(\mathscr{H}_{\mathscr{B}})$, and a secondary space
$\mathscr{L}(\mathscr{H}_{\mathscr{A}_{2}})$. For any isometries
$\Gamma^{\mathscr{B}}:\mathscr{H}_{\mathscr{B}}\longrightarrow\mathscr{H}_{\mathscr{B}}\otimes\mathscr{H}_{o}$
and
$\Gamma^{\mathscr{A}_{1}/\mathscr{A}_{2}}:\mathscr{H}_{\mathscr{A}_{1}/\mathscr{A}_{2}}\longrightarrow\mathscr{H}_{\mathscr{A}_{1}/\mathscr{A}_{2}}\otimes\mathscr{H}_{i}$
we define the corresponding fidelities of a state
$\Phi_{i}\in\mathscr{L}(\mathscr{H}_{\mathscr{A}_{1}}\otimes\mathscr{H}_{\mathscr{A}_{2}})$
to a maximally-entangled state
$\Phi_{+}\in\mathscr{L}(\mathscr{H}_{i}^{\otimes 2})$, before and after
application of the channels:

$\displaystyle F^{i}=$
$\displaystyle\>F((\Lambda^{\mathscr{A}_{1}}\otimes\Lambda^{\mathscr{A}_{2}})[\Phi_{i}],\Phi_{+})$
(77) $\displaystyle F^{o}=$
$\displaystyle\>F((\Lambda^{\mathscr{B}}\otimes\Lambda^{\mathscr{A}_{2}})[(\mathscr{E}\otimes\mathds{I})[\Phi_{i}]]/t(\mathscr{E}|\Phi_{i}),(\mathscr{E}_{0}\otimes\mathds{I})[\Phi_{+}])$

where
$\Lambda^{\mathscr{P}}[\cdot]=\textrm{Tr}_{\mathscr{P}}(\Gamma^{\mathscr{P}}[\cdot])$
for $\mathscr{P}=\mathscr{A}_{1},\mathscr{A}_{2}$ or $\mathscr{B}$. Then there
exist two isometries $\Gamma_{i}$ (encoding map) and $\Gamma_{o}$ (decoding
map), built from $\Gamma^{\mathscr{A}_{1}}$, $\Gamma^{\mathscr{A}_{2}}$ and
$\Gamma^{\mathscr{B}}$, such that channel fidelities between $\mathscr{E}$ and
$\mathscr{E}_{0}$ are bounded, up to isometries:

$\sqrt{1-\mathscr{F}_{\diamond}(\mathscr{E}_{i,o},\mathscr{E}_{0})}\leq
d\cdot\sqrt{1-\mathscr{F}_{J}(\mathscr{E}_{i,o},\mathscr{E}_{0})}\leq
d\cdot\sin\biggl{(}\arcsin\bigl{(}C^{i}/t(\mathscr{E}|\Phi_{i})\bigr{)}+\arcsin
C^{o}\biggr{)}$ (78)

where $d=\dim\mathscr{H}_{i}$,
$\mathscr{E}_{i,o}=\textrm{Tr}_{ext}\bigl{(}(\Gamma_{o}\circ\mathscr{E}\circ\Gamma_{i})[\rho_{\mathscr{A}_{1}}\otimes\bullet\>]\bigr{)}$,
$\rho_{\mathscr{A}_{1}}$ an ancillary state in
$\mathscr{L}(\mathscr{H}_{\mathscr{A}_{1}})$, and $C^{i}=\sqrt{1-F^{i}}$ and
$C^{o}=\sqrt{1-F^{o}}$.

Proof: This theorem is a generalization of the result from Sekatski  _et al._
(2018) to trace-decreasing channels. We follow the same guidelines for our
proof. First we define
$\Phi_{i}^{\prime}=(\mathds{I}\otimes\Lambda^{\mathscr{A}_{2}})[\Phi_{i}]$, in
order to forget about the injection on Alice’s second subsystem, that does not
have much relevance here as the channel $\mathscr{E}$ leaves it unaffected.
Then, we note that according to Proposition 2 from Sekatski  _et al._ (2018),
if one is given a target pure state
$\rho_{0}\in\mathscr{L}(\mathscr{H}_{sys})$ and any state
$\Gamma[\rho]\in\mathscr{L}(\mathscr{H}_{ext}\otimes\mathscr{H}_{sys})$ with
$\Lambda[\rho]=\textrm{Tr}_{ext}(\Gamma[\rho])\in\mathscr{L}(\mathscr{H}_{sys})$,
then the following relation holds

$F(\Lambda[\rho],\rho_{0})=F(\Gamma[\rho],\rho_{ext}\otimes\rho_{0})$ (79)

with
$\rho_{ext}=\dfrac{\textrm{Tr}_{sys}(\Gamma[\rho]\rho_{0}\otimes\mathds{I})}{\textrm{Tr}(\Gamma[\rho]\rho_{0}\otimes\mathds{I})}$
. We start by applying this proposition to $F^{i}$, with
$\mathscr{H}_{sys}=\mathscr{H}_{i}\otimes\mathscr{H}_{i}$ and
$\mathscr{H}_{ext}=\mathscr{H}_{\mathscr{A}_{1}}$, so we get a new expression
of that fidelity:

$F^{i}=F\bigl{(}(\Gamma^{\mathscr{A}_{1}}\otimes\mathds{I})[\Phi_{i}^{\prime}],\rho_{\mathscr{A}_{1}}\otimes\Phi_{+}\bigr{)}$
(80)

with
$\rho_{\mathscr{A}_{1}}=\dfrac{\textrm{Tr}_{\mathscr{H}_{i}\otimes\mathscr{H}_{i}}\bigl{(}(\Gamma^{\mathscr{A}_{1}}\otimes\mathds{I})[\Phi^{\prime}_{i}]{\lvert\Phi_{+}\rangle\\!\langle\Phi_{+}\rvert}\otimes\mathds{I}\bigr{)}}{\textrm{Tr}\bigl{(}(\Gamma^{\mathscr{A}_{1}}\otimes\mathds{I})[\Phi^{\prime}_{i}]{\lvert\Phi_{+}\rangle\\!\langle\Phi_{+}\rvert}\otimes\mathds{I}\bigr{)}}$.
The isometry $\Gamma^{\mathscr{A}_{1}}$ can be written as a unitary, applied
on a Hilbert state of larger dimension, so that
$(\Gamma^{\mathscr{A}_{1}}\otimes\mathds{I})[\Phi^{\prime}_{i}]=(U^{i}\otimes\mathds{I})[\sigma_{ext}\otimes\Phi^{\prime}_{i}]$
with $\sigma_{ext}$ an ancillary pure state and $U^{i}$ a unitary operation
applied on that state and $\mathscr{H}_{\mathscr{A}_{1}}$. This way we get:

$\displaystyle F^{i}=$ $\displaystyle\
F\bigl{(}(U^{i}\otimes\mathds{I})[\sigma_{ext}\otimes\Phi_{i}^{\prime}],\rho_{\mathscr{A}_{1}}\otimes\Phi_{+}\bigr{)}$
(81) $\displaystyle=$ $\displaystyle\
F\bigl{(}\sigma_{ext}\otimes\Phi_{i}^{\prime},({U^{i}}^{\dagger}\otimes\mathds{I})[\rho_{\mathscr{A}_{1}}\otimes\Phi_{+}]\bigr{)}$
$\displaystyle\leq$ $\displaystyle\
F\bigl{(}\Phi_{i}^{\prime},\textrm{Tr}_{ext,i}({U^{i}}^{\dagger}\otimes\mathds{I})[\rho_{\mathscr{A}_{1}}\otimes\Phi_{+}]\bigr{)}$

where we use the fidelity invariance under unitary operation, and the fact
that it can only increase upon tracing out, here of the Hilbert space of
$\sigma_{ext}$. This allows us to define the encoding map
$\Gamma^{i}=({U^{i}}^{\dagger}\otimes\mathds{I})[\>\bullet\>]$ so we have:

$F^{i}\leq
F\bigl{(}\Phi_{i}^{\prime},\textrm{Tr}_{ext,i}(\Gamma^{i}[\rho_{\mathscr{A}_{1}}\otimes\Phi_{+}])\bigr{)}$
(82)

Now by defining the decoding map $\Gamma^{o}=\Gamma^{\mathscr{B}}$, we can
apply the map $\Gamma^{o}\circ\bar{\mathscr{E}}\otimes\mathds{I}$ to both
states on the right-hand side of the inequality, and use Lemma 1 for extended
metric monotonicity, and once again fidelity monotonicity when tracing out
subsystems:

$\displaystyle C^{i}$ $\displaystyle=\sqrt{1-F^{i}}$ (83) $\displaystyle\geq
C\bigl{(}\Phi_{i}^{\prime},\textrm{Tr}_{ext,i}(\Gamma^{i}[\rho_{\mathscr{A}_{1}}\otimes\Phi_{+}])\bigr{)}$
$\displaystyle\geq t(\bar{\mathscr{E}}|\Phi_{i}^{\prime})\cdot
C\bigl{(}(\Gamma^{o}\circ\bar{\mathscr{E}}\otimes\mathds{I})[\Phi_{i}^{\prime}]/t(\bar{\mathscr{E}}|\Phi_{i}^{\prime}),\textrm{Tr}_{ext,i}((\Gamma^{o}\circ\bar{\mathscr{E}}\circ\Gamma^{i}\otimes\mathds{I})[\rho_{\mathscr{A}_{1}}\otimes\Phi_{+}])/\tilde{t}\>\bigr{)}$
$\displaystyle\geq t(\bar{\mathscr{E}}|\Phi_{i}^{\prime})\cdot
C\bigl{(}(\Lambda^{\mathscr{B}}\circ\bar{\mathscr{E}}\otimes\mathds{I})[\Phi_{i}^{\prime}]/t(\bar{\mathscr{E}}|\Phi_{i}^{\prime}),\textrm{Tr}_{ext}((\Gamma^{o}\circ\bar{\mathscr{E}}\circ\Gamma^{i}\otimes\mathds{I})[\rho_{\mathscr{A}_{1}}\otimes\Phi_{+}])/\tilde{t}\>\bigr{)}$

Here in order to apply Lemma 1, we noted that
$t(\bar{\mathscr{E}}|\Phi_{i}^{\prime})=\textrm{Tr}((\bar{\mathscr{E}}\otimes\mathds{I})[\Phi_{i}^{\prime}])$
is the transmissivity of the first state, which does not vary under
application of isometry $\Gamma^{o}$. Also $\tilde{t}$ is the transmissivity
of the second state, $i.e.$ $\tilde{t}=t(\bar{\mathscr{E}}_{i,o}|\Phi_{+})$ as
we define
$\bar{\mathscr{E}}_{i,o}=\textrm{Tr}_{ext}((\Gamma^{o}\circ\bar{\mathscr{E}}\circ\Gamma^{i})[\rho_{\mathscr{A}_{1}}\otimes\>\bullet\>])$.
The last partial trace in the inequality is carried out over all subsystems
except $\mathscr{L}(\mathscr{H}_{o}\otimes\mathscr{H}_{i})$, such that the
distance can only decrease. Noting that
$(\Lambda^{\mathscr{B}}\circ\bar{\mathscr{E}}\otimes\mathds{I})[\Phi_{i}^{\prime}]/t(\bar{\mathscr{E}}|\Phi_{i}^{\prime})=(\Lambda^{\mathscr{B}}\otimes\Lambda^{\mathscr{A}_{2}})\circ(\bar{\mathscr{E}}\otimes\mathds{I})[\Phi_{i}]/t(\bar{\mathscr{E}}|\Phi_{i})$
we get:

$C^{i}/t(\bar{\mathscr{E}}|\Phi_{i}^{\prime})\geq
C\bigl{(}(\Lambda^{\mathscr{B}}\otimes\Lambda^{\mathscr{A}_{2}})[\bar{\Phi}_{o}],(\bar{\mathscr{E}}_{i,o}\otimes\mathds{I})[\Phi_{+}]/t(\bar{\mathscr{E}}_{i,o}|\Phi_{+})\bigr{)}$
(84)

Finally, we can apply an equivalent of triangular inequality to Ulhmann’s
fidelity:

$\displaystyle\arccos\sqrt{F(\rho_{1},\rho_{3})}$ $\displaystyle=\arcsin
C(\rho_{1},\rho_{3})$ (85)
$\displaystyle\leq\arccos\sqrt{F(\rho_{1},\rho_{2})}+\arccos\sqrt{F(\rho_{2},\rho_{3})}$
$\displaystyle=\arcsin C(\rho_{1},\rho_{2})+\arcsin C(\rho_{2},\rho_{3})$

with the following states

$\displaystyle\rho_{1}$
$\displaystyle=(\bar{\mathscr{E}}_{i,o}\otimes\mathds{I})[\Phi_{+}]/t(\bar{\mathscr{E}}_{i,o}|\Phi_{+})$
(86) $\displaystyle\rho_{2}$
$\displaystyle=(\Lambda^{\mathscr{B}}\otimes\Lambda^{\mathscr{A}_{2}})[\bar{\Phi}_{o}]$
(87) $\displaystyle\rho_{3}$
$\displaystyle=(\mathscr{E}_{0}\otimes\mathds{I})[\Phi_{+}].$ (88)

$\rho_{1}$ is the output state of the real channel when sending a perfect
maximally entangled state, $\rho_{2}$ the average output state we effectively
measure after application of the real channel on a close-to-maximally-
entangled state, and $\rho_{3}$ the output state of the target channel when
sending a perfect maximally entangled state. This way we have
$C(\rho_{2},\rho_{3})=C^{o}$ and
$C(\rho_{1},\rho_{3})=\arccos\sqrt{\mathscr{F}_{J}(\bar{\mathscr{E}}_{i,o},\mathscr{E}_{0})}$
by definition, and $C(\rho_{1},\rho_{2})\leq
C^{i}/t(\bar{\mathscr{E}}|\Phi_{i})$ via inequality (84). This gives the final
result:

$\arccos\sqrt{F_{J}(\bar{\mathscr{E}}_{i,o},\mathscr{E}_{0})}=\arcsin\mathscr{C}_{J}(\bar{\mathscr{E}}_{i,o},\mathscr{E}_{0})\leq\arcsin\bigl{(}C^{i}/t(\bar{\mathscr{E}}|\Phi_{i})\bigr{)}+\arcsin(C^{o})$
(89)

From here, one just has to use the comparison between diamond and Choi-
Jamiołkowski distances, as we showed in Lemma 2, in order to get the bound
(78) and lemma 5 $\blacksquare$.

Figure 7: Schematic representation of isometries’ actions on (a) the input
state $\Phi_{i}$, (b) the output state $\Phi_{o}$, and (c) the quantum channel
$\mathscr{E}$. All isometries, except $\Gamma_{i}$, extract a qubit state from
a physical system. Only the qubit state remains as the other degrees of
freedom are discarded. The isometry $\Gamma_{i}$ encodes a qubit state onto a
physical state that can be fed into the quantum channel $\mathscr{E}$.
$\Gamma_{i}$ schematically performs the inverse operation than
$\Gamma^{\mathscr{A}_{1}}$. Together, $\Gamma_{i}$ and $\Gamma_{o}$ extract a
qubit-to-qubit channel from a physical channel.

The isometries mentioned in the proof are fundamental in a device independent
study, in order to extract ideal qubit spaces to real-world infinite-dimension
physical Hilbert spaces. $\Gamma^{\mathscr{A}_{1}}$,
$\Gamma^{\mathscr{A}_{2}}$ and $\Gamma^{\mathscr{B}}$ are the same type of
isometries as in all standard self-testing results Šupić and Bowles (2020),
and they extract a qubit state from the full state of a physical system, which
encompasses all other degrees of freedom. The unused degrees of freedom are
then thrown away. The channel isometries $\Gamma_{i}$ and $\Gamma_{o}$ were
introduced more recently Sekatski  _et al._ (2018) and together extract a
qubit channel from a physical channel acting on all degrees of freedom of a
physical system. The decoding map $\Gamma_{o}$ performs the same operation as