Introduction

Communication network users must operate or interact with potentially untrusted parties, servers, nodes and transmission channels in order to handle sensitive data, sign digitally, perform online banking, delegate computations, and electronically vote, among many other tasks. To guarantee the security of such network tasks against malicious entities, it is necessary to rely on a collection of building blocks, called cryptographic primitives, which can be combined with one another to guarantee overall security1. Coin flipping is a fundamental primitive that comes in two versions. In strong coin flipping (SCF), two parties remotely agree on a random bit such that none of the parties can bias the outcome with probability higher than 1/2 + ϵ, where ϵ is the protocol bias2. It is essential for multiparty computation3, online gaming and more general randomized consensus protocols involving leader election4. In weak coin flipping (WCF), on the other hand, there is a winner and a loser, in the sense that both parties have a preferred, opposite outcome.

In classical communication networks, there exist no secure SCF and WCF protocols without computational assumptions or trusting a third party2,5,6,7. Although accepting a nonzero abort probability allows for information-theoretically secure classical schemes to exist8, such schemes cannot detect malicious behaviours deviating from the original protocol. On the other hand, cheat-sensitive coin flipping becomes possible when using quantum properties. Quantum SCF protocols have in fact been shown to display a fundamental lower bound on their bias9, but quantum WCF may achieve biases arbitrarily close to zero10,11,12. Interestingly, quantum WCF can also be used for the construction of optimal quantum SCF and quantum bit commitment schemes13,14,15.

While quantum SCF protocols have been experimentally demonstrated16,17,18, along with other quantum two-party computations19,20,21,22,23, the implementation of quantum WCF has remained elusive so far, because of the absence of protocols bringing together the use of practical states and measurements with tolerance to losses. Recently, a linear optical implementation, exploiting photon-number encoding, was proposed in24, but the quantum advantage it can provide in terms of bias is very sensitive to losses: a dishonest party may always declare an abort when they are not satisfied with the outcome of the coin flip.

Here, we provide an experimental demonstration for quantum WCF. Our demonstration relies on the generation of heralded single photons by spontaneous parametric down conversion (SPDC), which are effectively entangled with the vacuum on a beam splitter of variable reflectivity. The outcome of the coin flip is then provided by the detection or absence of a photon. Our protocol is a refined version of the theoretical protocol from24, which provides a new desirable property in the presence of losses that relates to cheat sensitivity rather than bias: by dropping the condition from24 that both parties have equal probabilities of winning when cheating, our protocol allows them to detect whether their opponent is cheating during a verification step, and does not sanction an honest party, while retaining security in terms of bias. There are no known classical protocols that achieve such cheat sensitivity25,26. In order to emphasize the robustness of our protocol to losses, we show that it remains secure over an attenuation that corresponds to several kilometers of telecom optical fiber.

Results

Protocol

We first introduce our protocol for quantum weak coin flipping using a single photon, building on the protocol proposed in24. Our protocol accounts for potential losses and the detection of a cheating party (see Fig. 1 and Box 1). It ends with five mutually incompatible outcomes: Alice wins or is sanctioned, Bob wins or is sanctioned, or the protocol aborts. The protocol uses three beam splitters, whose reflectivities x, y, and z are chosen in order to satisfy two conditions on these events. Firstly, the fairness condition, which states that Alice and Bob have equal winning probabilities when both of them are honest, i.e. \({{\mathbb{P}}}_{h}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})={{\mathbb{P}}}_{h}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})\), or

$${{\mathbb{P}}}_{h}\left[(b,\,{v}_{1},\,{v}_{2})=(0,\,1,\,0)\right]={{\mathbb{P}}}_{h}\left[(b,\,a)=(1,\,0)\right].$$
(1)

Secondly, the correctness condition, which states that an honest party should never be sanctioned for cheating, i.e. \({{\mathbb{P}}}_{h}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}})={{\mathbb{P}}}_{h}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}})=0\), or

$${{\mathbb{P}}}_{h}\left[(b,\,{v}_{2})=(0,\,1)\right]={{\mathbb{P}}}_{h}\left[(b,\,a)=(1,\,1)\right]=0.$$
(2)

Note that contrary to the previous protocol24, we drop the balancing condition, which states that Alice and Bob should have equal probabilities of winning when using an optimal cheating strategy, as it cannot be satisfied together with the correctness condition in presence of experimental imperfections. Consequently, a practical balanced protocol would sanction an honest Alice for cheating, with non-zero probability. This impacts the cheat sensitivity, as one cannot trust the verification step if it sanctions honest parties (see Supplementary Note 1 for details on the protocol and the chosen conditions).

Fig. 1: Schematic description of cheat-sensitive quantum weak coin flipping.
figure 1

The preparation, decision and verification steps, along with the role of measurement outcome b and beam splitter reflectivities x, y, z, are detailed in Box 1. The sources for Alice and Bob representations can be found at Woman icons created by Freepik - Flaticon and Man icons created by Freepik - Flaticon, respectively.

Full size image

Experimental setup

The experimental setup used for the implementation of our protocol is shown in Fig. 2. Alice generates heralded single photons via type-II SPDC in a periodically-poled potassium titanyl phosphate (ppKTP) crystal. The protocol is implemented using fibered components at telecom wavelength. As polarization is a degree of freedom not used for encoding, Alice entangles it with the spatial modes, using polarizing beam splitters (PBS). In this way, the beam splitters (BS) reflectivities x, y, and z, can be effectively tuned by rotating the single-photon polarization before each PBS, using polarization controllers. We use a fast optical switch in order to select the party who performs the verification step, depending on the outcome b. During this operation, the photon is delayed using optical fiber spools; Alice’s source together with Bob’s verification setup then form a >300 m-long fibered Mach-Zehnder interferometer. In order to mitigate the resulting interference noise, we carefully insulated the spools and achieved an interference visibility of v ≳ 96% (see Methods for details).

Fig. 2: Experimental setup for cheat-sensitive quantum weak coin flipping.
figure 2

A ppKTP crystal (30 mm-long, 46.2 μm poling period) is pumped by a 770 nm pulsed laser (≈2 ps long pulses, 76 MHz rate). Twin photons at telecom wavelengths are generated via type-II SPDC, separated from the pump by a dichroic mirror (DM), and from each other by a PBS. The signal photon is used to perform the protocol as shown in the scheme in Box 1, which is the reference for defining the reflectivities x, y and z. These are tuned with polarization controllers, placed before PBSs. At the end of each of the possible paths, the signal photon is detected with high-efficiency SNSPDs (\({D}_{A},{D}_{B},{D}_{{V}_{1}},{D}_{{V}_{2}}\)). A coincidence counter (c.c.) conditions each detection on the idler photon, detected with an InGaAs avalanche photodiode (APD) Dherald, and on the emission of a pump pulse, detected via an internal photodiode, measured in a 500 ps coincidence window. The signal from Bob’s detector, conditioned on the heralding signal via a logic AND gate, triggers a fast optical switch on Alice’s side. While these signals are being processed, the photon is delayed by 300 m-long optical fiber spools on each party’s side. A delay line allows for fine-tuning of the wave-packets timing on the last PBS. Communication distance L between Alice and Bob is simulated by VOAs of transmission e−0.02L, which are shown on the dashed line marking visually the separation between the two parties. Two more VOAs are included in the setup to simulate losses due to photon storage corresponding to this distance.

Full size image

Under these conditions, the thermally-induced fluctuations are slow enough such that we can easily post-select the protocol runs in which there was no phase difference between the two arms of the interferometer. This post-selection does not threaten the protocol security, as the parties could monitor the interference before performing the coin flip, and agree on starting the protocol only when the phase difference is null. Single photons are detected with threshold superconducting nanowire single-photon detectors (SNSPDs) in order to maximize the detection efficiency. Finally, to simulate communication distance between Alice and Bob, and the corresponding losses induced by the photon storage that is necessary in this case, we use variable optical attenuators (VOAs).

Because of their central role in the analysis of the protocol, we wish to distinguish the BS reflectivities from the losses induced by the rest of the components in the setup. For that purpose we define different transmission (or heralding) efficiencies, measured when the reflectivities and the state of the switch are set to trivial values x, y, z, s ∈ {0, 1}. These values reflect the losses in every possible path in the experiment, which are induced for instance by fiber spools, VOAs, fiber coupling and mating, or detectors. We detail the notations for the efficiencies corresponding to each path and their measured values in Table 1. Each path is defined by the detector it ends in and the arm it goes through (Alice’s or Bob’s).

Table 1 List of notations and measured values for the efficiencies corresponding to the different paths involved in the experiment
Full size table

Results with honest parties

We are first interested in the protocol when both Alice and Bob are honest. In our experiments, because of dark counts, double-pair emission, or imperfect interference visibility, Alice and Bob can still be sanctioned even though they are honest and the setup is optimized. In general, we cannot tune the reflectivities perfectly, so Alice and Bob may have slightly different winning probabilities. This means our implementation cannot satisfy perfectly the fairness and correctness conditions. Therefore, we define the fairness \({{{{{{{\mathcal{F}}}}}}}}\) and correctness \({{{{{{{\mathcal{C}}}}}}}}\) in order to quantify the closeness to these two conditions as follows:

$${{{{{{{\mathcal{F}}}}}}}}=1-\left | \frac{{{\mathbb{P}}}_{h}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})-{{\mathbb{P}}}_{h}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})}{{{\mathbb{P}}}_{h}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})+{{\mathbb{P}}}_{h}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})}\right |,$$
(3)
$${{{{{{{\mathcal{C}}}}}}}}=1-\frac{{{\mathbb{P}}}_{h}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}})+{{\mathbb{P}}}_{h}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}})}{{{\mathbb{P}}}_{h}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})+{{\mathbb{P}}}_{h}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})}.$$
(4)

Both quantities are equal to 1 when the corresponding conditions are perfectly fulfilled, and \({{{{{{{\mathcal{C}}}}}}}},{{{{{{{\mathcal{F}}}}}}}} \, < \,1\) otherwise. In our implementation, the probability of emitting a pair in a pump pulse is p ≃ 0.015, so double-pair emissions are highly unlikely. We condition any detection event on the detection of both a pump pulse and a heralding photon, which effectively minimizes the already low dark count rates in SNSPDs. In this way, we can omit the double-pair emissions and dark counts as a first approximation, such that only the interference visibility v limits \({{{{{{{\mathcal{C}}}}}}}}\) and \({{{{{{{\mathcal{F}}}}}}}}\). Under these assumptions, we show that the correctness and fairness conditions are optimally approached by setting the following reflectivities:

$${x}_{h}={\left[1+\frac{{\eta }_{A}^{{V}_{1}}}{{\eta }_{B}^{{V}_{1}}}+\frac{{\eta }_{A}^{{V}_{1}}}{{\eta }_{B}^{y}}(1+v)\right]}^{-1},$$
(5)
$${y}_{h}={\left[1+\frac{{\eta }_{B}^{{V}_{1}}}{{\eta }_{B}^{y}}(1+v)\right]}^{-1},$$
(6)
$${z}_{h}=\frac{1}{2}.$$
(7)

The reader can refer to Supplementary Note 1 for the detailed proof and Supplementary Note 2 for the values used in our implementation. Then, as long as the parties are honest, we obtain the following probabilities for significant events:

$${{\mathbb{P}}}_{h}\left({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}}\right)={{\mathbb{P}}}_{h}\left({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}}\right)={x}_{h}{\eta }_{A}^{{V}_{1}}(1+v),$$
(8)
$${{\mathbb{P}}}_{h}\left({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}}\right)=0,$$
(9)
$${{\mathbb{P}}}_{h}\left({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}}\right)={x}_{h}{\eta }_{A}^{{V}_{2}}(1-v).$$
(10)

Note here the importance of maximizing the interference visibility v so that Alice is not sanctioned while being honest. The above expressions also provide a systematic way to optimize the reflectivities for honest parties, which does not require their direct measurement (see Methods for details).

We perform the protocol for different communication distances between Alice and Bob. These are simulated by setting each of the VOAs to a transmission η = e−0.02L with L the distance in kilometers, introducing additional losses to each arm of the setup. We optimize the fairness and correctness at each distance by tuning the reflectivities. We continuously run the protocol and record all detection events regardless of the phase difference between the two arms of the interferometer. Detection of both a heralding photon and a pump pulse triggers a protocol run. The average protocol rate is ≃51 kHz. As if Bob was monitoring the phase difference, we post-select the runs for which the phase spontaneously goes to zero thanks to slow temperature fluctuations, such that the rate in \({D}_{{V}_{2}}\) (which essentially corresponds to the probability of honest Alice being sanctioned) is minimized. In this way, we measure at least 1.5 × 105 valid iterations of the protocol for a 15-min run, making the Poisson noise negligible. In Fig. 3 we give the probabilities of the different events for several distances.

Fig. 3: Probability of each outcome of the protocol, measured for different communication distances between Alice and Bob.
figure 3

The abort probability is shown on the right axis, in magenta. The lines represent the theoretical evolution of probabilities, calculated via Eqs. (5) to (10), with efficiencies given in Table 1. The error bars are mainly due to error propagation on these efficiencies.

Full size image

We notice that the abort probability takes relatively high values, even when we trivially set the communication distance to L = 0 km. This has to do with important losses, particularly in mating sleeves connecting the numerous optical fiber components, the delay line, or in crystalline components such as the PBSs or the optical switch. Significant improvements could be made by fusing optical components for instance. Other critical features are the single-photon coupling and SNSPDs efficiencies. Both of these aspects are being actively studied27,28,29,30,31,32 and could see significant improvement in the near future. We also notice that the winning probabilities of Alice and Bob are indeed very close and the probability of an honest party to be sanctioned is minimized.

To further illustrate the performance of our protocol, we show the fairness \({{{{{{{\mathcal{F}}}}}}}}\) and correctness \({{{{{{{\mathcal{C}}}}}}}}\) in Fig. 4. Thanks to the appropriate tuning of reflectivities x, y, and z, as well as low dark count rates and high visibility, we were able to keep both of these quantities very close to 1, thus approaching the ideal conditions.

Fig. 4: Correctness \({{{{{{{\mathcal{C}}}}}}}}\) and fairness \({{{{{{{\mathcal{F}}}}}}}}\) measured in our experimental implementation of the protocol with honest parties, for different communication distances.
figure 4

The dashed line gives the target value for an ideal protocol.

Full size image

Cheat sensitivity, results with dishonest parties

The security of WCF protocols is measured by the bias that a dishonest party can induce on the flip. While we drop the balancing condition compared to the protocol in24, our protocol retains the same security guarantees in terms of bias, i.e., the winning probability of a dishonest party is bounded away from 1 (see Supplementary Note 1). Now we highlight the cheat sensitivity of our protocol, by implementing possible attacks by dishonest parties. We consider one party to be dishonest, the other one being honest. Bob’s optimal cheating strategy is quite straightforward, and consists in claiming b = 1 regardless of the actual measurement in detector DB24. As Alice is honest she sets the reflectivity x = xh given in Eq. (5). When Bob claims b = 1 then Alice’s switch directs her mode in detector DA so that she can verify whether Bob is being honest. She then detects a photon with probability:

$${\mathbb{P}}(a=1|{{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{cheats}}}}}}}})={x}_{h}{\eta }_{A}^{s},$$
(11)

in which case Bob is sanctioned for cheating. Otherwise, Bob wins with probability:

$${\mathbb{P}}(a=0|{{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{cheats}}}}}}}})= 1-{\mathbb{P}}(a=1|{{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{cheats}}}}}}}})\\= 1-{x}_{h}{\eta }_{A}^{s}.$$
(12)

In this way, Alice’s conditional verification, enabled in our setup by the fast optical switch, allows for a first kind of cheat sensitivity.

In order to illustrate this aspect, we implement Bob’s optimal cheating strategy by systematically forcing the switch to send the photon to DA. We measure the probability of sanctioning Bob for each of the communication distances simulated in the honest case. As displayed in Fig. 5, we show experimentally that the probability of sanctioning Bob decreases as communication-induced losses increase, therefore limiting Alice’s cheat sensitivity. This gives a substantial advantage to Bob when Alice’s arm is particularly lossy. Note that when Bob implements that strategy, only two events are possible, namely Bob winning or Bob being sanctioned; Alice can never win except if the sanction is precisely giving Alice the win (see discussion below).

Fig. 5: Probabilities of Bob winning or being sanctioned, when he is performing an optimal attack, measured for different communication distances between Alice and Bob.
figure 5

Only one set of points is shown for the two axes, as these two events are complementary. The line is plotted from Eqs. (11) and (12), with \({\eta }_{A}^{s}\) given in Table 1. The error bars are mainly due to error propagation on this efficiency. The observed deviation from the theory is linked to systematic errors when setting the reflectivities, which is discussed in Supplementary Note 2.

Full size image

On the other hand, when Bob is honest and Alice is dishonest, her optimal cheating strategy is less straightforward. In particular, our security proof does not derive her optimal strategy but rather derives a security bound valid for all strategies (see Supplementary Note 1). Nevertheless, we can illustrate this scenario using suboptimal strategies by simply tuning the value of x, so that Alice sends the photon to her side with higher probability: intuitively, without taking the verification setup into account, we can naively expect Alice’s winning probability to increase as she increases the reflectivity x. We experimentally perform the protocol for different values of x, all of them higher than the honest value (5). In that case, the expected event probabilities are given by the following formula (see Supplementary Note 1 for the detailed proof):

$${\mathbb{P}}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})=\frac{1}{2}\left(x{\eta }_{A}^{{V}_{1}}+(1-x){y}_{h}{\eta }_{B}^{{V}_{1}}+2v\sqrt{x(1-x){y}_{h}{\eta }_{A}^{{V}_{1}}{\eta }_{B}^{{V}_{1}}}\right),$$
(13)
$${\mathbb{P}}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}})=\frac{1}{2}\left(x{\eta }_{A}^{{V}_{2}}+(1-x){y}_{h}{\eta }_{B}^{{V}_{2}}-2v\sqrt{x(1-x){y}_{h}{\eta }_{A}^{{V}_{2}}{\eta }_{B}^{{V}_{2}}}\right),$$
(14)
$${\mathbb{P}}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})=(1-x)(1-{y}_{h}){\eta }_{B}^{y}.$$
(15)

In Fig. 6(a), we show the probabilities of significant events. Contrary to our naive conjecture, we see that thanks to Bob’s verification, and thus cheat sensitivity, Alice does not have a clear interest in forcing x = 1, as her winning probability peaks around x ≃ 0.78.

Fig. 6: Results for a dishonest Alice who sets different values of x than the honest value.
figure 6

The lines show theoretical predictions, calculated from Eqs. (13)-(16), with efficiencies given in Table 1. The error bars are mainly due to error propagation on these efficiencies. a Probabilities of different outcomes. b Alice’s cheating interest for different deterrent factors δ. The dashed black line indicates the points of maximum interest.

Full size image

Alice’s interest in cheating actually depends on how deterrent the sanction is. We define a factor δ ≥ 0, which quantifies that deterrability, or alternatively how harmful the sanction is for a cheating party. From this parameter we can derive an empirical function that quantifies Alice’s interest in cheating:

$${{{{{{{{\mathcal{I}}}}}}}}}_{A}(\delta )\,=\,\frac{{\mathbb{P}}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})-{\mathbb{P}}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})-\delta {\mathbb{P}}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}})}{{\mathbb{P}}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})+{\mathbb{P}}({{{{{{{\rm{B.}}}}}}}}\,{{{{{{{\rm{wins}}}}}}}})+\delta {\mathbb{P}}({{{{{{{\rm{A.}}}}}}}}\,{{{{{{{\rm{sanctioned}}}}}}}})}.$$
(16)

This function is built such that it can be linked to the fairness (3) when taking the appropriate sanction. Indeed, if for δ ∈ [0, 1] we sanction a cheating Alice by giving the win to Bob with probability δ, then the relation \({{{{{{{\mathcal{F}}}}}}}}=1-|{{{{{{{{\mathcal{I}}}}}}}}}_{A}(\delta )|\) holds. In this way, δ = 0 corresponds to a protocol that simply aborts without sanction when Alice is caught, and δ = 1 gives a protocol that always declares Bob the winner when Alice is caught. Ultimately \({{{{{{{{\mathcal{I}}}}}}}}}_{A}(\delta )\) can be interpreted as a sort of expectation value of a cheating Alice, or a comparison between what she can gain by cheating and what she can lose. In Fig. 6b we plot Alice’s cheating interest for different values of δ and x. If no sanction is taken (δ = 0), we see that her interest in cheating grows with x. Indeed, even if her winning probability decreases for high values of x, Bob’s then approaches zero, such that Alice wins with absolute certainty as long as the protocol does not abort. On the contrary, as the sanction is tightened and the value of δ increases, Alice has less interest in cheating for a given value of x. Furthermore, the value of x that maximizes \({{{{{{{{\mathcal{I}}}}}}}}}_{A}\) also goes down, showing how strengthening the sanction actually forces Alice to adopt a strategy that leaves a chance for Bob to win. We finally discuss scenarios in which both parties cheat simultaneously in Supplementary Note 1.

Discussion

After refining a previous theoretical proposal for a practical quantum weak coin flipping protocol24, we were able to perform an implementation of this protocol by generating a heralded single photon, and entangling it effectively with the vacuum. Thanks to the use of low dark counts SNSPDs, tunable beam splitters and a fast optical switch, while keeping a high visibility in our fibered interferometer, we demonstrated a fair and cheat-sensitive protocol. Importantly, this last property allows to detect a cheating party with non-negligible probability.

Note that in order to sanction a dishonest party with high probability, one could systematically sanction the winning party, regardless of their honesty. Thus, in order to display genuine cheat sensitivity, we highlight the primary importance of the correctness condition, which ensures an honest party is never sanctioned for cheating. This forced us to ignore the balancing of the benefit gained by each party when adopting an optimal cheating strategy, which was previously assessed as a necessary condition for a weak coin-flipping protocol24. Still, we propose a way of restoring this balance, by using the deterrent factor and interest function introduced in the previous paragraphs.

The balance could indeed arise from choosing different sanctions for Alice and Bob, associated with different deterrent factors δA and δB, in order to equalize the corresponding interest functions \({{{{{{{{\mathcal{I}}}}}}}}}_{A}({\delta }_{A})\) and \({{{{{{{{\mathcal{I}}}}}}}}}_{B}({\delta }_{B})\). A dishonest party who could dramatically increase their winning probability would therefore take a bigger risk of being harshly sanctioned when cheating. Interestingly enough, one could actually set arbitrarily big deterrent factors δ > 1 in order to account for harsher sanctions. We leave the evaluation of these sanctions, deterrent factors and potential alternative interest functions as an interesting game theory open question.

From an experimental perspective, we remark that the robustness to losses in our implementation was illustrated by simulating communication distance with variable optical attenuators. In a practical implementation of the protocol, it would be necessary to maintain a high visibility for a longer interferometer, which could be achieved with active stabilization techniques used in twin-field quantum key distribution implementations for instance33,34. Furthermore, optical implementations of quantum WCF with arbitrarily small biases are yet to be discovered—such implementations would be challenging since they require a rapidly growing number of rounds of communication between the parties35.

Methods

Source and detection

Our single-photon signal was heralded by its idler twin, in a pair generated via type-II SPDC in a ppKTP crystal (Raicol). We maximized the heralding efficiency ηs = Rsi/Ri, with Ri the idler photon detection rate and Rsi the pair detection rate. For that purpose, the pump focus and pair collection modes were tuned carefully when coupling to single-mode fibers, and losses on the signal-photon path were minimized. In particular, we used >85%-efficiency SNSPDs (ID281 from ID Quantique) to detect that photon. Losses on the idler photon were not limiting, so we detected it with a 25%-efficiency InGaAs APD (ID230 from ID Quantique). In this way, without adding the rest of the components, we measured a maximum heralding efficiency ηs = 63%. All detection events were recorded by a time tagger (Time Tagger Ultra from Swabian Instruments), and dated with picosecond precision. Two detection events were considered simultaneous when measured in a 500 ps coincidence window. We also use the pump laser as a clock, in order to filter out most of the dark counts from the APD, which occur at a 1 kHz-rate. In this way, protocol runs were triggered at a rate of 51 kHz, with 40 Hz of runs mistakenly triggered by dark counts.

Error management

Various factors can generate undesired detection events in our protocol. This is true in particular for sanction outcomes, triggered by a detection in DA or \({D}_{{V}_{2}}\) which should never occur when a party is honest. Most of these outcomes arise from Bob’s verification procedure, which relies on a Mach–Zehnder interferometer. If this interference is of poor visibility, then \({D}_{{V}_{2}}\) can be triggered even if Alice is being honest, and her winning probability is also substantially lowered. Considering the length of this interferometer (>300 m), the visibility is limited by two main factors, namely the coherence length and phase fluctuations. The coherence length of photons is ≃ 2.4 mm, which is small enough to start losing coherence after a few hours of experiment runs. This is mostly caused by length variations in the interferometer arms due to thermal fluctuations (≃2.4 mm/∘C for a 300 m arm). We therefore regularly tune the length of one arm of the interferometer, using a free-space micro-metric delay line. Phase fluctuations can be separated into two regimes. Slow phase fluctuations, of typical frequency ≲1 Hz, are again caused by thermal variations. We can easily measure them, and then either correct them or simply post-select the desired phase differences. Fast phase fluctuations, however, are caused by noise spanning the audible spectrum from 20 Hz to 2 kHz. This noise is amplified by the 300 m fiber spools, which act as sort of microphone. These fluctuations are hard to resolve with our single-photon rate of a few 10 kHz, such that the interference pattern is averaged on that noise, and we witness an interference visibility of approximately v ≃ 80%. In order to characterize that noise, we measure the interference pattern with a continuous diode laser and a fast photodiode. Without any sound insulation, the noise in the interference fluctuation spans the audible spectrum with a power spectral density of approximately ≃ 7 × 10−3V2/Hz. In order to mitigate this noise, we wrap the fiber spools into several layers of sound-absorbing floating parquet underlay. We then achieve an interference visibility of v ≃ 96%.

Reflectivity setting

When the parties are honest, Bob first sets z = 1/2 by blocking Alice’s signal, and equalizing the detection rates in \({D}_{{V}_{1}}\) and \({D}_{{V}_{2}}\). This later ensures an optimized interference, and therefore the correctness condition. Then he can tune y such that the detection rate in DB equals twice the total rate in \({D}_{{V}_{1}}\) and \({D}_{{V}_{2}}\), which should ensure the fairness condition. Alice then tunes x in order to optimize the interference visibility, which should complete the setting of reflectivities. If v is significantly lower than 1, Alice and Bob might have to perform some mild adjustments on x and y in order to maximize the fairness and correctness. After performing a protocol with reflectivities x, y, z we can evaluate them by measuring some specific probabilities (see Supplementary Note 2).

Optical switching

During the decision step of the protocol, Bob’s detection determines which party is winning, and which one is performing the verification. This decision is effectively taken into account by Alice via her optical switch (Nanospeed from Agiltron). In this way, if Bob does not claim victory, the switch is in state “0" in order to send Alice’s state to Bob, who performs the verification. If Bob claims victory, the switch goes to state “1" such that Alice keeps her state and performs the verification. In practice, we send the electronic signal from Bob’s detector, together with the heralding signal, to a fast programmable logic AND gate, integrated in a time controller (ID900 from ID Quantique). This AND gate filters out potential detection events outside of the protocol, which might saturate the optical switch. The gate’s output signal is then sent to the optical switch, which executes the decision (see Supplementary Note 2 for more details).