Abstract
Bipartite and multipartite entangled states are basic ingredients for constructing quantum networks and their accurate verification is crucial to the functioning of the networks, especially for untrusted networks. Here we propose a simple approach for verifying the Bell state in an untrusted network in which one party is not honest. Only local projective measurements are required for the honest party. It turns out each verification protocol is tied to a probability distribution on the Bloch sphere and its performance has an intuitive geometric meaning. This geometric picture enables us to construct the optimal and simplest verification protocols, which are also very useful to detecting entanglement in the untrusted network. Moreover, we show that our verification protocols can achieve almost the same sample efficiencies as protocols tailored to standard quantum state verification. Furthermore, we establish an intimate connection between the verification of Greenberger–Horne–Zeilinger states and the verification of the Bell state. By virtue of this connection we construct the optimal protocol for verifying Greenberger–Horne–Zeilinger states and for detecting genuine multipartite entanglement.
Introduction
Entanglement is the characteristic of quantum mechanics and key resource in quantum information processing^{1,2,3}. As typical examples of bipartite and multipartite entangled states, the Bell state and Greenberger–Horne–Zeilinger (GHZ) states^{4,5} play crucial roles in numerous quantum information processing tasks and in foundational studies, such as quantum teleportation^{6,7,8}, quantum key distribution^{9,10}, quantum random number generation^{11}, and nonlocality tests^{12,13}. Furthermore, as a special example of graph states^{14}, GHZ states are useful to constructing quantum networks^{15,16} designed for distributed quantum information processing, such as quantum secret sharing^{17,18}, quantum conference key agreement^{19}, and distribution^{20}.
To guarantee the proper functioning of a quantum network, it is essential to verify the entangled state deployed in the network accurately and efficiently, especially for untrusted networks^{21,22,23,24,25,26,27,28,29}. This scenario has wide applications in quantum information processing, such as onesided deviceindependent (DI) quantum key distribution^{30}, anonymous communication^{31,32}, and verifiable quantum secure modulo summation^{33}. Meanwhile, this problem is tied to the foundational studies on quantum steering in the asymmetric scenario^{3,34,35,36} and the uncertainty principle in the presence of quantum memory^{37,38}.
Unfortunately, not much is known about quantum verification in untrusted networks despite its significance. This is because not all parties in the networks are honest, and the verification problem gets much more complicated in the presence of dishonest parties. In particular, traditional tomographic approaches are not applicable in the network setting even if their low efficiency is tolerable. Also, most alternative approaches, including direct fidelity estimation^{39} and quantum state verification (QSV)^{40,41,42,43,44,45}, are not applicable, although QSV can address the adversarial scenario in which the source is not trustworthy^{43,44,45}. DI QSV^{46} based on selftesting^{22,47,48,49,50,51,52} can be applied in the network setting in principle, but is too resource consuming and too demanding with current technologies. For the Bell state and GHZ states, optimal verification protocols are known when all parties are honest^{42,53,54,55,56,57,58}. In the network setting, however, only suboptimal protocols are known in the literature^{23,24,25,26,29}.
In this paper, we propose a simple approach for verifying the Bell state over an untrusted network in the semideviceindependent (SDI) scenario in which one party is not honest. Only local projective measurements are required for the honest party. In addition, we establish a simple connection between verification protocols of the Bell state and probability distributions on the Bloch sphere and reveal an intuitive geometric interpretation of the performance of each verification protocol. By virtue of this geometric picture, we construct the optimal and simplest protocols for verifying the Bell state, which can also be applied to detecting entanglement in the untrusted network. Moreover, we determine the sample efficiencies of our SDI verification protocols in addition to the guessing probabilities.
Furthermore, we establish an intimate connection between the verification of GHZ states and the verification of the Bell state. Thanks to this connection, efficient protocols for verifying GHZ states can easily be constructed from the counterparts for the Bell state. Notably, this connection enables us to construct the optimal protocol for verifying GHZ states and for detecting genuine multipartite entanglement (GME). To put our work in perspective, we also provide a detailed comparison between SDI QSV considered in this work and standard QSV as well as DI QSV based on selftesting. For the Bell state and GHZ states, SDI verification can achieve almost the same sample efficiency as standard QSV; by contrast, the sample efficiency in the DI scenario is in general quadratically worse in the infidelity unless there exists a suitable Bell inequality for which the quantum bound coincides with the algebraic bound.
Results
Verification of the Bell state
Suppose two distant parties, Alice and Bob, want to create the Bell state \(\left{{\Phi }}\right\rangle =(\left00\right\rangle +\left11\right\rangle )/\sqrt{2}\) as follows: Bob first prepares \(\left{{\Phi }}\right\rangle\) in his lab and then sends one particle of the entangled pair to Alice using a quantum channel. To verify this state Alice can perform a random projective measurement from a set of accessible measurements and then ask Bob to guess the measurement outcome given the measurement chosen. Each projective measurement is specified by a unit vector r on the Bloch sphere, which specifies the two outcomes \({P}_{\pm }=({\mathbb{I}}\pm {{{\boldsymbol{r}}}}\cdot {{{\boldsymbol{\sigma }}}})/2\), where σ is the vector composed of the three Pauli matrices. If Bob is honest and prepares the target state \(\left{{\Phi }}\right\rangle\), then his reduced states corresponding to the two outcomes P_{+} and P_{−} have mutually orthogonal supports, so he can guess the measurement outcome with certainty by performing a suitable projective measurement.
If Bob is not honest and tries to prepare a different state ρ instead of \(\left{{\Phi }}\right\rangle\), then his guessing probability—the probability of successful guess—would be limited. In this case, Alice cannot distinguish two states that can be turned into each other by local operations of Bob; nevertheless, she can verify whether the state prepared is indeed \(\left{{\Phi }}\right\rangle\) up to these local operations. Let \({\rho }_{\pm }={{{\mathrm{tr}}}}_{A}(\rho {P}_{\pm })\) be the unnormalized reduced states of Bob. To guess the measurement outcome of Alice, Bob can perform a twooutcome POVM {E_{+}, E_{−}} to distinguish ρ_{+} and ρ_{−}. By the Helstrom theorem^{59}, the maximum guessing probability γ(ρ, r) over all POVMs (or projective measurements) is given by the formula γ(ρ, r) = (1 + ∣ρ_{+} − ρ_{−}∣∣_{1})/2.
Recall that a general twoqubit state has the form
where σ_{j}, σ_{k} are Pauli matrices (also denoted by X, Y, Z), a and b are the Bloch vectors of the two reduced states, and T is the correlation matrix. If ρ is pure, then we can deduce (cf. Supplementary Note 1),
To understand the geometric meaning of γ(ρ, r), note that the set of vectors \(\{\sqrt{T{T}^{{{{\rm{T}}}}}}\ {{{\boldsymbol{r}}}}: {{{\boldsymbol{r}}}} =1\}\) forms a rotational ellipsoid, which is called the correlation ellipsoid and denoted by \({{{{\mathscr{E}}}}}_{\rho }\) (cf. the steering ellipsoid^{60,61}), as illustrated in Fig. 1. The semimajor axis v and semiminor axis of \({{{{\mathscr{E}}}}}_{\rho }\) have length 1 and C, respectively, where C is the concurrence of ρ^{1,62}. In addition, the radius \(  \sqrt{T{T}^{{{{\rm{T}}}}}}\ {{{\boldsymbol{r}}}} \) is determined by C and the angle between r and the semimajor axis as follows,
A verification strategy of Alice is determined by a probability distribution μ on the Bloch sphere, which specifies the probability of performing each projective measurement. Given the strategy μ and the state ρ, the maximum average guessing probability of Bob reads
where the bias is a weighted average of radii of the correlation ellipsoid. Denote by γ_{2}(C, μ) the maximum guessing probability over all pure states with concurrence at most C. Note that maximizing γ(ρ, μ) for a given concurrence amounts to choosing a proper orientation of the correlation ellipsoid so as to maximize the weighted average of radii, as illustrated in Fig. 1. This intuition leads to the following theorem as proved in Supplementary Note 1.
Theorem 1
Suppose 0 ≤ C ≤ 1; then
where the maximization in Eq. (6) is over all unit vectors.
Any unit vector v that maximizes the integration in Eq. (6) is called an intelligent direction. For a given concurrence, the guessing probability is maximized when the major axis of the correlation ellipsoid parallels an intelligent direction. When C = 1, the correlation ellipsoid is a sphere, in which case Theorem 1 yields g(C, μ) = 1 and γ_{2}(C, μ) = 1. When C = 0, the correlation ellipsoid reduces to a line segment, in which case we can deduce
Notably, entanglement can be certified in the shared system when the guessing probability surpasses the threshold \({\gamma }_{2}^{* }(\mu )\). The relation between the guessing probability and concurrence for various verification protocols is illustrated in Fig. 2.
Alternative strategies of the adversary
So far we have assumed that the state ρ prepared by Bob is a twoqubit pure state and \({\rho }_{A}:= {{{\mathrm{tr}}}\,}_{B}(\rho )\) is supported in the local support of the target Bell state, that is, the subspace spanned by \(\left0\right\rangle\) and \(\left1\right\rangle\). Can Bob gain any advantage if ρ_{A} is not supported in this subspace? The answer turns out to be negative. Now Alice can first perform the projective measurement \(\{{P}_{A},{\mathbb{I}}{P}_{A}\}\) with \({P}_{A}=\left0\right\rangle \left\langle 0\right+\left1\right\rangle \left\langle 1\right\) and then apply a verification protocol as before if she obtains the first outcome and reject otherwise. The maximum guessing probability γ(C, μ) of Bob for any pure state with C(ρ) ≤ C is the same as before as shown in the following lemma and proved in Supplementary Note 3.
Lemma 1
γ(C, μ) = γ_{2}(C, μ) for 0 ≤ C ≤ 1.
Note that γ(C, μ) = 1 when C ≥ 1, in which case Bob can prepare the target Bell state. So we can focus on the case 0 ≤ C ≤ 1. Define γ^{*}(μ) ≔ γ(0, μ), then \({\gamma }^{* }(\mu )={\gamma }_{2}^{* }(\mu )\) thanks to Lemma 1, so the threshold for entanglement detection remains the same as before; cf. Eq. (8). In conjunction with the convexity of γ_{2}(C, μ) in C (cf. Lemma S1 in Supplementary Note 2), Lemma 1 implies that
which offers the best linear upper bound for γ(C, μ). When the distribution μ is clear from the context, γ^{*}(μ) is abbreviated as γ^{*} for simplicity.
Above results can be extended to mixed states, although our main interest are pure states. Let \(\hat{\gamma }(C,\mu )\) be the maximum guessing probability of Bob over all states with concurrence at most C. Define \({\hat{\gamma }}_{2}(C,\mu )\) in a similar way, but assuming that ρ_{A} is supported in the support of P_{A}. By the following theorem proved in Supplementary Note 4, \(\hat{\gamma }(C,\mu )\) and \({\hat{\gamma }}_{2}(C,\mu )\) are weighted averages of γ^{*}(μ) and γ(1, μ) = 1.
Theorem 2
Suppose 0 ≤ C ≤ 1; then
Fidelity as the figure of merit
Next, we consider the fidelity as the figure of merit, which is more natural for QSV. Here we assume that Bob controls the whole system except that of Alice, so we can assume that the state ρ prepared by Bob is pure. Define the reduced fidelity
where the maximization is taken over all local unitary transformations on \({{{{\mathcal{H}}}}}_{B}\). Denote by γ^{F}(F, μ) the maximum guessing probability over all pure states with F_{B}(ρ) ≤ F. Define \({\gamma }_{2}^{{{{\rm{F}}}}}(F,\mu )\) in a similar way, but assuming that ρ_{A} is supported in the support of P_{A}. It is known that F_{B}(ρ) = [1 + C(ρ)]/2 ≥ 1/2 for any twoqubit pure state ρ satisfying P_{A}ρ_{A} = ρ_{A}^{63}. So \({\gamma }_{2}^{{{{\rm{F}}}}}(F,\mu )\) is defined only for 1/2 ≤ F ≤ 1, although γ^{F}(F, μ) is defined for 0 ≤ F ≤ 1.
The following theorem proved in Supplementary Note 5 clarifies the relations between γ^{F}(F, μ), \({\gamma }_{2}^{{{{\rm{F}}}}}(F,\mu )\), and γ_{2}(C, μ). The guessing probabilities γ^{F}(F, μ) for various verification protocols are illustrated in Fig. 3.
Theorem 3
Suppose 1/2 ≤ F ≤ 1; then
Suppose 0 ≤ F ≤ 1; then
Equation (14) offers the best linear upper bound for γ^{F}(F, μ) when 1/2 ≤ F ≤ 1 and demonstrates the robustness of the verification protocol. Theorems 1 to 3 corroborate the significance of the threshold γ^{*} in verifying the Bell state and entanglement in the SDI scenario. Moreover, the threshold γ^{*} determines the sample efficiency, as we shall see shortly. Therefore, γ^{*} can be regarded as the most important figure of merit for characterizing the performance of a verification protocol.
Simplest and optimal verification protocols
Here we propose several concrete verification protocols, including the simplest and optimal protocols. The main results are summarized in Table 1 and illustrated in Fig. 2; more details can be found in Supplementary Note 9.
In the simplest verification protocol, Alice can perform two projective measurements r_{1} and r_{2} with probabilities p_{1} and p_{2}, respectively. Here the maximum guessing probability γ(C, μ) only depends on the angle between r_{1} and r_{2} in addition to the probabilities p_{1} and p_{2}. Moreover, γ(C, μ) is minimized when r_{1} ⋅ r_{2} = 0 and p_{1} = p_{2} = 1/2, in which case we have
and the guessing probability threshold is \({\gamma }^{* }=(2+\sqrt{2})/4\). When r_{1} = (1, 0, 0)^{T} and r_{2} = (0, 1, 0)^{T} for example, we get the XY protocol. Previously, ref. ^{23} proposed an equivalent protocol, but neither derived the exact formula for the guessing probability nor proved the optimality of the XY protocol among all twosetting protocols.
To determine the optimal protocol, we need to minimize g(C, μ) over μ. By Theorem 1, g(C, μ) is convex in μ, so g(C, μ) is minimized when μ is the uniform distribution on the Bloch sphere, which yields the isotropic protocol with
and the guessing probability threshold is γ^{*} = 3/4.
Protocols based on the Pauli Z measurement and measurements on the xyplane are of special interest to the verification of GHZ states as we shall see shortly. Prominent examples include the XYZ protocol (cf. Fig. 1), equator protocol, equator + Z protocol, polygon protocol, and polygon + Z protocol (see Supplementary Note 9).
Sample efficiency
To construct a practical verification protocol, it is crucial to clarify the sample efficiency. Although this problem has been resolved in standard QSV^{42,43,44}, little is known about the sample efficiency in the DI and SDI scenarios^{46}. Here we clarify the sample efficiency of our verification protocols in the SDI scenario. Consider a quantum device that is supposed to produce the target state \(\left{{\Phi }}\right\rangle \in {{{\mathcal{H}}}}\), but actually produces the states ρ_{1}, ρ_{2}, …, ρ_{N} in N runs. Our task is to verify whether these states are sufficiently close to the target state on average. Here the reduced fidelity is a natural choice for quantifying the closeness since Alice is ignorant to the local unitary transformations acting on Bob’s system. To guarantee that the average reduced fidelity of the states ρ_{1}, ρ_{2}, …, ρ_{N} is larger than 1 − ϵ with significance level δ (confidence level 1 − δ), the number of tests required is determined in Supplementary Note 6, with the result
Note that the sample efficiency is determined by the threshold \({\gamma }^{* }={\gamma }_{2}^{* }\) defined in Eq. (8).
The minimum threshold γ^{*} = 3/4 is attained for the isotropic protocol, in which case \(N\approx (2{{\mathrm{ln}}}\,{\delta }^{1})/\epsilon\), which is comparable to the number \((3{{\mathrm{ln}}}\,{\delta }^{1})/(2\epsilon )\) required in standard QSV^{42,53}. So the Bell state can be verified in the SDI scenario almost as efficiently as in the standard QSV. Our protocol can achieve the optimal sample complexity because it is tied to a steering inequality whose quantum bound coincides with the algebraic bound. In contrast, the sample complexity in the DI scenario is quadratically worse in the scaling with 1/ϵ, that is, \(N\propto ({{\mathrm{ln}}}\,{\delta }^{1})/{\epsilon }^{2}\) ^{46} (cf. Supplementary Note 7).
Verification of the GHZ state
Next, consider the GHZ state \(\left{G}^{n}\right\rangle =({\left0\right\rangle }^{\otimes n}+{\left1\right\rangle }^{\otimes n})/\sqrt{2}\) of nqubits with n ≥ 3. To verify this state, the n parties can randomly perform certain tests based on local projective measurements. In each test, the verifier (one of the parties) asks each party to perform a local projective measurement as specified by a unit vector on the Bloch sphere and return the measurement outcome. If all parties are honest, then only the target state \(\left{G}^{n}\right\rangle\) can pass all tests with certainty, so the GHZ state can be verified. In the presence of dishonest parties, let \({{{\mathscr{D}}}}\) be the set of dishonest parties, who know which parties are honest or dishonest and who may collude with each other; let \({{{\mathscr{H}}}}\) be the set of honest parties (including the verifier), who do not know which other parties are honest or dishonest. The goal is to verify \(\left{G}^{n}\right\rangle\) up to local unitary transformations on the joint Hilbert space of \({{{\mathscr{D}}}}\)^{23,24}. Assuming \( {{{\mathscr{D}}}} , {{{\mathscr{H}}}} \ge 1\), then \(\left{G}^{n}\right\rangle\) may be regarded as a Bell state shared between \({{{\mathscr{H}}}}\) and \({{{\mathscr{D}}}}\). So the verification of the GHZ state is closely tied to the verification of the Bell state. Actually, there is no essential difference when \( {{{\mathscr{H}}}} =1\).
However, a key distinction arises when \( {{{\mathscr{H}}}} \ge 2\) because each member of \({{{\mathscr{H}}}}\) can only perform local projective measurements on his/her party. So the potential tests that the verifier can realize are restricted. Careful analysis in Supplementary Note 10 shows that only two types of tests for verifying the GHZ state \(\left{G}^{n}\right\rangle\) can be constructed from local projective measurements. In the first type, all parties perform Z measurements, and the test is passed if they obtain the same outcome. In this way the verifier can effectively realize the Z measurement on \({V}_{{{{\mathscr{H}}}}}\), where \({V}_{{{{\mathscr{H}}}}}\) is the twodimensional subspace spanned by \({\bigotimes }_{j\in {{{\mathscr{H}}}}}{\left0\right\rangle }_{j}\) and \({\bigotimes }_{j\in {{{\mathscr{H}}}}}{\left1\right\rangle }_{j}\).
In the second type of tests, party j performs the X(ϕ_{j}) measurement with \({\sum }_{j}{\phi }_{j}=0\,{{\mathrm{mod}}}\,\,2\pi\), where \(X({\phi }_{j})={{{{\rm{e}}}}}^{{{{\rm{i}}}}{\phi }_{j}}\left0\right\rangle \left\langle 1\right+{{{{\rm{e}}}}}^{{{{\rm{i}}}}{\phi }_{j}}\left1\right\rangle \left\langle 0\right\) corresponds to the Bloch vector \({(\cos {\phi }_{j},\sin {\phi }_{j},0)}^{{{{\rm{T}}}}}\), and each ϕ_{j} is decided by the verifier. The test is passed if the number of outcomes −1 is even. Suppose ϕ_{1}, ϕ_{2}, …, ϕ_{n} are chosen independently and uniformly at random from the interval [0, 2π). Then \({\phi }_{{{{\mathscr{H}}}}}:= {\sum }_{j\in {{{\mathscr{H}}}}}{\phi }_{j}\,{{\mathrm{mod}}}\,\,2\pi\) is uniformly distributed in [0, 2π). Given ϕ ∈ [0, 2π), the average of \({\bigotimes }_{j\in {{{\mathscr{H}}}}}X({\phi }_{j})\) under the condition \({\phi }_{{{{\mathscr{H}}}}}=\phi\) reads
In this way, the verifier can effectively realize the X(ϕ) measurement on \({V}_{{{{\mathscr{H}}}}}\), where ϕ is completely random. A similar result holds when ϕ_{j} are chosen independently and uniformly at random from the discrete set \({\{2k\pi /M\}}_{k = 0}^{M1}\) with M ≥ 3 being a positive integer.
By the above analysis, the verifier can effectively realize projective measurements along the zaxis or on the xyplane when represented on the Blochsphere of \({V}_{{{{\mathscr{H}}}}}\), but not other projective measurements (assuming \( {{{\mathscr{H}}}} \ge 2\)). Each verification protocol of the GHZ state corresponds to a probability distribution μ on the Bloch sphere that is supported on the equator together with the north and south poles. Moreover, for all protocols in Table 1 except for the isotropic protocol (cf. Supplementary Notes 9 and 10), the guessing probabilities are the same as in the verification of the Bell state. To be specific, γ(C, μ) and γ^{F}(F, μ) can be defined as before; Theorems 1, 3, and Lemma 1 still hold, except that now C refers to the bipartite concurrence between \({{{\mathscr{H}}}}\) and \({{{\mathscr{D}}}}\). Although variants of the XY protocol and equator protocol were proposed previously^{23,24}, such exact formulas for the guessing probabilities are not known in the literature. To optimize the performance, μ should be uniform on the equator, which leads to the equator + Z protocol; the optimal probability p_{Z} for performing the Z measurement depends on C or F as before.
A quantum state ρ is genuinely multipartite entangled (GME) if its fidelity with the GHZ state \({{\mathrm{tr}}}\,(\rho \left{G}^{n}\right\rangle \left\langle {G}^{n}\right)\) is larger than 1/2^{64}. The GME can be certified if the guessing probability surpasses the threshold γ^{F}(1/2) = γ^{*}. This threshold is minimized at the special equator + Z protocol with p_{Z} = 4/(4 + π^{2}) = 0.288, in which case we have
This threshold is only 2.5% higher than the optimal threshold 3/4 for certifying the entanglement of the Bell state based on the isotropic protocol.
The sample efficiency for verifying the GHZ state can be determined following a similar analysis applied to the Bell state. The formula in Eq. (18) still applies, except that the choice of verification protocols is restricted. Now the minimum of γ^{*} is achieved at a special equator + Z protocol [cf. Eq. (20)]. So the GHZ state can be verified in the SDI scenario with almost the same efficiency as in the standard QSV^{57}, as illustrated in Fig. 4. In the DI scenario, by contrast, it is in general impossible to achieve such a high efficiency unless one can construct a Bell inequality for which the quantum bound coincides with the algebraic bound^{46}. Notably, the threequbit GHZ state can be verified with such a high efficiency by virtue of the Mermin inequality^{46,50}.
It should be pointed out that all our protocols for verifying GHZ states are applicable even in the presence of an arbitrary number of dishonest parties as long as the verifier is honest. Meanwhile, these protocols are useful for detecting GME. For some cryptographic tasks such as anonymous quantum communication, the security for all honest parties can be guaranteed at the same time with the assistance of a trusted common random source (CRS)^{23}. In this case, the number of honest parties can affect the security parameter.
Discussion
We proposed a simple and practical approach for verifying the Bell state in an untrusted quantum network in which one party is not honest. We also established a simple connection between verification protocols of the Bell state and probability distributions on the Bloch sphere together with an intuitive geometric picture. Based on this connection, we derived simple formulas for the guessing probability as functions of the concurrence and reduced fidelity. Meanwhile, we clarified the sample efficiency of each verification protocol and showed that the sample efficiency is determined by the threshold in the guessing probability. Moreover, we constructed the optimal and simplest protocols for verifying the Bell state, which are also very useful to detecting entanglement in the untrusted network.
Furthermore, we reduce the verification problem of GHZ states to the counterpart of the Bell state, which enables us to construct the optimal protocol for verifying GHZ states and for detecting GME. Our work shows that both Bell state and GHZ states can be verified in the SDI scenario with the same sample complexity as in standard QSV. By contrast, the sample complexity in the DI scenario is in general quadratically worse. This work is instrumental to verifying entangled states in untrusted quantum networks, which is crucial to guaranteeing the proper functioning of quantum networks. In addition, this work is of intrinsic interest to the foundational studies on quantum steering. In the future, it would be desirable to generalize our results to generic bipartite pure states, stabilizer states, and other quantum states.
Data availability
The data that support the findings of this study are available from the corresponding author upon request.
Code availability
The codes used for numerical analysis are available from the corresponding author upon request.
References
 1.
Horodecki, R., Horodecki, P., Horodecki, M. & Horodecki, K. Quantum entanglement. Rev. Mod. Phys. 81, 865–942 (2009).
 2.
Brunner, N., Cavalcanti, D., Pironio, S., Scarani, V. & Wehner, S. Bell nonlocality. Rev. Mod. Phys. 86, 419–478 (2014).
 3.
Uola, R., Costa, A. C. S., Nguyen, H. C. & Gühne, O. Quantum steering. Rev. Mod. Phys. 92, 015001 (2020).
 4.
Greenberger, D. M., Horne, M. A. & Zeilinger, A. Bell’s Theorem, Quantum Theory and Conceptions of the Universe, ed Kafatos, M. (Kluwer Academic, 1989).
 5.
Greenberger, D. M., Horne, M. A., Shimony, A. & Zeilinger, A. Bell’s theorem without inequalities. Am. J. Phys. 58, 1131–1143 (1990).
 6.
Bennett, C. H. et al. Teleporting an unknown quantum state via dual classical and EinsteinPodolskyRosen channels. Phys. Rev. Lett. 70, 1895–1899 (1993).
 7.
Bouwmeester, D. et al. Experimental quantum teleportation. Nature 390, 575–579 (1997).
 8.
Zhao, Z. et al. Experimental demonstration of fivephoton entanglement and opendestination teleportation. Nature 430, 54–58 (2004).
 9.
Ekert, A. K. Quantum cryptography based on Bell’s theorem. Phys. Rev. Lett. 67, 661–663 (1991).
 10.
Acín, A. et al. Deviceindependent security of quantum cryptography against collective attacks. Phys. Rev. Lett. 98, 230501 (2007).
 11.
Acín, A. & Masanes, L. Certified randomness in quantum physics. Nature 540, 213–219 (2016).
 12.
Clauser, J. F., Horne, M. A., Shimony, A. & Holt, R. A. Proposed experiment to test local hiddenvariable theories. Phys. Rev. Lett. 23, 880–884 (1969).
 13.
Pan, J.W., Bouwmeester, D., Daniell, M., Weinfurter, H. & Zeilinger, A. Experimental test of quantum nonlocality in threephoton GreenbergerHorneZeilinger entanglement. Nature 403, 515–519 (2000).
 14.
Hein, M., Eisert, J. & Briegel, H. J. Multiparty entanglement in graph states. Phys. Rev. A 69, 062311 (2004).
 15.
Kimble, H. J. The quantum internet. Nature 453, 1023–1030 (2008).
 16.
Wehner, S., Elkouss, D. & Hanson, R. Quantum internet: a vision for the road ahead. Science 362, eaam9288 (2018).
 17.
Hillery, M., Bužek, V. & Berthiaume, A. Quantum secret sharing. Phys. Rev. A 59, 1829 (1999).
 18.
Bell, B. A. et al. Experimental demonstration of graphstate quantum secret sharing. Nat. Commun. 5, 5480 (2014).
 19.
Zhao, S. et al. Phasematching quantum cryptographic conferencing. Phys. Rev. Appl. 14, 024010 (2020).
 20.
Fu, Y., Yin, H.L., Chen, T.Y. & Chen, Z.B. Longdistance measurementdeviceindependent multiparty quantum communication. Phys. Rev. Lett. 114, 090501 (2015).
 21.
Eisert, J. et al. Quantum certification and benchmarking. Nat. Rev. Phys. 2, 382–390 (2020).
 22.
Šupić, I. & Bowles, J. Selftesting of quantum systems: a review. Quantum 4, 337 (2020).
 23.
Pappa, A., Chailloux, A., Wehner, S., Diamanti, E. & Kerenidis, I. Multipartite entanglement verification resistant against dishonest parties. Phys. Rev. Lett. 108, 260502 (2012).
 24.
McCutcheon, W. et al. Experimental verification of multipartite entanglement in quantum networks. Nat. Commun. 7, 13251 (2016).
 25.
Šupić, I. & Hoban, M. J. Selftesting through EPRsteering. New J. Phys. 18, 075006 (2016).
 26.
Gheorghiu, A., Wallden, P. & Kashefi, E. Rigidity of quantum steering and onesided deviceindependent verifiable quantum computation. New J. Phys. 19, 023043 (2017).
 27.
Lu, H. et al. Counting classical nodes in quantum networks. Phys. Rev. Lett. 124, 180503 (2020).
 28.
Markham, D. & Krause, A. A simple protocol for certifying graph states and applications in quantum networks. Cryptography 4, 3 (2020).
 29.
Unnikrishnan, A. & Markham, D. Verification of graph states in an untrusted network. Preprint at http://arxiv.org/abs/2007.13126 (2020).
 30.
Branciard, C., Cavalcanti, E. G., Walborn, S. P., Scarani, V. & Wiseman, H. M. Onesided deviceindependent quantum key distribution: security, feasibility, and the connection with steering. Phys. Rev. A 85, 010301(R) (2012).
 31.
Unnikrishnan, A. et al. Anonymity for practical quantum networks. Phys. Rev. Lett. 122, 240501 (2019).
 32.
Hahn, F., Jong, J. & Pappa, A. Anonymous quantum conference key agreement. PRX Quantum 1, 020325 (2020).
 33.
Hayashi, M. & Koshiba, T. Verifiable quantum secure modulo summation. Preprint at http://arxiv.org/abs/1910.05976 (2019).
 34.
Wiseman, H. M., Jones, S. J. & Doherty, A. C. Steering, entanglement, nonlocality, and the EinsteinPodolskyRosen paradox. Phys. Rev. Lett. 98, 140402 (2007).
 35.
Saunders, D. J., Jones, S. J., Wiseman, H. M. & Pryde, G. J. Experimental EPRsteering using Belllocal states. Nat. Phys. 6, 845–849 (2010).
 36.
Cavalcanti, D. et al. Detection of entanglement in asymmetric quantum networks and multipartite quantum steering. Nat. Commun. 6, 7941 (2015).
 37.
Berta, M., Christandl, M., Colbeck, R., Renes, J. M. & Renner, R. The uncertainty principle in the presence of quantum memory. Nat. Phys. 6, 659–662 (2010).
 38.
Zhu, H. Zero uncertainty states in the presence of quantum memory. npj Quantum Inf. 7, 47 (2021).
 39.
Flammia, S. T. & Liu, Y.K. Direct fidelity estimation from few Pauli measurements. Phys. Rev. Lett. 106, 230501 (2011).
 40.
Hayashi, M., Matsumoto, K. & Tsuda, Y. A study of LOCCdetection of a maximally entangled state using hypothesis testing. J. Phys. A: Math. Gen. 39, 14427–14446 (2006).
 41.
Hayashi, M. Group theoretical study of LOCCdetection of maximally entangled states using hypothesis testing. New J. Phys. 11, 043028 (2009).
 42.
Pallister, S., Linden, N. & Montanaro, A. Optimal verification of entangled states with local measurements. Phys. Rev. Lett. 120, 170502 (2018).
 43.
Zhu, H. & Hayashi, M. Efficient Verification of Pure Quantum States in the Adversarial Scenario. Phys. Rev. Lett. 123, 260504 (2019).
 44.
Zhu, H. & Hayashi, M. General framework for verifying pure quantum states in the adversarial scenario. Phys. Rev. A 100, 062335 (2019).
 45.
Takeuchi, Y. & Morimae, T. Verification of manyqubit states. Phys. Rev. X 8, 021060 (2018).
 46.
Dimić, A., Šupić, I. & Dakić, B. Sampleefficient deviceindependent quantum state verification and certification. Preprint at http://arxiv.org/abs/2105.05832 (2021).
 47.
Mayers, D. & Yao, A. Self testing quantum apparatus. Quantum Inf. Comput. 4, 273 (2004).
 48.
McKague, M., Yang, T. H. & Scarani, V. Robust selftesting of the singlet. J. Phys. A: Math. Theor. 45, 455304 (2012).
 49.
Yang, T. H., Vértesi, T., Bancal, J.D., Scarani, V. & Navascués, M. Robust and versatile blackbox certification of quantum devices. Phys. Rev. Lett. 113, 040401 (2014).
 50.
Kaniewski, J. Analytic and nearly optimal selftesting bounds for the ClauserHorneShimonyHolt and Mermin inequalities. Phys. Rev. Lett. 117, 070402 (2016).
 51.
Hayashi, M. & Hajdušek, M. Selfguaranteed measurementbased quantum computation. Phys. Rev. A 97, 052308 (2018).
 52.
Metger, T. & Vidick, T. Selftesting of a single quantum device under computational assumptions. Quantum 5, 544 (2021).
 53.
Zhu, H. & Hayashi, M. Optimal verification and fidelity estimation of maximally entangled states. Phys. Rev. A 99, 052346 (2019).
 54.
Wang, K. & Hayashi, M. Optimal verification of twoqubit pure states. Phys. Rev. A 100, 032315 (2019).
 55.
Li, Z., Han, Y.G. & Zhu, H. Efficient verification of bipartite pure states. Phys. Rev. A 100, 032316 (2019).
 56.
Yu, X.D., Shang, J. & Gühne, O. Optimal verification of general bipartite pure states. npj Quantum Inf. 5, 112 (2019).
 57.
Li, Z., Han, Y.G. & Zhu, H. Optimal verification of GreenbergerHorneZeilinger states. Phys. Rev. Appl. 13, 054002 (2020).
 58.
Dangniam, N., Han, Y.G. & Zhu, H. Optimal verification of stabilizer states. Phys. Rev. Res. 2, 043323 (2020).
 59.
Helstrom, C. W. Quantum Detection and Estimation Theory (Academic, 1976).
 60.
Jevtic, S., Pusey, M., Jennings, D. & Rudolph, T. Quantum steering ellipsoids. Phys. Rev. Lett. 113, 020402 (2014).
 61.
Zhang, C. et al. Experimental validation of quantum steering ellipsoids and tests of volume monogamy relations. Phys. Rev. Lett. 122, 070402 (2019).
 62.
Wootters, W. K. Entanglement of formation of an arbitrary state of two qubits. Phys. Rev. Lett. 80, 2245 (1998).
 63.
Verstraete, F. & Verschelde, H. Fidelity of mixed states of two qubits. Phys. Rev. A 66, 022307 (2002).
 64.
Gühne, O. & Tóth, G. Entanglement detection. Phys. Rep. 474, 1–75 (2009).
Acknowledgements
This work is supported by the National Natural Science Foundation of China (Grant No. 11875110 and No. 62101600) and Shanghai Municipal Science and Technology Major Project (Grant No. 2019SHZDZX01).
Author information
Affiliations
Contributions
Y.G.H. and Y.W. initiated the project. Y.G.H., Z.L. and H.Z. did the theoretical analysis. H.Z. supervised the project. All authors discussed the results and contributed to the final manuscript.
Corresponding author
Ethics declarations
Competing interests
The authors declare no competing interests.
Additional information
Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Supplementary information
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Han, YG., Li, Z., Wang, Y. et al. Optimal verification of the Bell state and Greenberger–Horne–Zeilinger states in untrusted quantum networks. npj Quantum Inf 7, 164 (2021). https://doi.org/10.1038/s41534021004998
Received:
Accepted:
Published:
DOI: https://doi.org/10.1038/s41534021004998
Further reading

Practical anonymous entanglement with noisy measurement
Quantum Information Processing (2022)