{'fraction_non_alphanumeric': 0.03923377469068808, 'fraction_numerical': 0.014543086607336662, 'mean_word_length': 4.147625698324022, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 2, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 15, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A weak form of self-testing

The concept of self-testing (or rigidity) refers to the fact that for certain Bell inequalities the maximal violation can be achieved in an essentially unique manner. In this work we present a family of Bell inequalities which are maximally violated by multiple inequivalent quantum realisations. We completely characterise the quantum realisations achieving the maximal violation and we show that each of them requires a maximally entangled state of two qubits. This implies the existence of a new, weak form of self-testing in which the maximal violation allows us to identify the state, but does not fully determine the measurements. From the geometric point of view the set of probability points that saturate the quantum bound is a line segment. We then focus on a particular member of the family and show that the self-testing statement is robust, i.e. that observing a non-maximal violation allows us to make a quantitative statement about the unknown state. To achieve this we present a new construction of extraction channels and analyse their performance. For completeness we provide two independent approaches: analytical and numerical. The noise robustness, i.e. the amount of white noise at which the bound becomes trivial, of the analytical bound is rather small (~0.06%), but the numerical method takes us into an experimentally-relevant regime (~5%). We conclude by investigating the amount of randomness that can be certified using these Bell violations. Perhaps surprisingly, we find that the qualitative behaviour resembles the behaviour of rigid inequalities like the Clauser-Horne-Shimony-Holt inequality. This shows that at least for some device-independent applications rigidity is not a necessary ingredient.

Introduction.-In his seminal work Bell showed that performing measurements on spatially-separated quantum systems may give rise to correlations inconsistent with any local-realistic description of the world [1] (see Ref. [2] for a comprehensive review). While the initial motivation for studying Bell nonlocality and performing Bell experiments was to demonstrate, beyond any reasonable doubt, that the world is non-classical, we now understand that Bell nonlocality can be used in a more constructive manner. If we assume that the systems under consideration are governed by quantum mechanics, one can use the observed correlations to draw conclusions about their inner workings, a phenomenon known as deviceindependent certification of quantum devices. Quite surprisingly, in some cases one can almost completely determine the state and measurements under consideration. First such statements can be traced back to the early works of Tsirelson [3,4], Summers and Werner [5] and Popescu and Rohrlich [6] and this phenomenon is now referred to as self-testing [7,8] or rigidity [9]. The simplest and most well-known example concerns the famous Clauser-Horne-Shimony-Holt (CHSH) inequality [10]: if we observe the maximal violation of the CHSH inequality, we must be measuring a maximally entangled state of two qubits using anticommuting observables [3][4][5][6].
In a tomographic scenario we use a trusted measurement device to characterise an unknown quantum state (or vice versa) and in such a scenario a complete description of the unknown object can be obtained. In a deviceindependent scenario we trust neither the state nor the measurements, which imposes certain limitations on how much information we can hope to extract. As we have no information about the dimension of our system, we can never rule out the presence of additional degrees of freedom on which the measurements act trivially. Similarly, since there are no preferred local reference frames, we can only hope to characterise the system up to local unitaries. These two ambiguities are always present in the device-independent setting and any self-testing statement must account for them. A third ambiguity arises when the quantum realisation is chiral, i.e. it is not unitarily equivalent to its own transpose (we take the transpose in some fixed product basis). For instance the ordered set of three observables given by (σ x , σ y , σ z ) is not unitarily equivalent to (σ T x , σ T y , σ T z ). Several scenarios involving chiral realisations have been studied [11][12][13][14] and there the transpose ambiguity must be explicitly added to the list of allowed equivalences. Since we consider the transpose as natural and well-understood as the other two equivalences, we still refer to such a characterisation as selftesting. By now several classes of self-testing statements have been derived [13][14][15][16][17][18][19][20][21][22][23][24][25][26][27][28] and all of them exhibit the same structure: observing some strongly non-classical correlations implies that particular local measurements are performed on a specific entangled state (up to the equivalences mentioned above). In some cases these statements have been made robust, which allows us to draw nontrivial conclusions in the presence of a realistic level of noise [29][30][31][32][33][34] (see Ref. [35] for a recent review on selftesting).
In addition to its foundational importance self-testing has immediate applications to cryptography: if the Bell violation alone essentially determines the quantum realisation, one can certify that the randomness generated in the experiment is intrinsically quantum and cannot be known to an external eavesdropper. This is precisely the idea behind device-independent cryptography [36][37][38][39][40] (see Refs. [41][42][43] for reviews on various aspects of deviceindependent cryptography and randomness in quantum physics).
In this letter we prove the existence of a new, weak form of self-testing. We study a 1-parameter family of Bell inequalities and show that observing the maximal violation certifies the presence of a maximally entangled state of two qubits even though the measurements cannot be uniquely determined. To understand how this phenomenon is affected by noise, we focus on a particular member of the family and derive an analytic robust selftesting result for the state. Since the analytic statement can only tolerate a small amount of noise, we also compute numerical bounds using the "swap method" [29,30], which turn out to be significantly stronger. Finally, we study the amount of randomness that can be certified from the observed violation.
A family of Bell functionals.-Given a measurement with two outcomes {F 0 , F 1 } we associate the outcomes with values ±1, which gives rise to the observable A := F 0 − F 1 . We denote the observables of Alice and Bob by A x and B y , respectively. In the scenario of two parties, three settings and two outcomes we consider a family of Bell functionals defined as where α ∈ [0, 2] is a parameter and A x B y denotes the expectation value of the product of the outcomes. Note that for α = 1 this is precisely the correlation part of the I 3322 Bell functional [44,45]. It is easy to check that for this Bell functional the largest value achievable by local-realistic models equals β L = 4 max{1, α}, whereas quantum systems can achieve the value of β Q = 4 + α 2 . For our purposes we are only interested in Bell functionals that satisfy β L < β Q , so from now on we restrict our attention to the case of α ∈ (0, 2). It turns out that in those cases the quantum value can be achieved in multiple (inequivalent) ways: a 1-parameter family of quantum realisations for α = 1 was presented in Ref. [46] and can be straightforwardly generalised to all α ∈ (0, 2). This family is based on the maximally entangled state of two qubits |Φ + = 1 √ 2 (|00 + |11 ) and gives rise to a line segment in the space of probability distributions. Hence, it serves as a simple example of a non-trivial (in the sense that β L < β Q ) Bell functional which does not have a unique maximiser in the quantum set.
Until this work it was not known whether this Bell functional (1) admits additional maximisers which do not belong to the line segment and (2) exhibits some weak form of self-testing. In this work we answer both of these questions.
Exact self-testing.-Writing out the Bell operator gives Since the Bell functional contains only correlators, the quantum value can be computed by solving a semidefinite program [47] and the dual solution can be turned into a sum-of-squares decomposition of the Bell operator [48]. Indeed, it is easy to verify that Since we do not a priori assume that the measurements are projective, we do not replace A 2 x and B 2 y by identity operators. Nevertheless, we still have A 2 x ≤ 1, B 2 y ≤ 1, which immediately implies that W ≤ (4+α 2 ) 1⊗1. To see that this bound can be saturated consider the maximally entangled two-qubit state |Φ + and the observables where θ α := arcsin(α/2) (note that the range α ∈ (0, 2) corresponds to θ α ∈ (0, π/2)). Our goal now is to characterise all quantum realisations that achieve the maximal quantum value. To do so we use a method proposed originally in Ref. [6], which proceeds in 4 steps: (1) find algebraic relations satisfied by the local observables, (2) explicitly characterise the local observables, (3) construct the Bell operator and (4) diagonalise it.
Let ρ AB be an arbitrary bipartite state ρ AB and A x , B y be arbitrary binary observables. Let us also assume that the reduced states ρ A and ρ B are full-rank (in any case no conclusions can be drawn outside of the support of the state and this assumption significantly simplifies the notation). If this realisation achieves W, ρ AB = 4 + α 2 , where A, B := tr(A † B) is the Hilbert-Schmidt inner product, we deduce that for x, y ∈ {0, 1, 2} and moreover that for j ∈ {0, 1, 2}. Since the reduced states are full-rank Eq.
(3) implies that all the measurements are projective, i.e. A 2 x = 1 and B 2 y = 1. Conditions given in Eq. (4), on the other hand, impose some constraints on how the observables of Alice and Bob act on the state. Since L 2 j , ρ AB = L j ρ 1/2 AB 2 F , where || · || F is the Frobenius norm ||A|| F := A, A , the equality L 2 j , ρ AB = 0 implies that the operator L j ρ 1/2 AB vanishes. As an immediate consequence we obtain L j ρ AB = 0 for all j ∈ {0, 1, 2}. These conditions involve the observables of both parties, but we can use projectivity, which we have deduced earlier, to eliminate one of them. By elementary algebraic manipulations (see Appendix A for details) we show that L 1 ρ AB = 0 implies Furthermore, equality (L 0 + L 2 )ρ AB = 0 implies It is well-known that the commutation relation given in Eq. (5) combined with A 2 0 = A 2 1 = 1 implies a particular form of A 0 and A 1 (see Ref. [12] for an elementary proof). The Hilbert space of Alice must be of the form H A ≡ C 2 ⊗ C d A for some d A ∈ N and up to a local unitary the observables can be written as Then, Eq. (6) implies that where u j ∈ [0, 2π) and {|a j } d A j=1 forms an orthonormal basis on C d A . It is convenient to think of this arrangement of observables as a direct sum of 2 × 2 subspaces where each subspace is characterised by an angle u j ∈ [0, 2π).
Since the Bell functional is symmetric with respect to swapping Alice and Bob, the Hilbert space of Bob decomposes as H B ≡ C 2 ⊗ C d B for some d B ∈ N and the observables must be of the same form. However, it is convenient to write them down in a slightly different manner: Having characterised the local observables we are ready to write down the Bell operator. It is convenient to reorder the registers and write it as where R(u, v) is the two-qubit Bell operator corresponding to angle u for Alice and v for Bob. To characterise the states which give rise to the maximal violation we must find out for which choices of u and v the value λ = 4 + α 2 is an eigenvalue of W and what the corresponding eigenspace is. Since |a j a j | ⊗ |b k b k | are orthogonal projectors, the spectrum of W is simply the union of the spectra of R(u j , v k ). The two-qubit operator R(u, v) can be diagonalised explicitly and its eigenvalues read where we have eliminated θ α using the relation α = 2 sin θ α . Clearly, the eigenvalue λ = 4 + α 2 appears iff u = v, the corresponding eigenspace is 1-dimensional and one can check that thanks to the particular choice of Bob's observables the corresponding eigenvector is always |Φ + . The fact that in this continuous family of two-qubit realisations parametrised by angle u ∈ [0, 2π) the optimal state does not depend on the angle allows us to conclude that any state ρ AB satisfying W, ρ AB = 4 + α 2 must up to local unitaries be of the form: where σ A B is a normalised state satisfying is only supported on the subspaces where Alice and Bob perform "matching" measurements). In other words, every quantum realisation that achieves the maximal quantum value is basically a convex combination of the two-qubit realisations presented above.
We are now able to characterise all the probability distributions which saturate the quantum value and it suffices to compute the statistics corresponding to the twoqubit realisations. Since the state is maximally entangled, we have A x = B y = 0, while the correlators are given by It is clear that this set, which is an exposed face of the quantum set of correlations, is simply a line segment and that the extremal points correspond to u = π/2 and u = 3π/2. Note also that choosing u = x and u = π − x leads to identical statistics, because the corresponding realisations are related by a transpose. It is natural to ask whether a stronger self-testing statement can be made if instead of looking at the Bell value we consider the entire statistics. It is easy to see that the extremal points of the line segment are self-tests in the usual sense, i.e. the exact form of observables can be deduced (in fact, since they are extremal points of the quantum set of correlators, this follows already from the work of Tsirelson [3]). The points in the interior, on the other hand, cannot be self-tests in the usual sense, since they are not extremal in the quantum set. Moreover, it is easy to see that each interior point can be achieved in at least two inequivalent ways: (1) by a particular two-qubit realisation corresponding to a specific value of u or (2) as a convex combination of the two extremal points. Nevertheless, all such points certify the maximally entangled state of two qubits.
Robust self-testing.-To study the case of nonmaximal violation we focus on the Bell functional which corresponds to α = √ 2. This is a convenient choice because in this case all the ideal realisations employ a pair of anticommuting observables. In this paragraph we present a robust self-testing of the observables and the state (see Appendix B for derivations). For the following two theorems we assume that W is a Bell operator obtained by setting α = √ 2 in Eq. (2).
In the exact case we have concluded that A 2 x = 1, {A 0 , A 1 } = 0 and {A 0 +A 1 , A 2 } = 0. The sum-of-squares decomposition implies that these algebraic relations are approximately satisfied if a near-maximal violation is observed.
Theorem 1. If W, ρ AB ≥ 6−ε, then the measurements are nearly projective: Moreover, the following pairs of operators approximately anticommute: By symmetry analogous statements hold for the observables of Bob. Note that these statements remain non-trivial even under a macroscopic amount of noise (e.g. the trivial bound for the second quantity reads {A 0 , A 1 } 2 , ρ A ≤ 4, which is saturated by all projective measurements whose operators commute).
A complete characterisation of the optimal arrangements derived above allows us to propose suitable extraction channels and what is novel is the fact that one of the extraction channels must depend on all three observables.
This statement is not particularly robust to noise: the right-hand side exceeds the trivial value of 1 2 only if ε ≤ 0.0035. To obtain stronger results we have employed the swap method (see Appendix C 4 for details) and the results are presented in Fig. 1. The lower bound on the fidelity of the extracted state is essentially a straight line and strongly resembles the best currently known bound for the CHSH inequality (cf. Fig. 1 in Ref. [33]). Certifying randomness.-We have so far focused solely on certifying quantum properties like anticommutation of observables or presence of a particular quantum state. Let us now study the amount of randomness that can be certified based on the observed violation. In this case we focus on the Bell functional corresponding to α = 1, as it corresponds to the largest noise robustness. We consider the simplest device-independent scenario: the devices of Alice and Bob are produced by Eve whose goal is to predict the outcome of Alice for a particular fixed setting. It is well-known that in this case Eve does not gain anything by entangling herself with the device. In fact, if we only care about her guessing probability, she does not even need to keep any classical knowledge about the device. Certifying randomness reduces to investigating the trade-off between the bias of the local observables and the observed Bell violation and such trade-offs can be studied numerically using the Navascués-Pironio-Acín (NPA) hierarchy [49,50]. More specifically, we use the "1 + AB" level to investigate the maximal bias of A x for a fixed violation β (by symmetry the same constraints apply to the observables of Bob). To examine the tightness of the resulting bounds we find feasible points based on the family of quantum realisations presented above (see Appendix D for details). As shown in Fig. 2 the upper and lower bounds turn out to be relatively close.
The exact self-testing results stated above already im-ply that the maximal violation β = 5 forces all the observables to produce maximal randomness and this is precisely what we see from the numerical data. Randomness produced by A 0 and A 1 can be certified all the way down to the classical value β = 4. Randomness of A 2 , on the other hand, is only guaranteed for β > 2 √ 5 and we have indeed found a quantum realisation which achieves β = 2 √ 5 while keeping A 2 deterministic (see Appendix D 2). Clearly, A 0 and A 1 are better suited for generating randomness than A 2 . To get some intuition on whether this inequality is useful for the purpose of certifying randomness let us compare it with the CHSH inequality. To make a fair comparison suppose that we perform ideal measurements on the isotropic two-qubit state σ(η) := (1−η)Φ + +η1⊗1/4, where η ∈ [0, 1] is a noise parameter. We compare our numerical results with the well-known analytic trade-off for the CHSH inequality [40]. The noise robustness of the new inequality is not as good as that of CHSH, but as shown in Fig. 3 the qualitative behaviour appears rather similar.
Determining the minimal value of β for which the observable A x is guaranteed to generate randomness is equivalent to finding the largest Bell value consistent with A x = ±1. A related question is to determine the maximal value of β under the assumption that certain observables commute, a problem which can be tackled numerically by imposing some additional constraints on the NPA hierarchy. Numerical evidence suggests that: Except for the last two cases we can provide explicit twoqubit realisations which saturate these bounds (see Appendix D 2). These results suggest that this Bell inequality can be used to make device-independent conclusions about the incompatibility structure of the employed observables [51].
Conclusions and outlook.-Self-testing is an active research field and a particularly interesting direction is to explore its powers and limitations by deriving new types of self-testing statements or impossibility results. For instance we have recently learnt that one can self-test quantum channels [52], entangled measurements [53,54], quantum instruments [55] or that one can extend the concept of self-testing to prepare-and-measure scenarios [56][57][58][59][60][61]. In this work we derive a new type of self-testing statement which allows us to certify the state but not the measurements.
Until now self-testing of the state or randomness certification have only been shown for rigid Bell inequalities and so one might have conjectured rigidity to be necessary for these purposes. In this work we show, perhaps surprisingly, that the non-rigid nature of a Bell inequality does not prevent it from being a robust self-test of a quantum state or an efficient certificate for randomness.
The first question that follows from our work is whether there exist applications in which rigidity is actually strictly necessary. Can we find a natural and operational task in which non-rigid inequalities exhibit a qualitatively different behaviour? A different direction would be to look for even weaker forms of self-testing. The Bell inequalities considered in this work do not certify the entire quantum realisation, but at least uniquely determine the state. We are not aware of any bipartite Bell inequalities which are maximally violated by multiple inequivalent states, but if they exist, could they be used to make some even weaker form of self-testing statements? More generally, can we come up with other reasonable statements generalising the concept of self-testing and deviceindependent certification? Note added. While completing this work we became aware of Ref. [62], which investigates how self-testing and the geometry of the quantum set is affected by liftings. In the main text we have shown how to completely characterise arrangements of local observables which are capable of achieving the quantum value, but we have skipped some elementary steps. In this appendix we fill in the details of this argument.
Writing out L 1 ρ AB = 0 gives The fact that all the measurements are projective implies that Tracing out the register of Bob gives Since the reduced state ρ A is full-rank, we can right-multiply by ρ −1 A to obtain which can be rearranged to give Similarly, writing out (L 0 + L 2 )ρ AB = 0 gives which through an analogous argument leads to Combining this with the relation derived above gives We now choose the basis such that A 0 and A 1 are given by To find all valid solutions for A 2 we start by writing A 2 as for some Hermitian operators T 1 , T X , T Y , T Z acting on C d A . Equality {A 0 + A 1 , A 2 } = 0 immediately implies that T 1 = T X = 0. It is then easy to check that Since T Y and T Z commute, there exists a basis in which they are both diagonal and let us denote such a basis by {|a j } d A j=1 . The first condition implies that the eigenvalues of T Y and T Z can be expressed as cos u j and sin u j of some angle u j ∈ [0, 2π) and therefore cos u j |e j e j |,

This immediately implies that
which is precisely the form given in the main text.

Appendix B: Extraction channels
In this appendix we propose two explicit constructions of extraction channels tailored to the case of α = √ 2. The first one is an extension of the standard swap isometry given in Ref. [17], while the second one is a novel construction. The reason why new constructions are necessary is the fact that at least one of the extraction channels must depend on all three observables. At this point we are only interested in certifying the state, so we can without loss of generality assume that the measurements of Alice and Bob are projective (mapping non-projective measurements onto projective ones can always be seen as the first part of the extraction process).

Preliminaries
Let us start by proving two simple facts about binary observables. Both proofs rely crucially on Jordan's lemma, which states that two Hermitian operators satisfying R 2 = S 2 = 1 can be simultaneously block-diagonalised such that the resulting blocks are of size at most 2 × 2.
Lemma B.1. Let R, S be Hermitian operators acting on C d satisfying R 2 = S 2 = 1. Then, the operator Proof. Thanks to Jordan's lemma it suffices to consider observables acting on C 2 . Up to unitaries these can be parametrised as for θ ∈ [0, π/2]. For these operators a direct calculation shows that Now it suffices to check that |3 cos θ − cos 3θ| ≤ 2 √ 2 for all θ.
Let L(C d ) be the set of linear operators acting on C d .
Lemma B.2. Let R, S be Hermitian operators acting on C d satisfying R 2 = S 2 = 1. Then, the linear map Λ B : is completely positive.
Proof. To show that Λ B is completely positive we compute the corresponding Choi operator and prove that it is positive semidefinite. The unnormalised Choi operator is defined as where |Ω AB = d j=1 |j A |j B is the standard (unnormalised) maximally entangled state of local dimension d. An explicit calculation gives Since taking a (total) transpose does not affect the eigenvalues, it suffices to prove that C T ≥ 0 and note that because the operators E X , E Y , E Z are Hermitian. The fact that R and S can be written in a block-diagonal form where the blocks are of size at most 2 × 2 implies that the same property holds for E X , E Y and E Z . This means that to ensure that C T ≥ 0, it suffices to check positivity for all possible observables in d = 2. Using the parametrisation given in Eq. (B1) we obtain Clearly, this operator is diagonal in the Bell basis and the eigenvalues can be computed analytically. It is a simple exercise to check that the resulting trigonometric functions are non-negative on the interval θ ∈ [0, π/2].

Constructing an extraction channel from two observables
Here we present two distinct ways of constructing a qubit extraction channel out of two binary observables acting on an unknown Hilbert space. Let R and S be binary observables corresponding to projective measurements, i.e. Hermitian operators acting on C d satisfying R 2 = S 2 = 1. It is well-known that if the observables anticommute {R, S} = 0, they identify a qubit within C d . Our goal is to find simple constructions of linear maps which give rise to valid quantum channels for all choices of R and S, while for observables satisfying {R, S} = 0 extract the desired qubit.
Construction A. The standard swap isometry is defined through the following circuit: The circuit corresponds to a concatenation of an isometry V 1 : where H is the Hadamard matrix. It is easy to check that The combined isometry V : C d → C 2 ⊗ C d is given by V := V 3 V 2 V 1 and a direct computation shows that Let Λ A : L(C d ) → L(C 2 ) be the quantum channel obtained by first applying the isometry and then tracing out the second register: Writing the output of the channel in the Pauli basis gives If the observables anticommute {R, S} = 0, it is easy to see that the X component of the output qubit is perfectly correlated to the S observable on the initial system, while the Z component is perfectly correlated to the R observable.
For our purposes we need to generalise this construction. Suppose that the operator S instead of satisfying S 2 = 1 is only guaranteed to satisfy S 2 ≤ 1. Since 1 − S 2 ≥ 0, we can find a Hermitian operator T satisfying T 2 = 1 − S 2 . Then, consider where the Kraus operators are given by Clearly, this is a valid quantum channel. Let us now consider a swap circuit in which the unitary V 3 is replaced with the channel Φ 3 . It turns out that the resulting extraction channel is given precisely by Eq. (B2). In other words, this mathematical expression corresponds to a valid quantum channel for any S satisfying S 2 ≤ 1.
This map is clearly trace preserving, while complete positivity has been proved in Lemma B.2. This construction differs from the previous one in the sense that if {R, S} = 0, then the X component of the output qubit is maximally correlated to (R + S)/ √ 2, while the Z component is maximally correlated to (R − S)/ √ 2.

Combining the two channels
In the previous section we have given two constructions of extraction channels and let us now explain how they can be applied to our self-testing scenario.
An essential requirement is that the extraction channels produce a perfect maximally entangled state of two qubits whenever the violation is maximal. Our explicit characterisation of the optimal strategies implies that when the maximal violation is achieved we have Now if we recall how the X and Z components of the output qubit are correlated to the observables R and S of the input system in the two constructions we arrive at the following choice of extraction channels. Alice employs the channel Λ A corresponding to R = A 2 and The fact that S 2 ≤ 1 follows immediately from Lemma B.1. At the same time Bob employs the channel Λ B with R = B 0 and S = B 1 . Let us denote the output two-qubit state by and our goal is to evaluate the fidelity between σ A B and the standard maximally entangled state Φ + . Since Φ + is a pure state, we have It is convenient to write Φ + in the basis of Pauli matrices and evaluate each term separately. A direct calculation shows that for P ∈ {X, Y, Z} we have Conveniently, it is not necessary to provide bounds on all three terms, because for every two-qubit state τ A B we have To see this note that applying a correlated Pauli twirl to τ A B produces a Bell-diagonal state without affecting the coefficients of the terms X ⊗ X, Y ⊗ Y and Z ⊗ Z (see Lemma 10 in the supplementary information of Ref. [63] for more details). Positivity of the resulting density matrix immediately implies the condition given in Eq. (B3). This means that In Appendix C 3 we derive analytic lower bounds on C X , ρ AB and C Z , ρ AB in terms of the observed violation, which lead to Theorem 2 in the main text. Analogously, for every two-qubit state we have which implies that This bound turns out to be more useful for the numerical calculations using the swap method given in Appendix C 4.

Appendix C: Robust self-testing
In this appendix we derive robust self-testing bounds for the case of α = √ 2. In the first part we derive analytic statements, whereas at the end we give some details on the numerical calculations performed using the swap method.

Preliminaries
Our main task is to bound norms of certain operators. We denote the Frobenius norm (Schatten 2-norm) by || · || F and the operator norm (Schatten ∞-norm) by || · || ∞ . Let us first state a couple of facts which we will take advantage of in the argument.
The Cauchy-Schwarz inequality for linear operators X and Y reads We will often use this inequality in situations where one of the operators is a normalised quantum state. Note that then we have L, ρ = Lρ 1/2 , ρ 1/2 , which implies Moreover, we will use the fact that This can be easily seen from the fact that ||XY || 2 F = tr(XY Y † X † ) ≤ ||Y || 2 ∞ tr(XX † ) = ||Y || 2 ∞ · ||X|| 2 F , where we have used the fact that Y Y † ≤ ||Y || 2 ∞ 1 and that A ≥ B implies tr A ≥ tr B. We will also use the reverse triangle inequality which states that for any norm we have Moreover, if X 2 = 1, then

Conditions from the sum-of-squares decomposition
Recall that for α = √ 2 we have Clearly, if the observed violation equals β = W, ρ AB = 6 − ε, we can immediately deduce that The latter implies that for j = 0, 1, 2.

Analytic self-testing bounds
In this section we derive several robust self-testing statements. The techniques are elementary, but the proofs can be lengthy. To improve the readability we have divided the argument up into several lemmas.
Lemma C.1. If the observed violation is close to maximal, then the observables A 0 and A 1 approximately anticommute and, moreover, the operators (A 0 − A 1 ) and B 2 are almost perfectly correlated. More specifically, if W, ρ AB = 6 − ε, then Proof. Eq. (C6) applied to L 1 implies that If we multiply the operator under the norm by √ 2 1 ⊗ B 2 and then apply Eq. (C3) we conclude that Alternatively, if we multiply the same operator by (A 0 − A 1 ) ⊗ 1, we obtain These two inequalities allow us to apply the reverse triangle inequality to AB , which gives the first inequality stated in the lemma. Inequality (C7) together with the variant of the Cauchy-Schwarz inequality stated in Eq. (C2) gives the second inequality stated in the lemma.
Corollary C.1. Since the Bell inequality is symmetric with respect to swapping Alice and Bob, we immediately deduce that if W, ρ AB = 6 − ε, then Lemma C.2. If the observed violation is close to maximal, then the operators (A 0 + A 1 ) and (B 0 + B 1 ) are almost perfectly correlated. More specifically, if W, ρ AB = 6 − ε, then Proof. Eq. (C6) applied to L 0 implies that If we multiply the operator under the norm by 1 ⊗ (B 0 + B 1 ) and then apply Eq. (C3) we conclude that This together with Corollary C.1 allow us to apply the reverse triangle inequality to which gives Applying the Cauchy-Schwarz inequality given in Eq. (C2) concludes the proof.
Lemma C.3. If the observed violation is close to maximal, then the operators (A 0 + A 1 ) and A 2 approximately anticommute. More specifically, if W, ρ AB = 6 − ε, then Proof. Note that Multiplying the operator under the norm by 2B 0 gives Alternatively, multiplying it by gives Since we can apply the reverse triangle inequality to One last application of the reverse triangle inequality combined with the first result of Lemma C.1 gives the final result.
In the last two lemmas we bound the inner products appearing in the fidelity expression given in Eq. (B4).
Lemma C.4. If the observed violation is close to maximal, then the inner product C X , ρ AB is close to unity. More specifically, if W, ρ AB = 6 − ε, then Proof. Let and note that the operator C X can be written as Therefore, The second term we can already bound since the Cauchy-Schwarz inequality and the fact that The first factor can be bounded by In the second step we write , ρ AB is precisely the term we have bounded in Lemma C.2.
To show that all the other terms approximately vanish we apply inequalities (C2) and (C3) to obtain For j = 1, 2 we have For j = 3 we use inequality (C5) to obtain Similarly, for j = 4, 5 we have Collecting all the error terms and plugging in the bounds derived in Lemmas C.1 and C.3 and Corollary C.1 leads to the desired inequality.
Lemma C.5. If the observed violation is close to maximal, then the inner product C Z , ρ AB is close to unity. More specifically, if W, ρ AB = 6 − ε, then Proof. Note that the expression for C Z can be written as which immediately implies that where we have used the Cauchy-Schwarz inequality combined with the observation that Plugging in the bounds derived in Corollary C.1 gives the final result of the lemma.

Details of the numerical calculation using the swap method
We construct a 100 × 100 moment matrix Γ, whose rows/columns correspond to P j |ψ , where P j is a monomial from the set {1, A x , A x A x } ⊗ {1, B y , B y B y }. We impose the equality conditions resulting from A 2 x = 1 and B 2 y = 1, the normalisation condition Γ jj = 1 for all j and positivity Γ ≥ 0. Then we minimise subject to a fixed Bell violation β = t for various values of t ∈ [5.7, 6]. Inequality (B6) leads to the lower bound on the fidelity presented in Fig. 1.
Note that this moment matrix is not sufficient to obtain a bound on C X , ρ AB , because it does not contain strings of A x operators of sufficient length. Therefore, if we want to bound the fidelity using the inequality given in Eq. (B4) or bound all three terms simultaneously, we must construct a larger moment matrix. While we have been able to construct a larger moment matrix, we were not able to perform the numerical optimisation on it.

Appendix D: Randomness certification
In this appendix we explain the approach we have used to study the amount of randomness generated by the Bell inequality corresponding to α = 1.

The trade-off between marginals and the Bell violation
To compute the upper bounds plotted in Fig. 2 we construct a 16 × 16 moment matrix Γ whose rows/columns correspond to {|ψ , A x ⊗ 1|ψ , 1 ⊗ B y |ψ , A x ⊗ B y |ψ }. We maximise the expectation value A x subject to a fixed Bell violation β = t for various choices of t ∈ [4,5].
To find feasible points we start with some optimal arrangement of the observables for Alice and Bob (as given in the main text) and consider a tilted version of the Bell operator: rA x ⊗ 1 + W for some r ≥ 0. Finding the eigenvector corresponding to the largest eigenvalue gives a particular realisation for which typically β = W < 5 and A x > 0. By generating a sufficient number of points and then taking their convex hull we construct the lower curves presented in Fig. 2.

Maximal violation under commutation constraints
Here we present two explicit realisation that saturate the conjectured bounds stated in the main text. For [A 0 , A 1 ] = 0 consider the observables It is easy to verify that W, Φ + = 2 √ 5. Note that this realisation also satisfies [B 0 , B 2 ] = [B 1 , B 2 ] = 0. Moreover, it shows that the value β = 2 √ 5 is consistent with B 2 = 1 (and by symmetry with A 2 = 1).