{"id":"afc4f50d-9a4b-4b68-80b1-8d55c883f957","arxiv_id":"2506.18888","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"The paper releases a reproducible Python and GUI toolkit that builds min-tradeoff functions via semidefinite programming and computes finite-size EAT security bounds for DI-QRNG and DI-QKD.","lead":"This paper presents a Python software framework, expdiqrng, that automates finite-size security analyses for quantum random number generation and quantum key distribution using the Entropy Accumulation Theorem. The framework includes both an API and a graphical user interface, with two worked examples showing how to compute secure randomness and key rates under finite-resource assumptions.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The package's security certificates depend on unvalidated floating-point dual SDP solutions; a small dual infeasibility would silently invalidate the EAT entropy bound.","rationale":"The reader's negative assessment was CONDITIONAL with the weakest assumption being the lack of certified SDP dual solutions and correct EAT implementation. My stress-test isolates the dual-certificate step as the single most load-bearing requirement: all EAT outputs in Section IV and V are trustworthy only if the min-tradeoff function is a genuine lower bound. The manuscript gives no evidence that the dual solutions are feasible, exact, or independently validated, so the stated security guarantee is not yet established. I considered other candidate concerns: the misleading 'net gain' terminology, the apparent outcome-2 inconsistency in the QKD data config, and the large min-tradeoff diameter of 66.26. These are real usability or tightness issues but they do not threaten the validity of the security proof as directly as an uncertified dual certificate. The proposed high-precision re-solve is a low-cost, decisive check: it directly tests the feasibility and accuracy of the exact certificate used in the headline example. If the check passes, the conditional verdict could eventually be upgraded to acceptance after similar checks on the CHSH case; if it fails, the central claim is refuted for the presented examples. I therefore leave the reader's CONDITIONAL verdict unchanged and agree that this is the weakest assumption.","tokens_in":16357,"tokens_out":23759,"duration_ms":252610,"concrete_test":"Re-run the Section IV modCHSH workflow with identical inputs, but replace the internal SDP solve of the min-tradeoff computation by an independent arbitrary-precision solve of the same NPA/BFF relaxation using SDPA-GMP. Verify dual feasibility of the returned solution to residual tolerance 1e-8 and compare the package's stored min-tradeoff constant term (1.088404255614198) and certificate value (1.4368663908110753) to the high-precision feasible values. If the dual is infeasible, or if the package's values exceed the high-precision values by more than 1e-6, the min-tradeoff function is not a certified lower bound and the EAT rates in Listing 8 are not valid.","verdict_should_be":"UNCHANGED","load_bearing_attack":"To deliver on its central claim, expdiqrng must construct min-tradeoff functions that are valid lower bounds on the per-round conditional entropy appearing in the EAT bound (7). The manuscript states only that min-tradeoff functions are calculated using dual SDP solutions, referring to Section 3.4 of [25]; it does not specify the conditions under which a floating-point dual solution yields a feasible dual certificate, nor does it describe any post-processing (residual checks, interval arithmetic, exact rational reconstruction) to certify that certificate. Mainstream SDP solvers wrapped by ncpol2sdpa return approximate solutions with default tolerances; a dual that is infeasible at the 1e-8 level is enough to make the affine function f(p) overestimate the true entropy for some distribution consistent with the observed data, which would invalidate the security bound without changing any printed output in Listings 6-8. This is load-bearing because every reported rate, in both the QRNG and QKD case studies, inherits its validity from this single unverified certificate. The manuscript also offers no independent validation: no test suite, no comparison with known analytical bounds, and no machine-checked proof. The Markov condition, variance terms, and EAT parameter handling are downstream; if the min-tradeoff certificate is not sound, the rest of the pipeline cannot repair it.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript introduces expdiqrng, a Python framework (with a GUI) for finite-size security analysis of device-independent QRNG and QKD protocols using the Entropy Accumulation Theorem (EAT). The framework is designed to construct min-tradeoff functions from semidefinite programming relaxations (NPA and BFF) and to feed them into an EAT-based rate calculation. Two case studies are presented: a modCHSH QRNG example using min-entropy through the API, and a CHSH QKD example using von Neumann entropy through the GUI. The authors state that the source code is publicly available and argue that the tool lowers the skill barrier for rigorous quantum cryptographic analysis.","tokens_in":16635,"tokens_out":14918,"duration_ms":153463,"significance":"If the numerical security certificates are sound, this is a useful and timely contribution: it packages the EAT pipeline with a GUI, public code, and step-by-step examples, which is valuable for experimentalists. The modular design and the reliance on established SDP hierarchies (NPA and BFF) are strengths, as is the explicit use of the Brown et al. EAT formulation. However, the central claim depends critically on unstated numerical certification of the SDP dual solutions, and the QKD example raises a serious question about which entropy quantity is actually bounded. With those issues resolved, the tool could have real impact; as written, the security guarantees are not sufficiently evidenced.","major_comments":[{"comment":"The only description of the core certificate construction is that \"min-tradeoff functions were calculated using the dual SDP solutions, as described in Section 3.4 of [25]\". A floating-point dual solution returned by ncpol2sdpa is not automatically a feasible dual certificate for the NPA/BFF relaxation; if the dual is infeasible at the solver tolerance, the affine function f can overestimate the true conditional entropy for some distribution consistent with the observed data, which would invalidate the EAT bound (7) without changing any printed output. The manuscript must specify the exact SDP and dual variables used, the solver and tolerances, and any post-processing that certifies feasibility (e.g., residual checks, interval arithmetic, or exact rational reconstruction), and it should provide a way for the user to verify each certificate. No test suite, independent analytical comparison, or existing-software comparison is currently reported, so the central claim in the abstract is not yet supported.","section":"Section III, Section IV C, Appendix A"},{"comment":"The Devetak-Winter rate in Eq. (11) is r = H(A|E) - H(A|B), but the min-tradeoff function in Definition 2 and the BFF relaxation in Appendix A are stated for the joint quantity H(A_iB_i|X_iY_iR') / H(Q_AQ_B|...E). The QKD example subtracts H(A|B)=0.01 from a min-tradeoff certificate value of 0.979964 and treats the result as the asymptotic key rate. This is only valid if the certificate already lower-bounds H(A_i|X_iY_iE). If the certificate bounds the joint entropy, the computed expression is H(A_i|E)+H(B_i|A_iE)-H(A_i|B_i), which does not generally lower-bound the true Devetak-Winter rate. Please clarify which entropy quantity the package computes for \"Key Distribution\", and either correct the example or re-derive the key-rate formula.","section":"Section V, Eq. (11), Definition 2, Appendix A"},{"comment":"The headline output is called net_gain_per_second and is described as the \"actual secure randomness generation rate\", yet the printed parameters include subtract_consumption_for_test_rounds: False, and the text explicitly states that the 2.585 bits per round of input randomness are not subtracted. For a randomness expansion protocol, input randomness consumption is part of the net gain calculation; reporting 947,239 bits/s as a \"net gain\" while assuming free input randomness is misleading. Rename the quantity (e.g., gross generation rate) or change the example to subtract the consumption and report a true net expansion rate.","section":"Section IV F, Listing 8"}],"minor_comments":[{"comment":"The set Gamma appearing in Var[f|Gamma], Min[f|Gamma], and d_f is never defined. Define it (e.g., as the set of distributions compatible with the protocol constraints and the event Omega) so the formulas are self-contained.","section":"Section II E, Eq. (9)"},{"comment":"The variable confidence_interval_list takes the value 0.99 and is used as p_Omega; the name is nonstandard and could be confused with a statistical confidence interval. Rename it to pOmega or explain the correspondence with the completeness level.","section":"Section II B, Listing 5"},{"comment":"The example data rows do not clearly match the described parsing schema: the text says the first column identifies settings by values 1, 2, 3, 4, while the listed file appears to contain rows with first-column values such as 2 and 73. Please supply a self-consistent sample file or explicitly state the column mapping for the printed rows.","section":"Section V, Listing 10"},{"comment":"Provide a versioned release (or DOI) and list the exact versions of Python, ncpol2sdpa, and the SDP solver used to produce Listing 8 and the GUI results, so that the numerical outputs are reproducible.","section":"Data availability"},{"comment":"Reference [12] is marked \"to appear\" although it is dated 2021; update the citation, and check [11] and [25] for final published versions.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper is a software/tool contribution. The main technical risk is the unverified SDP certificate, and the QKD example raises a specific concern about whether the min-tradeoff function bounds H(A|E) or H(AB|E). If the authors can certify the numerical outputs and correct the QKD entropy accounting, the tool would be a useful addition. The editor may wish to request an independent check of the QKD rate calculation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know about this paper. First, it is a software contribution, not a theory one: expdiqrng looks like the first integrated Python API plus GUI for EAT-based finite-size analysis of DI-QRNG/QKD, automating min-tradeoff construction via NPA/BFF and running the full EAT pipeline. Second, the security numbers it prints are only as trustworthy as the dual SDP solutions used to build the min-tradeoff functions, and the paper never shows those certificates are feasible.\n\nWhat is genuinely new is the integration itself. The package ties together data parsing, Bell-expression configuration, NPA/BFF relaxations, min-tradeoff construction, and EAT rate calculation in one modular codebase, with two concrete walkthroughs (modCHSH QRNG and CHSH QKD). The EAT formulas are taken faithfully from Brown–Ragy–Colbeck, and the BFF appendix is accurate. For experimentalists who do not want to reimplement EAT from scratch, this is a real time-saver.\n\nThe load-bearing soft spot is exactly what the stress-test note flags. The paper says min-tradeoff functions are \"calculated using the dual SDP solutions\" and cites Section 3.4 of [25], but it never explains how those floating-point duals from ncpol2sdpa are certified. Mainstream solvers return approximate solutions; a dual that is infeasible at the 1e-8 level would let the affine f(p) overestimate the true conditional entropy on some distributions, and every EAT rate in the paper would be silently wrong. That is not a hypothetical concern for a security tool. There are no residual checks, no interval arithmetic, no comparison with known analytical bounds, and no test suite. This is fixable, but it must be fixed before the package is promoted as rigorous.\n\nA smaller issue: the QRNG example calls the output \"net gain per second,\" yet the code sets subtract_consumption_for_test_rounds=False and the paper itself says the output is gross, assuming input randomness is free. For a randomness expansion protocol, that is misleading; the roughly 2.585 bits consumed per round should be subtracted for a true net rate. That is a labeling fix, not a conceptual one.\n\nFinally, the paper does not give a commit hash or version pin, so the reproducibility claim is hard to evaluate from the text alone, though the GitHub repository may include tests.\n\nOverall, the central design is sound and the examples are plausible, but the security certificates need independent validation. I would send this to peer review: a referee can install the package, run the examples, and check whether the duals actually satisfy the SDP constraints. The revision should add a validation section and clarify the net-vs-gross terminology.","headline":"A genuinely useful EAT software framework whose security numbers rest on unverified floating-point dual SDP solutions—worth refereeing, but only after the authors certify their certificates.","tokens_in":17163,"tokens_out":2761,"would_cite":true,"duration_ms":31223,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The expdiqrng package claims to automate finite-size security analysis for quantum random number generation and quantum key distribution, constructing min-tradeoff functions via semidefinite programming and applying the Entropy…","keywords":["quantum cryptography","entropy accumulation theorem","finite-size security analysis","min-tradeoff function","semidefinite programming","device-independent quantum key distribution","quantum random number generation","graphical user interface"],"falsifier":"Take a CHSH instance with very few rounds, say $n=3$, exhaustively search the quantum strategy space compatible with the observed correlations, compute the exact smooth min-entropy by direct enumeration, and check that the package's reported finite-size bound never exceeds that value; a single counterexample would show the automated certificate pipeline is unsound.","tokens_in":16139,"feed_emoji":"🔐","tokens_out":15268,"duration_ms":138885,"temperature":0.7,"pith_summary":"The paper presents an open-source Python package, expdiqrng, whose central claim is that finite-size security analysis for quantum random number generation and quantum key distribution -- including device-independent protocols that do not trust the hardware -- can be fully automated. Given a Bell expression, observed data, and a handful of protocol parameters, the package constructs a valid min-tradeoff function, an affine lower bound on the per-round conditional entropy, by solving semidefinite relaxations, and then feeds it into the Entropy Accumulation Theorem, a framework that turns per-round bounds into a total finite-size security guarantee. If the claim holds, experimentalists who would otherwise face a steep mathematical barrier can compute trustworthy randomness and key rates directly from raw experimental counts. The paper supports the claim with two end-to-end case studies, one based on the modified CHSH Bell expression and one on the standard CHSH scenario, and reports concrete finite-size rates in both.","feed_headline":"Python package certifies finite-size quantum randomness","feed_subtitle":"It constructs the mathematical security certificates automatically, so experimentalists skip the hardest proof step.","key_machinery":"The load-bearing object is the min-tradeoff function, an affine map $f$ from observed per-round statistics to a lower bound on the conditional von Neumann entropy $H(A_iB_i|X_iY_iE)$ for any state consistent with those statistics. The package obtains $f$ by solving a semidefinite program -- an NPA-type hierarchy, a chain of relaxations approximating the quantum correlation set, or a quadrature-based relaxation for von Neumann entropy -- and reading the dual solution, so the function is a certificate rather than a heuristic fit. The EAT channel structure with the Markov condition lets this per-round bound accumulate over $n$ rounds into the smooth min-entropy bound $H^{\\epsilon_s}_{\\min}(A^nB^n|X^nY^nE) > nt - n(\\epsilon_V+\\epsilon_K) - \\epsilon_\\Omega$. The free parameter $\\beta$ balances the variance and completeness penalties, and the package sweeps $\\beta$, the test-round probability $\\gamma$, and the data-chunk time to report the optimal secure rate.","core_discovery":"The central claim is that a single software pipeline can take a raw click table from a QRNG or QKD experiment and return an EAT-based finite-size security bound with no manual derivation of the difficult objects. The package builds the min-tradeoff function from the dual solution of an NPA-type or quadrature-based semidefinite relaxation, then evaluates the EAT bound $H^{\\epsilon_s}_{\\min}(A^nB^n|X^nY^nE) > nt - n(\\epsilon_V+\\epsilon_K) - \\epsilon_\\Omega$, where $t$ is the min-tradeoff function's value at the observed frequency and the three $\\epsilon$ terms are finite-size penalties. In the modCHSH QRNG example, the asymptotic rate of about 1.4369 bits per event falls to roughly 947,240 secure bits per second at $10^6$ events per second after one hour of data, with smoothing $\\epsilon_s=10^{-12}$ and completeness $p_\\Omega=0.99$. In the CHSH QKD example, an asymptotic key rate near 0.96 bits per event yields about $8\\times10^8$ key bits per second at roughly $10^9$ events per second on a ten-second data chunk. The authors also demonstrate the graphical workflow, from parsing data files to plotting how key rate depends on the protocol parameters.","pith_inferences":["Beyond the paper's own examples, exporting the raw primal and dual solver certificates alongside each rate would let anyone independently verify the security bound, since the entire argument rests on those dual solutions.","A natural test is to benchmark the automatically generated min-tradeoff function against known analytical constructions, such as tilted CHSH bounds; the gap would quantify how much rate the generic SDP route sacrifices for automation.","The same modular pipeline could extend to multi-party or multi-outcome Bell scenarios: the EAT machinery is not specific to two-party CHSH, but the semidefinite relaxations would need to be rebuilt."],"forward_implications":["An experimental group can turn a raw count table into a certified finite-size randomness rate without writing EAT code, either through the Python API or the graphical interface.","The automated parameter sweep lets users see how the secure rate depends on test-round probability, smoothing, and collection time, so they can choose an operating point to maximize output under their own noise and time budget.","Both min-entropy (for QRNG) and von Neumann entropy (for QKD) are supported, with the QKD error-correction leakage included in the rate calculation.","Because the certificate is built from a dual semidefinite solution, the same framework can accommodate arbitrary linear combinations of correlators and marginal probabilities, which can certify more randomness than a single Bell inequality."],"supporting_citations":[{"why":"States the Entropy Accumulation Theorem that the whole finite-size bound relies on.","marker":"[8]"},{"why":"Supplies the device-independent randomness expansion framework and the min-tradeoff construction whose notation and formulas the package follows.","marker":"[11]"},{"why":"Provides the improved second-order entropy-accumulation term used in the finite-size correction.","marker":"[12]"},{"why":"Defines the semidefinite relaxations whose dual solutions are used to construct the min-tradeoff functions.","marker":"[23–25]"},{"why":"Introduces the quadrature-based semidefinite relaxation used to certify von Neumann entropy.","marker":"[26]"},{"why":"Shows that using complete measurement statistics rather than a single Bell inequality can certify more randomness, which the package supports.","marker":"[27, 28]"},{"why":"Supplies the Bell-certified randomness methodology and the statistical error-bar method used to estimate Bell expressions from data.","marker":"[5]"}],"fun_headline_variants":["Automate EAT-based security proofs for QKD and QRNG","GUI-driven Python framework for finite-size quantum security","Turn click tables into proven randomness and key rates","Skip the hardest proof: Python does EAT security bounds","Finite-size quantum security bounds without the math grind"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The security numbers stand or fall with the numerical semidefinite solver: if its dual solution is not a true feasible lower bound, or if the protocol's relaxation is mis-specified, the reported rate can overstate the certified randomness.","fun_headline_variants_meta":{"raw":{"variants":["Automate EAT-based security proofs for QKD and QRNG","GUI-driven Python framework for finite-size quantum security","Turn click tables into proven randomness and key rates","Skip the hardest proof: Python does EAT security bounds","Finite-size quantum security bounds without the math grind"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000231,"raw_usage":{"total_tokens":1521,"prompt_tokens":1016,"completion_tokens":505,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":632,"completion_tokens_details":{"reasoning_tokens":427}},"tokens_in":632,"tokens_out":505,"duration_ms":4870,"temperature":1.0,"reasoning_tokens":427,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:40:51.692821+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a CHSH instance with very few rounds, say $n=3$, exhaustively search the quantum strategy space compatible with the observed correlations, compute the exact smooth min-entropy by direct enumeration, and check that the package's reported finite-size bound never exceeds that value; a single counterexample would show the automated certificate pipeline is unsound.","supporting_citations":[{"cited_title":"Random numbers certified by Bell’s theorem,","cited_arxiv_id":null,"evidence_quote":"States the Entropy Accumulation Theorem that the whole finite-size bound relies on."},{"cited_title":"Entropy accu- mulation,","cited_arxiv_id":null,"evidence_quote":"Supplies the device-independent randomness expansion framework and the min-tradeoff construction whose notation and formulas the package follows."},{"cited_title":"Bounding the set of quantum correlations,","cited_arxiv_id":null,"evidence_quote":"Introduces the quadrature-based semidefinite relaxation used to certify von Neumann entropy."},{"cited_title":"The security of practical quantum key distribution,","cited_arxiv_id":null,"evidence_quote":"Supplies the Bell-certified randomness methodology and the statistical error-bar method used to estimate Bell expressions from data."}],"review_version":1}