{'fraction_non_alphanumeric': 0.040215553071344626, 'fraction_numerical': 0.009631094677100353, 'mean_word_length': 4.346000612932884, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 7, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Source-independent quantum random number generation via measuring coherence

Measuring quantum states provides means to generate genuine random numbers. It has been shown that genuine randomness can be obtained even with an uncharacterized quantum source. In this work, we propose a framework that formalizes the idea of realizing source-independent quantum random number generation via measuring coherence. Without full state tomography, the coherence of the source can be estimated by coherence witnesses. The existing uncertainty-relation-based schemes can be treated as special cases under the coherence framework, as we design a nonlinear coherence witness that can essentially yield the same results. Meanwhile, we propose a source-independent random number generation scheme, which can achieve a higher randomness generation rate than the uncertainty-relation-based ones.


Introduction
Random number generation has many important applications in various tasks. In some cases, such as Monte Carlo simulation, it only requires the random numbers to be statistically unbiased. Pseudo random numbers or physical random numbers based on classical mechanics, such as coin flipping and noise measuring, are sufficient. The outcomes of these procedures may appear random, but they are in principle predictable. In cryptography, one of the security foundations lies on the unpredictability of random numbers, such as for the usage of keys. The random numbers via classical mechanic procedures are not suitable for cryptosystems. Therefore, it is important to study the generation of unpredictable (or genuine) random numbers.
According to Born's rule [1], the measurement outcome of a quantum system that is in the superposition of the measurement basis is unpredictable. Based on quantum mechanic principles, there are many quantum random number generation (QRNG) schemes proposed in the last two decades. For a review of the subject, one can refer to Ref. [2,3] and the references therein. In general, a QRNG setup consists of two parts, a source that contains randomness and a measurement that readouts the randomness. As shown in Fig. 1, the source emits a sequence of quantum signals and the readout system measures them to produce random outcomes. For instance, if the states from the source are a sequence of qubits, |+ = (|0 + |1 )/ √ 2, and the measurement is a projection onto the {|0 , |1 } basis, the outcomes are genuinely random.  In practice, the source may contain both genuine randomness and classical noise. The latter can normally be influenced by some unexpected environment parameters, such as the temperature. In a cryptographic picture, an adversary, Eve, may take advantage of the classical noise. Consider a source that emits maximally mixed state ρ = 1/2(|0 0| + |1 1|). Although the measurement outcomes on the Z basis appear random, they are not genuinely random. This can be understood in the presence of Eve, who simply prepares |0 or |1 based on a predetermined random string. In this case, the measurement outcomes are entirely predictable. In fact, the bias in random number generators becomes a major security issues in current cryptosystems [4].
The key job of randomness analysis is to quantify the genuine randomness so that it can be extracted. One way of randomness quantification relies on modeling the QRNG implementation, which normally requires to calibrate the source and measurement devices [5]. In practice, however, the calibration is often hard to perform thoroughly.
Once implemented devices deviate from theoretical models, the randomness can be compromised. Several proposals have been proposed to solve this problem. For instance, QRNGs via certifying randomness based on nonlocality tests [6] are called self-testing or device-independent schemes, where neither the calibration of the quantum source nor the measurement is required. In practice, realizing a loophole free Bell test is experimentally challenging, which requires high-fidelity state preparation and detection efficiency, as well as the accurate chronological sequence control [7]. Furthermore, the randomness generation rate is quite limited owing to a small violation of Bell inequalities obtained with the state-of-the-art technology [8,9].
In real-life applications, fully device-independent scenario may be too restrictive. By putting certain reasonable assumptions to devices, the performance of QRNGs would become practically acceptable. Along this direction, various efforts have been devoted to find a tradeoff between device independence and high randomness generation rate [10,11,12,13]. In this paper, we focus on the scenario of generating genuine randomness with well-calibrated measurement devices but uncharacterized source, namely, source-independent quantum random number generation (SIQRNG) [11]. With certain reasonable assumptions on measurement devices, the SIQRNG schemes can be very practical. For instance, with a continuous-variable system, the randomness generation rate in such a scenario has achieved the Gbps regime [12]. The intuition behind these schemes is the quantum uncertainty relation. Given two complementary measurement bases, X and Z, if the outcome uncertainty of the X-basis measurement is small, its uncertainty of the Z-basis measurement must be large. The information on the complementary basis can be used to reveal the genuine randomness within the source. Since the uncertainty relation is state-independent, the QRNG schemes are source-independent.
Recently, genuine randomness has been shown to be essentially related to the coherence of the input quantum state in the measurement basis [14,15]. There, the source is trusted and the extractable randomness is quantified in the asymptotic limit. In this paper, we propose a framework that extends this idea to a more general setting, where the source is uncharacterized and the measurement outcomes are finite. We show that SIQRNG can be realized via measuring coherence of the input quantum state. Moreover, we propose a method of estimating the coherence via coherence witnesses. By designing a nonlinear coherence witness, we show that the coherence estimation yields the same randomness quantification with the previous uncertainty-relation-based SIQRNG schemes. Furthermore, we propose a SIQRNG scheme that generally enjoys a higher randomness generation rate than the uncertainty-relation-based ones.
The paper is organized as follows. In Sec. 2, we review the preliminaries on coherence measures and SIQRNG. Then, in Sec. 3, we introduce a witness to measure the coherence. In Sec. 4, we present the framework of QRNG via measuring coherence, based on which, a SIQRNG protocol is proposed in Sec. 5. In Sec. 6, with numerical simulations, we show that our protocol generally enjoys a higher randomness generation rate than the uncertainty-relation-based schemes. Finally, we conclude in Sec. 7.

Resource theory of coherence
The resource theory of coherence formalizes the intuition that quantum superpositions are non-classical [16]. In this framework, with an orthogonal basis, Π = {|i }, as the reference basis, one can define the free state (incoherent state) as σ = i p i |i i|, with {p i } ≥ 0 and i p i = 1. The free operations (incoherent operations) are the set of operations that take incoherent states to incoherent states. Specifically, they are formed by the Kraus operators, {K i }, that satisfy K i IK † i ∈ I, where I is the set of incoherent states.
Under this resource framework, a coherence measure needs to fulfill a few criteria. There are many proposals for coherence measures, such as the l 1 -norm of coherence [16], the coherence of formation [14], and the robustness of coherence [17]. In this paper, we adopt the relative entropy of coherence [16], where H(ρ) is the von Neumann entropy of ρ and ∆ Π (ρ) ≡ i |i i|ρ|i i| is the dephasing operation in the reference basis Π. Recently, the relative entropy of coherence is linked to the genuine randomness obtained by measuring ρ in the basis Π [15].

SIQRNG
In the framework of SIQRNG, illustrated in Fig. 2, Eve prepares a sequence of quantum states represented by τ AE . Then she sends the subsystem A to the legitimate user, Alice, and retains the rest E. Alice divides the received state τ A = Tr E (τ AE ) into N partition states and measures each state in some basis. Alice tries to extract genuine randomness from the measurement outcome. Meanwhile, Eve aims at predicting the random numbers extracted from τ A with the assistance of τ E .  Figure 2: Source independent quantum random number generator. The squashing model transfers the input states into qubits. Based on additional random inputs, the readout system randomly choose a basis to measure the received state.
Since the source is untrusted and uncharacterized, τ A can be prepared in an arbitrary dimensional Hilbert space. On the other hand, Alice's outcome is either 0 or 1, which implies her measurement resembles a qubit measurement. One can think of Alice projecting the received state to a qubit first and then performing measurement. This projection is called squashing operation [18,19]. The challenge lies on proving the equivalence between a practical measurement and squashing operation plus a qubit measurement with an arbitrary state input. Fortunately, the squashing model has been proven to be satisfied in the common optical implementations using threshold detectors with proper postprocessing [20,21].
After the squashing operation, Alice can project the state τ A to n qubits and N − n vacuum states. Alice performs qubit measurements on the n qubits. The rest N − n vacuum states can be regarded as measurement losses. Since measurement devices are trusted in the SIQRNG scenario, one can assume that the n qubits are fair-sampled from the N states. That is, here the detection efficiency loophole is not considered. The following randomness analysis will focus on the n squashed qubits.
Here, we briefly review the previous SIQRNG scheme [11].
1) An untrusted source (controlled by Eve) emits a sequence of quantum states.
2) Alice (or Eve) squashes the quantum states into qubits and vacua. Alice discards the vacua and retains the n squashed qubits.
3) Alice randomly chooses n x qubits out of the n squashed qubits and measures them in the X basis. Within n x outcomes, the ratio of outcome |− is e xb , which is defined to be the error rate. Ideally, Alice expects the source to emit the state |+ and hence the result of |− is defined as an error.
4) Alice measures the rest n z = n − n x squashed qubits in the Z basis to obtain n z raw random bits. 5) Alice extracts n z (1 − S(e xb + θ)) − t e random bits from the raw random bits using a universal hashing function, where S is the binary Shannon entropy, θ is the statistical deviation parameter and 2 −te is the failure probability of the randomness extraction.
In above scheme, the security proof techniques of quantum key distribution (QKD) are employed in the randomness analysis. Here is the argument. Ideally, the source should emit states |+ . Then, Alice measures them in the Z basis, {|0 , |1 }, to generate random numbers. In scenario of SIQRNG, the source is allowed to emit arbitrary quantum states in arbitrary dimensions. On the measurement end, one can consider a virtual protocol. First, a squashing model is applied to project the quantum states into a sequence of qubit and vacuum states. Then Alice performs an error correction procedure that transforms all states to |+ . Finally she measures them in the Z basis. By designing the error correcting code appropriately, this operation can be commute with the Z-basis measurement [22]. Also the squashing model is proven to be equivalent to the threshold detection model with appropriate postprocessing [20]. Hence, Alice does not need to perform the virtual protocol, which requires a universal quantum computer. Instead, she can perform the Z-basis measurement first and then apply a randomness extraction on the measurement outcomes. The latter essentially functions the same as the error correction procedure in the virtual protocol.
In the randomness extraction, or the error correction in the virtual protocol, Alice needs to know the error rate in the X basis, Thus, in the SIQRNG scheme, Alice needs to randomly test the quantum state in the X basis to estimate its error rate, which is later used for randomness quantification [11].
In this paper, we would show the randomness of SIQRNG from a difference perspective. The idea is based on the recently discovered link between coherence and genuine randomness in a quantum state [14,15]. Instead of applying error correction, Alice estimates the coherence of the qubit states via measuring randomly sampled qubit states. Then she measures the rest qubits in the Z basis to generate the raw randomness. The estimated coherence are used to bound the genuine randomness of the raw data. In postprocessing, she distills the genuine randomness from the raw data.

Measuring coherence with coherence witness
Normally, to estimate the coherence of an unknown state, one needs to perform a full state tomography to obtain the density matrix ρ. In some cases, full tomography information is not available. For example, as the dimension of the state increases, the number of required measurement in tomography increases quadratically, which becomes very challenging for experiments. Thus, it is interesting to estimate the coherence of an unknown state without a full tomography.
A similar problem raises in the field of entanglement measure, where it is expected to estimate the entanglement with a limited number of measurements. The solution there is to employ entanglement witnesses, which are originally designed to justify whether quantum states are entangled or not, to estimate entanglement [23,24]. Recently, this idea has been extended to the resource theory of coherence [17], i.e., estimating the coherence with coherence witnesses.
The original coherence witness is a linear function of the density matrix ρ [17]. Here, we extend this notion to an arbitrary function of ρ.

Definition 1.
A coherence witness is a function of ρ, W (ρ), that satisfies the following criteria, A linear coherence witness has been shown to be useful to bound the coherence [17]. Here, we design a nonlinear coherence witness to bound the relative entropy of coherence.
is an coherence witness, where Ξ is a mutually unbiased basis of Π.
Proof. It is not hard to see that ∀ρ ∈ I, one has W u (ρ) = 0, since Ξ is a mutually unbiased basis of Π. Also, for Theorem 1. Given a reference basis Π = {|i } and a state ρ in a d-dimensional Hilbert space, the relative entropy of coherence, C(ρ), can be bounded by the coherence witness W u (ρ) defined in Eq. (3.1), where Ξ is a mutually unbiased basis of Π.
Proof. The dephasing operators, ∆ Π (ρ) and ∆ Ξ (ρ), can be viewed as two projection measurements, which have the quantum uncertainty relation [25], The two bases Π and Ξ are mutually unbiased, and hence c = 1/d. Rearranging the terms in Eq.(3.3) and using the definition From Theorem 1, one can estimate the relative entropy of coherence via measuring the state in the complementary basis of the reference basis. This idea is similar to the one employed in the uncertainty-relation-based SIQRNG [11,12]. There, the intrinsic randomness generated via the Z-basis measurement is estimated by measuring the state in the complementary X basis. In the next section, we propose a framework that formalizes the relation between these two scenarios.

Framework of SIQRNG via measuring coherence
The task of estimating coherence of an unknown quantum state shares similarities with randomness evaluation in SIQRNG. In both scenarios, the source state is uncharacterized while the measurement is trusted. Meanwhile, the amount of genuine randomness within the source can be quantified by the coherence of the quantum state [14,15]. Therefore, extracting genuine randomness in SIQRNG can be reduced to the problem of estimating coherence within the source. In this section, we would present an framework that links the two tasks.

Quantification of randomness
Following the discussion of SIQRNG in Sec. 2, we focus on the n squashed qubits, which contribute one raw data bit each. Alice needs to quantify the genuine randomness in the n-bit raw data from the n-qubit state, τ A = Tr E (τ AE ) ∈ H ⊗n 2 , where H 2 denotes a two-dimensional Hilbert space. In the partial trace, we put the N − n vacuum states to system E. Note that the n qubits can be correlated with each other, or even with Eve's system τ E .
Suppose Alice randomly chooses n z qubits and measures them in the Z basis to generate raw random bits, while she measures the rest n − n z qubits in some other complementary bases for parameter estimation, which would give Alice information about τ A . Denote the measurement outcome in the Z basis (an n z -bit string) by K z . Here, Alice's measurement can be viewed as a dephasing operation on each qubit of subsystem A in the Z basis, ∆ A Z ⊗nz (τ AE ). Then the randomness contained in K z is quantified by [26], where the minimization runs over all possible states of Eve that satisfy Tr E (τ AE ) = τ A , and H ε 1 min is the smooth min-entropy, defined in Appendix A, with a smooth parameter ε 1 .
The min-entropy R ε 1 (K z ) is the key parameter for randomness extraction. With universal hashing [27], such as Teoplitz-matrix hashing, one can extract random bits that are ε-close to a uniformly distributed string from Eve's point of view. Here, the security parameter is ε = ε 1 + ε 2 , with ε 2 the failure probability introduced in the randomness extraction procedure.

Randomness analysis
In the following, we analyze the randomness with the assumption that the n squashed qubits are independent and identically distributed (i.i.d.). This assumption is also made in the scenario of collective attacks in QKD, where Eve attacks each signal in an i.i.d. manner. In a more general setting, the n qubits might be entangled, which corresponds to the scenario of coherent attacks in QKD. It is proven that the security parameter for coherent attacks is only polynomially lager than the security parameter for collective attacks [28]. The extra information available to the adversary for coherent attacks can be compensated by slightly reducing the size of the final random bits in the privacy amplification stage. We expect that a similar argument can be employed here to obtain the security proof against the most general sources. We leave the randomness analysis with an correlated source for future study.
With the i.i.d. assumption, the joint state that outputs the raw random bits can be expressed by τ AE = ρ ⊗nz AE . From Eq. (4.1), one can have , the smooth min-entropy can be lower bounded by the conditional von Neumann entropy , defined as H(A|E) ρ AE = H(ρ AE ) − H(ρ E ) [29]. Thus one has We remark that this expression only holds for n z ≥ 8 , which is normally satisfied in practice, typically, n z ≥ 95 for ε 1 = 10 −10 .

Randomness analysis via coherence witness
The randomness analysis result, Eq. (4.5), implies that one can estimate the amount of randomness in a quantum state by measuring the coherence of the state. In Sec. 3, we have shown that, without a full state tomography, one can lower bound the coherence with coherence witnesses. Therefore, there is a close relation between coherence witness and SIQRNG: any coherence witness that is able to lower bound the coherence can be employed to realize a SIQRNG scheme.
As an example, we apply this analysis method to the SIQRNG scheme described in Sec. 2.2. The measurement used by Alice in the SIQRNG scheme forms a coherence witness, W u , as shown in Eq. (3.1). Then, applying Theorem 1 to Eq. (4.5), the number of genuine random bits, denoted by R ε 1 u , is estimated by where W u (ρ A ) = H(∆ X (ρ A )) − 1. In the asymptotic limit, when the number of emitted qubits n approaches infinitely large, the randomness generation rate is given by where β = n/N is the transmittance of the signal, and q = n z /n is the ratio of Z-basis measurement. In this limit, Alice can set q → 1 to maximize r u . Note that Eq. (4.7) coincides with the randomness generation rate evaluated via the complementary uncertainty relation [11].

Tomography-based SIQRNG
Note that the SIQRNG protocols based on the complementary uncertainty relation do not necessarily extract the maximal amount of the randomness from the source. For instance, suppose that the source emits state (|0 + i|1 )/ √ 2, from Eq. (4.7), one obtain a lower bound of r u to be 0, thus no genuine randomness can be extracted. Nevertheless, the measurement outcome on the Z basis is in fact genuinely random. In this case, the genuine randomness cannot be revealed by the coherence witness using the X measurement. Instead, the randomness can be witnessed with another complementary basis Y = {|±i = (|0 ± i|1 )/ √ 2}. Without a priori knowledge of the source, one might choose a bad witness to underestimate the genuine randomness.
For the SIQRNG scheme described in Sec. 2.2, by adding one more measurement basis, Alice can obtain a better estimation of the coherence of ρ A via a full state tomography. Then she can extract more genuine randomness from the raw data. Based on this observation, we propose a SIQRNG protocol based on tomography, as presented in Table 1. Table 1: Source-independent quantum random number generation 1. State preparation: (a) An untrusted source (might be controlled by Eve) emits N quantum states in arbitrary dimensions, which are sequentially sent to the readout system. (b) An squashing operation transforms the quantum states into n qubits and N − n vacua.

Measurement:
(a) The N − n vacua are discarded and the remaining n squashed qubit states are post-selected for randomness generation. (b) Alice randomly chooses n x , n y , and n z qubits for the X-, Y -, and Z-basis measurements, with probability q x = q, q y = q, q z = 1 − 2q, respectively.
Denote p x , p y , and p z to be the rates to obtain the outcomes |+ , |i+ , and |0 , respectively. (c) The Z-basis measurement outcomes are recorded as the raw data.
3. State tomography: with the measurement results, p x , p y , and p z , Alice can estimate the density matrix of the squashed qubits, ρ A . Note that statistical fluctuations need to be considered here. 4. Randomness evaluation and extraction: with the information of ρ A , Alice can bound the genuine randomness of the raw data and apply a proper randomness extractor to obtain the final random bits.
In the protocol, the coherence of the source C(ρ A ) can be accurately estimated with a full tomography of ρ A . Then, the number of genuine random bits, denoted by R ε 1 t , can be estimated via Eq. (4.5), In the asymptotic limit, the randomness generation rate, denoted by r t , is given by where β = n/N is the transmittance of the signal and q z = n z /n is the ratio of Z-basis measurement. In large data-size limit, Alice can set q z → 1.
In tomography, the density matrix, ρ A can be estimated from measurement outcomes, p x , p y , and p z , defined in Table 1. Write ρ A as ρ A = (I + (2 p − 1) · σ)/2, where p = (p x , p y , p z ) and σ = (σ x , σ y , σ z ) are the Pauli matrices. Substituting ρ A into Eq. (2.1) and (5.1), one can get

Squashing model
As discussed in Sec. 2, the squashing model should be applied to project the quantum state from the uncharaterized source into a sequence of qubits. The squashing model requires that, depending on the measurement setting, appropriate postprocessing should be implemented. Here, Alice can employ the postprocessing of squashing model used in the analysis of quantum state tomography [21]. According to the Supplementary Materials of Ref. [21], the double click events should be considered to derive a set of bounds of the obtained statistics. Specifically, for each measurement bases j ∈ {X, Y, Z}, let n 0 j , n 1 j and n d j denote the numbers of the two single-click events and the double-click event, respectively. Then Alice obtains a set of qubit states, S, that are compatible with the measurement results. That is, they fulfill the following constraints, In the following, we denote the lower bound for p j in above inequalities by p L j , and the upper bound by p U j . In our protocol, Alice needs to consider the worst case of ρ A ∈ S. That is, she should minimize C(ρ A ) in Eq.(5.3) over S. In Appendix C, we show that C(ρ A ) is a unimodal function with respect to each p j , with the minimal value achieved for p j = 1/2. Without loss of generality, from now on, we assume p U j ≥ 1/2, otherwise Alice can flip the bit label in the j basis. Denote the worst case value of p j for the coherence quantification by p w j , thus p w j = max(p L j , 1/2).

Double clicks
As discussed in Sec. 5.1, it is possible to have double-click events in measurement, which should be taken into account in the tomography testing step. In addition, as the measurement outcome in the Z basis is also used to generate the raw random bits, one should implement some postprocessing on these data to map them to single-value outcomes. Note that the double-click events in the X and Y bases do not need this postprocessing, since they are only used for tomography testing in Eq. (5.5) where Alice only needs to count the number of double clicks. As will shown later, this postprocessing, such as random assignment, generally consumes randomness, which should be taken into account when evaluating the net randomness generation rate.

Random assignment method
Here, we consider a postprocessing method that Alice randomly assigns 0 or 1 for the double-click events in the Z basis. After the squashing model analysis, Alice obtains p w z as the worst case estimation of p z . Then, in the random assignment procedure, the probability of assigning value 0 to the doubleclick events, denoted by p a , should be compatible with p w z , Thus, p a is given by The randomness cost in the double-click assignment procedure is n d z H(p a ). Thus the net randomness generation rate is given by,

Discard method
In practice, the random assignment might be technically challenging to implement. Thus, we consider an easier method to deal with the doubleclick events in the Z basis -discarding all the double-click events. Let ρ s and ρ d denote the density matrix after squashing model that correspond to the single-click events and the double-click events, respectively. Then, one has p d ρ d A + (1 − p d )ρ s A = ρ A , where p d = n d z /n z is the ratio of double-click events in the Z basis. Once discarding all the double-click events, the random bits in the remaining data can be lower bounded by where n s z = n z − n d z is the number of single-click events in the Z basis. To estimate C(ρ s A ), one can employ the concavity of relative entropy of coherence, Source-independent quantum random number generation via measuring coherence 13 where C(ρ d A ) ≤ 1 is used in the second inequality. Combining Eq. (5.11), (5.9), and (5.3), the net randomness generation rate is given by Note that the randomness generation rate by the discard method is generally smaller than that by the random assignment method in Eq. (5.8).

Analysis of statistic fluctuations
In practice, the number of squashed qubits n is finite. Thus the probabilities used for parameter estimation would suffer from statistical fluctuations. Here, we analyze the finite-data-size effect on the estimation of p w j . In order to distinguish the probabilities with the measurement rates, denote the expectation values of p w j to bep j , which would be inserted into Eq. (5.4) to evaluate the genuine randomness. Since the qubits are assumed to be i.i.d., Alice can employ the Hoeffding inequality [30] to estimate the discrepancy between p w j andp j caused by the statistical fluctuations, Here, we assume p w j − θ ≥ 1/2, otherwise we take the worst boundp j = 1/2. Replacing {p w j } by {p w j − θ} in Eq. (5.8) or (5.12), one can obtain the lower bound of randomness with a total failure probability, where ε 1 is introduced by the smooth parameter and ε 2 is introduced by randomness extraction.

Simulation
In this section, we first analyze the performance of the tomography-based SIQRNG and compare it to the original proposal. Then, by taking account of statistical fluctuations, we optimize the ratio of qubits used for the tomography testing.

Comparing to the original SIQRNG
For simplicity, we consider the asymptotic limit where the number of emitted quantum states N is infinitely large. Then, the randomness generation rate for the original protocol is given by Eq. (4.7), while the rate for the tomography-based protocol is given by Eq. (5.2). In both cases, q z is set to be 1. Besides, we assume the single photon source is used without considering the photon loss and the detector inefficiency, and hence the transmittance β = 1. Then, the randomness generation rate for the original protocol is given by In the comparison, we assume the input state has the form of ρ A = (I+xσ x +yσ y )/2, where x and y are two parameters and x 2 + y 2 ≤ 1. The comparison between Eq. (6.1) and (6.2) is illustrated in Fig. 3. One can clearly see that the tomography-based scheme generally provides a higher randomness generation rate than the original proposal. The larger the parameter y is, the bigger gap the two schemes has. In general, one can consider a more general state, ρ A = (I+xσ x +yσ y +zσ z )/2, where the gap of randomness generation rate between the two schemes is nonzero as long as y = 0.

Parameter optimization
Now we analyze the performance of the tomography-based protocol by simulating a practical experiment setup. Details of the simulation model is presented in Appendix D. Consider a practical source, consisting of a laser and a polarization modulator, which emits N coherent-state pulses with an intensity of µ 0 . We assume the quantum state is prepared to be |+ , which is then transmitted through a depolarization channel. Thus, the received quantum state can be described by where p ∈ [0, 1]. The readout system consists of a polarization rotator (used for basis selection), a polarization beam splitter, and two threshold detectors with the same detection efficiencies. Denote the total transmittance by η, including the detector efficiency and the coupling efficiency between the source and the detector. It is equivalent to consider a coherent state with intensity of µ ≡ µ 0 η. Here, we ignore the detection caused by dark count since for QRNG, dark counts are normally negligible comparing to η. For a more comprehensive model taking account of dark counts, one can refer to the corresponding QKD model [31].
In this model, we put the misalignment errors into the parameter p. Then, the simulated worst estimations of p j are given by, Meanwhile, the number of double click events in the Z basis is The detailed model with the calculations of Eq. (6.4) -(6.7) are shown in Appendix D.
Note that all thep j here are less than 1/2, as required in the randomness analysis shown in Sec. 5. Then one can evaluate the extractable randomness from Eq. (5.12) ‡.
In the simulation, we pick p = 0, p = 0.1, p = 0.3 for the input state of Eq. (6.3), and set ε x = ε y = ε z = ε 1 = ε 2 = 10 −10 and the number of pulses N = 10 10 . First, by optimizing the tomography testing parameter q, we show the dependence of the randomness generation rate, given by Eq. (5.12), on the intensity µ in Fig. 4. From the figure, one can see that initially, the randomness generation rate increases with the intensity of the signal µ, due to the increase of the single-click events relative to the no-click events. As µ keeps increasing, the double-click events become dominant. Then, the randomness generation rate starts to decreases. Thus, there is an optimal choice of µ. In experiment, one should characterize total transmittance η first and then set the light intensity µ 0 to make µ = µ 0 η optimal.
Next, we investigate how the optimal tomography testing parameter, q, varies with the number of pulses, N. Here, we pick p = 0.1 and optimize the the intensity µ. When N ≤ 10 4.8 , no net random bits can be generated. One can see from Fig. 5(a) that the optimal q starts from 0.14 and drops down close to 0 with the increase of N. This is consistent with the intuition that q z = 1 − 2q → 1 as N goes to infinite. Note that the optimization of q assume that q x = q y in the tomography-based protocol. In general, one can optimize q x and q y separately.
We also investigate how the randomness generate rate varies with the number of pulses N, as shown in Fig. 5(b). Here, we pick p = 0.1 and optimize both the intensity µ and the tomography testing parameter q. One can see that no randomness can be obtained as N ≤ 10 4.8 , beyond which point the rate increases with N. This increase is ‡ Here, we adopt the discard method to process the double-click events in the Z basis. In fact, one would obtain the same randomness generate rate by the random assignment method in the case of Eq. (6.3). mainly contributed by the increase ratio of Z-basis measurement as N becomes large. This is similar to the biased basis case in QKD [32].

Discussion
In this paper, we propose a framework that realize the SIQRNG with measuring coherence of an unknown quantum state. We show that the uncertainty-relationbased SIQRNG is essentially related to estimating the relative entropy of coherence with a coherence witness. Furthermore, we propose a SIQRNG scheme based on state tomography and take account of the statistical fluctuations. By simulating the QRNG, we show that our protocol generally enjoys a higher randomness generation rate than the uncertainty-relation-based ones.
Along this direction, one can realize a SIQRNG scheme by designing the coherence witness that is adapted to specific experimental conditions. Besides, it is promising to extend the framework to high-dimensional QRNG, e.g., schemes based on continuous variables [12] or laser phase fluctuations [33]. A possible challenge of this extension is the development of the high-dimensional squashing model. ignore the detection caused by dark counts since for QRNG, dark counts are normally negligible comparing to η.
In the following, we aim to evaluate all the directly obtained experimental statistics. They include the number of total click events, n j , the number of single-click events of the two detectors, n 0 j , n 1 j , and the number of double-click events, n d j , when measuring in the j ∈ {X, Y, Z} basis.
Note that the number of photons of the coherent-state pulse follows the Poisson distribution, P (n) = e −µ 0 µ n 0 n! . With the total transmittance of the system η, the total number of clicks in the X basis is