Trading Locality for Time: Certifiable Randomness from Low-Depth Circuits

The generation of certifiable randomness is the most fundamental information-theoretic task that meaningfully separates quantum devices from their classical counterparts. We propose a protocol for exponential certified randomness expansion using a single quantum device. The protocol calls for the device to implement a simple quantum circuit of constant depth on a 2D lattice of qubits. The output of the circuit can be verified classically in linear time, and is guaranteed to contain a polynomial number of certified random bits assuming that the device used to generate the output operated using a (classical or quantum) circuit of sub-logarithmic depth. This assumption contrasts with the locality assumption used for randomness certification based on Bell inequality violation and more recent proposals for randomness certification based on computational assumptions. Furthermore, to demonstrate randomness generation it is sufficient for a device to sample from the ideal output distribution within constant statistical distance. Our procedure is inspired by recent work of Bravyi et al. (Science 362(6412):308–311, 2018), who introduced a relational problem that can be solved by a constant-depth quantum circuit, but provably cannot be solved by any classical circuit of sub-logarithmic depth. We develop the discovery of Bravyi et al. into a framework for robust randomness expansion. Our results lead to a new proposal for a demonstrated quantum advantage that has some advantages compared to existing proposals. First, our proposal does not rest on any complexity-theoretic conjectures, but relies on the physical assumption that the adversarial device being tested implements a circuit of sub-logarithmic depth. Second, success on our task can be easily verified in classical linear time. Finally, our task is more noise-tolerant than most other existing proposals that can only tolerate multiplicative error, or require additional conjectures from complexity theory; in contrast, we are able to allow a small constant additive error in total variation distance between the sampled and ideal distributions.


Introduction
A fundamental point of departure between quantum mechanics and classical theory is that the former is nondeterministic: quantum mechanics, through the Born rule, posits the existence of experiments that generate intrinsic randomness.This observation leads to the simplest and most successful "test of quantumness" to have been designed and implemented: the Bell test [Bel64].Far beyond its role as a test of the foundations of quantum mechanics, the Bell test has become a fundamental building block in quantum information, from protocols for quantum cryptography (e.g.device-independent quantum key distribution [Eke91,VV14]) to complexity theory (e.g.delegated quantum computation [RUV13], multiprover interactive proof systems [CHTW04]) and much more [BCP + 14].Yet, while a loophole-free implementation of a Bell test has been demonstrated [HBD + 15, GVW + 15, SMSC + 15] it remains a challenging experimental feat, which unfortunately leaves its promising applications wanting (here "loophole-free" refers to a stringent set of experimental standards which ensure that all required assumptions have been verified "beyond reasonable doubt").The increasingly powerful quantum devices that are being experimentally realized tend to be single-chip, and do not have the ability to implement loophole-free Bell tests.The task of devising convincing "tests of quantumness" for such devices is challenging.
Until recently the only proposal for such tests was the design of so-called "quantum supremacy experiments" [HM17], which specify classical sampling tasks that can in principle be implemented by a mid-scale quantum device, but cannot be simulated by any efficient classical randomized algorithm (under somewhat standard computational assumptions [AC17,HM17]).These proposals share a number of well-recognized limitations.Firstly, while the sampling part of the process can be done efficiently on a quantum computer, verifying that the quantum computer is sampling from a hard distribution requires a computational effort which scales exponentially in the number of qubits.Secondly, their experimental realization is hindered by a generally poor tolerance to errors in the implementation, which is compounded by the necessity to implement circuits with relatively large (say, at least √ N for an N × N grid) depth.Combined with the resort to complexity-theoretic assumptions for which there is little guidance (mostly due to lack of experience) in terms of concrete parameter settings, this has led to an ongoing race in efficient simulations [CZX + 18, HNS18, MFIB18].Indeed, the proposals operate in a limited computational regime, requiring a machine with, say, at least 50 qubits (to prevent direct clasical simulation) but at most 70 qubits (so that verification can be performed in a reasonable amount of time) -leaving open the question of what to do with a device with more than, say, 100 qubits.At a more conceptual level, the proposals are based on computational tasks that appear arbitrary (such as the implementation of a random quantum circuit from a certain class).In particular, they do not lead to any further characterization of the successful device, that could be used to e.g.build a secure delegation protocol or even simply certify a simple property such as the preparation of a specific quantum state or the implementation of a certain class of measurements.
We propose a different kind of experiment, or "test of quantumness", for large but noisy quantum devices, that is inspired from recent work of Bravyi et al. on the power of low-depth quantum circuits [BGK17].Our test is applicable in a regime where the device has a large number of qubits, but may only have the ability to implement circuits of low (constant) depth, due e.g. to a limited gate fidelity.We argue that the test overcomes the main limitations outlined above: it generates useful outcomes (certifiably random bits), it is easily verifiable (in classical linear time), and it is robust to a small amount of error (it is sufficient to generate outputs within constant statistical distance from the ideal distribution1 ).The test does not require any assumption from complexity theory, but instead considers a novel physical assumption (introduced in [BGK17]): that the device implements a circuit whose depth is at most a small constant times the logarithm of the number of qubits.Intuitively, this assumption trades off locality (as required by the Bell test) for time (as measured by circuit depth).It is particularly well-suited to quantum devices for which the number of qubits can be made quite large, but the gate fidelity remains low, limiting the depth of a circuit that can be implemented.Informally, we show the following.
Then C achieves exponential randomness expansion: a sample from D can be obtained using O(log 2 M) uniformly random bits and outputs of the circuit must have Ω(M d ) bits of entropy.
We refer to Theorem 6.7 for a precise statement.In particular, the output entropy is quantified using the quantum conditional min-entropy, conditioned on the inputs to the circuit and quantum side information that may be correlated with the initial state of the circuit.Note that the resulting test is far more robust than most existing proposals, that require the output distribution to be multiplicatively close to the target distribution.In contrast, in our case it is sufficient to hit a certain target (the relation R, that itself is very permissive) an inverse polynomial fraction of the time!Aside from the application to randomness expansion, Theorem 1.1 strengthens the main result of Bravyi et al. [BGK17] in multiple ways.Bravyi et al. provide a relation such that for any classical circuit of sufficiently low depth, there exists an input such that the circuit must return an output that satisfies the relation with probability bounded away from 1.In contrast, we point out the existence of an efficiently sampleable distribution on inputs such that, for any classical low-depth circuit, we know that on average over the choice of an input the circuit returns an output that satisfies the relation with at most small probability.While this improvement follows using a simple extension of the arguments in [BGK17], it is key to the practical relevance of the scheme.In addition we make a further improvement and address the following question left open in [BGK17]: how small can the maximum success probability of all low-depth classical circuits (i.e. the "soundness") be made?Theorem 1.2 (Exponential soundness).Let N be an arbitrary integer and M = N 2 .There exists a distribution D on {0, 1} M and an efficiently verifiable relation R ⊆ {0, 1} M × {0, 1} M such that the following holds, for universal constants c, c ′ > 0: • (Completeness) There exists a depth-3 geometrically local (in 2D) quantum circuit such that for any input x in the support of D the circuit samples a y such that (x, y) ∈ R with probability 1.
• (Soundness) For any classical circuit of depth D ≤ c log N, the probability that (x, y) ∈ R, for x ∼ D and y the output of the circuit on input x, is O(exp(−N c ′ )).
Note that the improvement in soundness between our two results is enabled by the fact that in Theorem 1.2 it is no longer the case that it is possible to sample from D using poly-logarithmically many bits.Arguably, good soundness guarantees are crucial to a successful experimental demonstration: due to the presence of noise the quantum device cannot be expected to succeed with probability arbitrarily close to 1, so that the lower the performance of classical circuits, the lower the requirements on the quantum circuit as well.
We comment on the depth assumption that underlies our results.First we note that the ideal behavior for the quantum circuit in our experiment is relatively straightforward to implement, requiring only a Clifford circuit of depth 3 acting locally on a 2D grid.Current state-of-the art in experiments comes close to implementing such circuits on, say, a 10 × 10 grid.In order to gain confidence in the depth assumption required in Theorem 1.1, one should have the ability to execute the ideal depth-3 quantum circuit in an amount of time that precludes the execution of a fast classical circuit of much larger depth, say, 30.This can be accomplished even with quantum gate times that are about 10 times slower than classical gate times, which although admittedly not currently practical, is not an unreasonable assumption in the medium-term.
One may imagine other experimental scenarios where our test is relevant.For example, the ideal quantum behavior can also be implemented in a two-phase procedure of the following form.Consider a network of constant-qubit devices arranged in a N × N grid.In a first phase, the devices use local quantum communication channels to distribute EPR pairs between nearest-neighbors.This phase can be implemented offline.In a second phase, each device receives a classical input, performs a simple local measurement, and returns a classical output (no communication is required).Our result implies that, to even approximately reproduce the output distribution implemented by this procedure, a classical network would need to perform at least Ω(log N) iterations, where at each iteration a device can communicate with a constant number of devices located at arbitrary locations in the network (the network need not be 2D: at each step, a device is allowed to broadcast arbitrarily but can only receive information from a constant number of devices, whose identity must be fixed ahead of time).This suggests an interesting test for a future quantum internet.
Proof idea.Our starting point is the key observation, made by Bravyi et al. [BGK17], that a sub-logarithmic depth circuit made of gates with constant fan-in has a form of implied locality, where the "forward lightcone" of most input vertices only includes a vanishing fraction of output vertices.In particular, two randomly chosen input locations are unlikely to have overlapping lightcones.If the input to the circuit is non-trivial in those two locations only, then the outputs in each input location's forward lightcone are obtained by a computation that depends on that input only.In other words, we have a reduction from classical, lowdepth circuits to two-party local computation that exactly preserves properties of the output.While the same lightcone argument holds true for a quantum circuit, the quantum circuit has the ability of distributing entanglement across any two locations in depth 2, by executing a sequence of entanglement swapping procedures in parallel.Thus the same reduction maps a quantum, low-depth circuit to a two-party local computation, where the parties may perform their local computation on a shared entangled state.Since there are wellknown separations between the kinds of distributions that can be generated by performing local operations on an entangled state, as opposed to no entanglement at all -this is precisely the scope of Bell inequalities -Bravyi et al. have obtained a separation between the power of low-depth classical and quantum circuits.
We build on this argument in the following way.Our first contribution is to boost the argument in [BGK17] from a worst-case to a "high probability" statement.Instead of showing that (i) for every classical circuit, there is some choice of input on which the classical circuit will fail, and (ii) there is a quantum circuit that succeeds on every input, we show that there exists a suitable distribution on inputs that is such that, (i) any classical circuit fails with high probability given an input from the distribution, and (ii) there is a quantum circuit that succeeds with high probability (in fact, probability 1) on the distribution.Second, we observe that the construction in [BGK17] imposes constraints not only on classical low-depth circuits, but also on quantum low-depth circuits; this observation enables the reduction to nonlocal games hinted at above.Finally, we amplify the argument to show how a polynomial number of Bell experiments can be simultaneously "planted" into the input to the circuit.This allows us to perform a reduction to a nonlocal game in which there is a large number of players divided into pairs which each perform their own distinct Bell experiment.By adapting techniques from the area of randomness expansion from nonlocal games [AFDF + 18] we are then able to conclude that any sub-logarithmic-depth circuit, classical or quantum, that succeeds on our input distribution, must generate large amounts of entropy.Moreover, this guarantee holds even if the circuit only correctly computes a sufficiently large but constant fraction of outputs for the games.
Related work.Two recent works investigate the question of certified randomness generation outside of the traditional framework of Bell inequalities.In [BCM + 18] randomness is guaranteed based on the computational assumption that the device does not have sufficient power to break the security of post-quantum cryptography.The main advantages of this proposal are that the assumption is a standard cryptographic assumption, and that verification is very efficient.A drawback is the interactive nature of the protocol, where only a fraction of a bit of randomness is extracted in each round.In [Aar18], Aaronson announced a randomness certification proposal based on the Boson Sampling task.The main advantage of the proposal is that it can potentially be implemented on a device with fewer than 100 qubits.Drawbacks are the difficulty of verification, that scales exponentially, and the resort to somewhat non-standard complexity conjectures, for which there is little evidence of practical hardness (e.g. it may not be clear how to set parameters for the scheme so that an adversarial attack would require time 2 80 ).In comparison, we would say that an advantage of our proposal is its simplicity to implement (on an axis different from Aaronson's: we require many more qubits, but a much simpler circuit, of constant depth and with classically controlled Clifford gates only), its robustness to errors, and its ease of verification.A possible drawback is the physical assumption of bounded depth, that may or may not be reasonable depending on the scenario (in contrast to cryptographic or even complexity-theoretic assumptions, that operate at a higher level of generality).
Acknowledgments.The authors thank Adam Bouland for helpful discussions and members of the Caltech theory reading group (Matthew Weidner, Andrea Coladangelo, Jenish Mehta, Chinmay Nirkhe, Rohit Gurjar, Spencer Gordon) for posing some of the questions answered in this work.
Thomas Vidick is supported by NSF CAREER Grant CCF-1553477, AFOSR YIP award number FA9550-16-1-0495, MURI Grant FA9550-18-1-0161, a CIFAR Azrieli Global Scholar award, and the the Institute for Quantum Information and Matter, an NSF Physics Frontiers Center (NSF Grant PHY-1733907).Jalex Stark is supported by NSF CAREER Grant CCF-1553477, ARO Grant W911NF-12-1-0541, and NSF Grant CCF-1410022.Matthew Coudron is supported by Canada's NSERC and the Canadian Institute for Advanced Research (CIFAR), and through funding provided to IQC by the Government of Canada and the Province of Ontario.

Notation
Finite-dimensional Hilbert spaces are designated using caligraphic letters, such as H.A register A, B, R, represents a physical subsystem, whose associated Hilbert space is denoted H A , H B , etc.We write Id R for the identity operator on H R .We write Pos (H) for the positive semidefinite operators on H, and U (H) for the unitary operators.A POVM {M a } on H is a collection of positive semidefinite operators on H such tht ∑ a M a = Id.For X a linear operator on H, we write Tr(X) for the trace and X 1 = Tr √ X † X.For an integer d ≥ 1 an observable over Z d is a unitary operator A ∈ U (H) such that A d = Id.For ω = e 2iπ d and taking addition modulo d we write for the generalized qudit Pauli X and Z operators, which are observables acting on H = C d .

Nonlocal games
We consider two types of games: multiplayer nonlocal games, and circuit games.Circuit games are nonstandard, and we introduce them in Section 5. Nonlocal games are defined as follows.
We call an element x ∈ X in the support of π a query, and for i ∈ {1, . . ., ℓ} an entry x i of x a question to the i-th player.We refer to the function V(•|•) as the win condition for the game, and for any query x, to a tuple a such that V(a|x) = 1 as a valid (or winning) tuple of answers (to query x).When players return valid answers we say that they win the game.
The entangled value (or simply value) of G, ω * (G), is defined as the supremum over all strategies τ of ω * τ (G).
To compare strategies we first introduce a notion of distance between measurements, with respect to an underlying state.(This is a standard definition in the area of self-testing.)Definition 2.4 (State-dependent distance).Let ρ be a density matrix in H and let M = {M a } a , N = {N a } a be two POVM on H that have the same set of outcomes.The state-dependent distance between M and N is (1) Definition 2.5 (Closeness of strategies).Let τ = (ρ, {M a i x i }), τ = ( ρ, { Ma i x i }) be strategies for an ℓ-player nonlocal game G.We say that τ is ε-close to τ if and only if ρ − ρ 1 ≤ ε and for all i ∈ {1, . . ., ℓ} it holds that E x d ρ (M x i , Mx i ) ≤ ε, where the expectation is over x = (x 1 , . . ., x ℓ ) drawn from π. Definition 2.6 (Isometric strategies).Let τ = (ρ, {M a i x i }) and τ ′ = (ρ ′ , {(M ′ ) a i x i }) be strategies for an ℓ-player nonlocal game G, and ε > 0. We say that τ is ε-isometric to τ ′ if and only if there exist isometries Definition 2.7.We say that a game G is robustly rigid if the following holds.There is a continuous function f : R + → R + such that f (0) = 0 and a strategy τ for G such that for any δ ≥ 0, any strategy τ ′ with value at least ω * τ (G) − δ is f (δ)-isometric to τ.We refer to f as the robustness of the game.
Note that for a game to be robustly rigid it is necessary that there exists a unique strategy τ such that ω * τ (G) = ω * (G), up to isometry.

Circuits
We consider layered circuits over an arbitrary gate set.The choice of a specific gate set may affect the depth of a circuit; for concreteness, the reader may consider the standard gate set {X, Z, H, T, CNOT}.In general, gates in the gate set used to specify the circuit may have arbitrary fan-out, but are restricted to fan-in at most K, where K ≥ 2 is a parameter that is considered a constant (in contrast to the depth D of the circuit, that is allowed to grow with the number of input wires to the circuit).Note that if C is a quantum circuit, "fan-in" is the same as locality, i.e. the number of qubits that a gate acts on nontrivially.In particular, for quantum circuits bounded fan-in automatically implies bounded fan-out.
It is convenient to generalize the usual notion of Boolean circuit to allow circuits that act on inputs taken from a larger domain, e.g.C : Σ n → Σ m , where Σ is a finite alphabet.Similar to the fan-in, whenever using the O(•) notation we consider the cardinality of Σ a constant.A circuit of depth D and fan-in K over Σ can be converted in a straightforward way in a circuit of depth D and fan-in K • ⌈log 2 |Σ|⌉ over {0, 1}.For the case of quantum circuits, allowing a non-Boolean Σ amounts to considering a circuit that operates on d-dimensional qudits, for d = |Σ|, instead of 2-dimensional qubits.

Min-entropy
Given a bipartite density matrix ρ AB we write H(A|B) ρ , or simply H(A|B) when ρ AB is clear from context, for the conditional von Neumann entropy, H(A|B) = H(AB) − H(B), with H(X) σ = −Tr(σ ln σ) for any density σ on H X .
We recall the definition of (smooth) min-entropy.
Definition 2.8 (Min-entropy).Let ρ XE be a density matrix on two registers X and E, such that the register X is classical.The min-entropy of X conditioned on E is defined as When the state ρ with respect to which the entropy is measured is clear from context we simply write H min (X|E) for H min (X|E) ρ .For ε ≥ 0 the ε-smooth min-entropy of X conditioned on E is defined as where B(ρ XE , ε) is the ball of radius ε around ρ XE , taken with respect to the purified distance. 2he following theorem justifies the use of the smooth min-entropy as the appropriate notion of entropy for randomness extraction.
Theorem 2.9 ([DPVR12]).For any integers n, m and for any ε > 0 there exists a d = O(log 2 (n/ε) • log m) and an efficient classical procedure EXT : {0, 1} n × {0, 1} d → {0, 1} m such that for any density matrix ρ XE = ∑ x |x x| ⊗ ρ x E such that the register X is an n-bit classical register and where for an integer ℓ ≥ 1, U ℓ = 2 −ℓ Id is the totally mixed state on ℓ qubits and ρ E = ∑ x ρ x E .

Stabilizer games
In this section we introduce a restricted class of nonlocal games that we will be concerned with throughout the paper.We call the games stabilizer games.They have the property that the game always has a perfect quantum strategy τ = (ρ, {M x i }) that uses an entangled state ρ = |ψ ψ| that is a graph state, on which the players make measurements that are specified by tensor products of Pauli observables.It is important for our results that there is a perfect strategy such that the entangled state can be prepared by a quantum circuit of low depth (in fact, constant depth) starting on a |0 state.It will also be convenient that the same perfect strategy only requires the measurement of Pauli operators, and that the win condition in the game is a linear function of the players' answers.
We proceed with a formal definition.The games we consider have ℓ players.In the intended strategy for the players, each player j ∈ {1, . . ., ℓ} holds k j qudits, measures m j commuting Pauli observables over Z d (depending on its question), and reports the m j outcomes.Definition 3.1 (Stabilizer game).An (ℓ, k, m) stabilizer game G = (X i , {w x , b x }) is an ℓ-player nonlocal game defined from the following data.
• a number of players ℓ, • a parameter d for the dimension of the qudits (in the honest strategy), • for j ∈ {1, . . ., ℓ}, a parameter k j for the number of qudits held by the j-th player (ibid), • for j ∈ {1, . . ., ℓ}, a parameter m j for the number of simultaneous measurements made by the j-th player (ibid), • for j ∈ {1, . . ., ℓ}, a set X j , each element of which is identified with a k j -qudit Pauli, • a distribution π on queries x ∈ ∏ ℓ j=1 X m j j , such that any (x 1 , . . ., x ℓ ) in the support of π is such that for each j, x j designates an m-tuple of commuting k j -qudit Pauli observables, • for each query x in the support of π, a vector w x ∈ ∏ ℓ j=1 (Z d ) m j and a coefficient b x ∈ Z d that are used to specify the win condition in the game.
To play, the verifier samples a question x j ∈ X m j for each player.Each player responds with a string a j ∈ Z m j d .Let x = (x 1 , . . ., x ℓ ) and a = (a 1 , . . ., a ℓ ).The players win if where here the inner product is over vectors in Z ∑ m j d . Using the notation from Definition 2.1, V(a|x) = 1 if w x • a = b x , and 0 otherwise.
In a stabilizer game each player is tasked with reporting m values in Z d .It is then natural to use a representation of strategies in terms of observables over Z d .We adapt Definition 2.2 as follows.
Definition 3.2.Let G = (X i , {w x , b x }) be a stabilizer game.A strategy τ = (ρ, {M x j }) for G is specified by an ℓ-partite density matrix ρ and for each j ∈ {1, . . ., ℓ} and x j = (x j,1 , . . ., Note that in the definition, for s ∈ {1, . . ., m j } the observable M x j ,s may depend on the whole m j -tuple x j , and not only on x j,s .
We introduce a notion of "honest strategy" in a stabilizer game.
Definition 3.3 (Honest strategy).Let G = (X j , {w x , b x }) be a stabilizer game.A honest strategy in G is a strategy in which the state ρ is an (∑ j k j )-qudit ℓ-partite pure state |ψ such that the j-th player has k j qubits, and the player's observables M x j = (M x j ,1 , . . ., M x j ,m ) associated with question x j = (x j,1 , . . ., x j,m j ) ∈ X m j j are precisely the m j commuting Pauli observables specified by x j .We say that the strategy has depth d if the state |ψ can be prepared by a quantum circuit of depth at most d starting from the |0 state.

Pauli observables
We introduce convenient notation for working with the Pauli observables.Definition 3.4 (Notation for many-qudit Paulis).Given an integer d ≥ 1 and a tuple s ∈ Z 2 d , we write P s = X s 0 Z s 1 for a one-qudit Pauli acting on C d .Given an integer n ≥ 1 and a string r ∈ (Z 2 d ) n , we write P r = ⊗ i P r i for an n-qudit Pauli acting on (C d ) ⊗n .Definition 3.5 (Correction value).Let q be a k-qudit Pauli operator and r ∈ (Z where the brackets denote the group commutator, [p, q] = pqp −1 q −1 .
The following lemma shows that the function cor can be computed locally.
Lemma 3.6 (cor can be computed locally).For a string s, let s| i denote the string which is equal to s i in the i th position and 0 everywhere else.Then Proof.First, notice that To see this, recall that cor is computed as the phase of the group commutator of a P r| i and σ(q).We can evaluate this group commutator one tensor factor at a time.In all tensor factors other than i, the commutator will be trivial since the r operator is identity.Therefore, the commutator does not change if we also set the q operator to identity.Next, we need that for any fixed q, the map r → cor r (q) is an additive homomorphism.In other words, To see this, we apply Lemma 3.7 with A = σ(q), B = P r , C = P r ′ .The lemma follows by combining Equations ( 5) and ( 6) with the observation that r = ∑ i r| i .
where the last line follows from commutation of B and [A, C].

Rotated and stretched stabilizer games
In this section we define stretched stabilizer games which formalize the notion of distributing a stabilizer game out over long "paths".One property of stretched games is that players on far ends of the paths have outputs which require correction according to a function of the outputs along the intermediate points in the paths.We introduce a notion of rotated stabilizer game that captures this scenario by allowing the players to report an additional "rotation string".
Definition 3.8 (Rotated stabilizer game).Given a stabilizer game G = (X j , {w x , b x }) the rotated stabilizer game associated with G, G R , is defined as follows.For each j ∈ {1, . . ., ℓ} and question x j ∈ X m j j , the j-th player reports an answer a j ∈ Z m j d together with a rotation string where r = (r 1 , . . ., r ℓ ).
Observe that if r is the 0 vector then for any q, cor r (q) = 0, so the win condition for the rotated game G R reduces to the win condition for G. Therefore any strategy for G implies a strategy for G R with the same success probability.More generally, it is possible to define a strategy in G R by having the players conjugate their observables in G by an arbitrary Pauli observable (the same for all observables), and report as rotation string the string that specifies the observable used for conjugation.
Using Lemma 3.6 it follows that there is a reduction in the other direction as well.Given a strategy for G R , one obtains a strategy for G by replacing the answer (a i , r i ) from the i-th player in G R by the answer in G.The following lemma summarizes this observation in terms of rigidity of the rotated game.Recall the definition of a robustly rigid game in Definition 2.7.
Lemma 3.9 (Rotation preserves rigidity).Suppose that a stabilizer game G is robustly rigid (see Definition 2.7).Let τ = (|ψ ψ| , {M x j }) be a rigid strategy and f the robustness.Then the rotated stabilizer game G R is rigid in the following sense.For any strategy τ = (ρ ′ , {M ′ there is a strategy in G that is a coarse-graining of (ρ ′ , {M ′ x j }) according to (8), 3 and that has value w ′ in G.In particular, up to local isometries the state ρ ′ is within distance We introduce a notion of "stretched" rotated game, that will be useful when we relate circuit games to stablizer games.Definition 3.10 (Stretched stabilizer game).Let G = (X j , {w x , b x }) be a stabilizer game, and Γ = (Γ 1 , . . ., Γ ℓ ) an ℓ-tuple of finite sets, such that for j ∈ {1, . . ., ℓ}, Γ j has k j designated elements (u j,1 , . . ., u j,k j ).Each element of Γ j is used to index one out of |Γ j | qudits that are supposed to be held by the j-th player.To G and Γ we associate a "stretched" game G S Γ as follows.In G S Γ the parameter k j is replaced by k ′ j = |Γ j |.For any k j -qudit Pauli observable asked to player j in G, there is a k ′ j -qubit Pauli observable in G S Γ such that the observable acts as the identity on the additional (k ′ j − k j ) qubits.The win condition in G S Γ is the same as in G.
Given a stabilizer game G and sets Γ = (Γ 1 , . . ., Γ ℓ ), we write G S,R Γ = (G S Γ ) R for the rotated stretched stabilizer game associated with G and Γ.

Repeated games
For an integer r ≥ 1 we consider the game that is obtained by repeating a stabilizer game r times in parallel, with r independent sets of ℓ players (that may share a joint entangled state).Definition 3.11.Let G be an (ℓ, k, m) stabilizer game, and r ≥ 1 an integer.The r-fold repetition of G is the (rℓ, k) stabilizer game G r that is obtained by executing G independently in parallel with r groups of ℓ players.More formally, the input distribution π r in G r is the direct product of r copies of the input distribution π in G, and the win condition in G r is the AND of the win conditions in each copy of G.
For purposes of randomness expansion, in Section 6 we consider repeated games for which the input distribution π r is not exactly the direct product of r copies of π, but a derandomized version of it.Similarly, to achieve better robustness, instead of the AND of the winning conditions we may consider a win condition that is satisfied as soon as sufficiently many of the win conditions for the subgames are satisfied.These modifications are explained in Section 6.1.

The Magic Square game
For concreteness we give two examples of stabilizer games, the Memin-Peres Magic Square game [Mer90b] and the Mermin GHZ game [Mer90a].The former is given for illustration; the latter will be used towards randomness expansion in Section 6. Definition 3.12 (Magic Square game).Consider the following 3 × 3 matrix, where each entry is labeled by a two-qubit Pauli observable: The Magic Square game is a (2, 2, 2) stabilizer game over 2-dimensional qubits defined as follows.The sets X 1 = X 2 each contain 6 pairs of two qubit-Pauli observables, the first two pairs indicated in each of the rows and columns of (9).The distribution π is uniform on pairs of entries associated with the same row or column.For any query x = (x 1 , x 2 ) each player reports two bits associated with the two observables it was asked about.We can associate a third bit to the third observable in the corresponding row or column by taking the parity of the first two bits, except for the case of the third column, where we take the parity plus 1.The constraint w x • a = b expresses the constraint that, whenever the questions x 1 , x 2 are associated with a row and column that intersect in an entry of the square, the outcomes associated with the intersection should match.
Definition 3.13 (Honest strategy in the Magic Square game).In the honest strategy, the two players share two EPR pairs.Upon reception of a question that indicates two commuting two-qubit Pauli observables, the player measures both observables on her qubits and reports the two outcomes.
The following robustness result is shown in [WBMS16].
Theorem 3.14.The Magic Square game is robustly rigid, with respect to the honest strategy and with robustness Next we recall the Mermin GHZ game.
It is well-known that the game GHZ has quantum value 1, and there is a honest strategy based on making Pauli measurements on a GHZ state |ψ GHZ = 1 √ 2 (|000 + |111 ), which can be prepared in depth 3.

Lightcone arguments for low-depth circuits
Let N ≥ 1 be an integer.We write GRID N for the set {1, . . ., N} 2 , that we often identify with the "grid graph" of degree 4, which is the graph on this vertex set with an edge between (i, j) and (i ± 1, j ± 1), with addition taken modulo N. (As a matter of notation we often identify a graph with its vertex set.) For an integer 0 ≤ L ≤ N and u ∈ GRID N we write Box L (u), or Box(u) when L is implicit, for the set Box L (u) = {u} + {−L, . . ., L} 2 ⊆ GRID N (with addition again taken mod N).(In other words, Box L (u) is the ball of radius L around u in the L ∞ metric.)

Lightcones
Recall that the circuits that we consider are defined over an arbitrary gate set with bounded fan-in K. Given a circuit C, we introduce the natural notion of a circuit graph, with vertices at the gates and edges along the wires.
Definition 4.1.Let C be a circuit.The circuit graph associated with C is a directed graph on vertex set V = I ∪ U ∪ O.Here I contains one vertex for each input wire, O contains one vertex for each output wire, and U contains one vertex for each gate.There is an edge from u to v if the output of u is an input of v.
In particular, all vertices of I are sources (have indegree 0) and all vertices of O are sinks (have outdegree 0).We call vertices in I input vertices and vertices in O output vertices.
We typically consider circuits that are spatially local on a 2D grid, in which case we identify the input and output sets of the graph with a grid, i.e.I = O = GRID N for some integer N ≥ 1.Note that the circuit graph of a circuit with fan-in K has in-degree bounded by K, but has no a priori bound on the out-degree.Definition 4.2.Let C be a circuit.For a vertex v in the circuit graph define its backward lightcone L b (v) as the set of input vertices u for which there exists a path in the circuit graph from u to v.For an input vertex u define the forward lightcone of u, L f (u), as the set of output vertices v such that u ∈ L b (v).
The following lemma is established in Section 4.2 of [BGK17] during the proof of their Theorem 2. We include the short proof for completeness.

Lemma 4.3 ([BGK17]
).Let C be a circuit that has depth D and maximum fan-in K. Then the following hold: • All backward lightcones are small.That is, for every vertex v of the circuit graph, |L b (v)| ≤ K D .
• Most forward lightcones are small.That is, for any µ ∈ (0, 1), where the probability is taken over the choice of a uniformly random input vertex v ∈ I.
Proof.Every path in the circuit graph has length at most D. Each vertex has indegree at most K. Then for any fixed vertex v, there are at most K D distinct paths through the circuit graph ending at v. Therefore, . Each vertex has an in-degree of at most K D , so there are at most nK D edges in the graph, where n is the number of output wires for the circuit.Fix µ ∈ (0, 1).By Markov's inequality, at most µn vertices may have out-degree at least 1 µ K D .

Input patterns
We introduce a method to "plant" queries to the players in a stabilizer game into the input to a circuit.The main definition we need is of an input pattern, that specifies locations for each players' question, as well as paths between these locations.These paths, or "stars", will be useful in the design of a quantum circuit that implements the players' strategy as a low-depth quantum circuit; this is explained in Section 5.1.
grid edges are not shown on the picture).The paths may be extended inside each box to connect the vertices u 1 , u 2 , u 3 to g 1 , g 2 , g 3 in an arbitrary way.Such connections will be used in Section 5.1 to define low-depth measurements which distribute a three-qubit state at sites g 1 , g 2 , g 3 among the qubits u 1 , u 2 , u 3 .On the right, we show the contraction of the star to a star graph.The paths are contracted to single edges (still drawn with curves) and the boxes are contracted to single vertices (shown by filled-in circles).
Definition 4.4 (Star).See Figure 1.We say a subset of GRID N is a box if it is equal to Box L (u) for some integer L and vertex u.A star Γ is a collection of disjoint boxes together with a collection of disjoint paths such that • each path has its endpoints on the boundaries of boxes and • contracting each box to a single vertex, and each path to a single edge, results in a a star graph, i.e. a graph that has ℓ vertices of degree one, one vertex of degree ℓ, and no other vertices.
We use the term central box to refer to the unique box which contains one endpoint of every path.If b 0 is the central box, we may say that the star Γ is centered at b 0 .By abuse of notation, we often write Γ to refer to the set of vertices contained in the paths and boxes of Γ.
The following definition captures exactly the amount of information that we need to remember about a given circuit C in order to talk about the spread of correlations within C -we will forget everything about the circuit except some information about its lightcones.Definition 4.5 (Input pattern).Let G be an (ℓ, k, m) stabilizer game.Let 1 ≤ r ≤ N be integer.An input pattern associated with (G, N, r) is a tuple P = {(u (i) , Γ (i) )} 1≤i≤r such that ) is an ℓ-tuple of vertices of GRID N , which we refer to as input locations, • each Γ (i) is a star, • the vertices of u (i) are contained in distinct noncentral boxes of Γ (i) .Definition 4.6 (Circuit specification).A circuit specification S on GRID N is a triple S = (L f , BAD in , BAD out ) such that for all u ∈ GRID N , L f (u) ⊆ GRID N is a set called the forward lightcone associated with u, and BAD in , BAD out ⊆ GRID N are sets called the bad input set and bad output set respectively.Definition 4.7.For integer B, R in , R out we say that a circuit specification S Given a fixed circuit specification, the following definition captures the conditions that are required for an input pattern so that the circuit game associated with that input pattern can be reduced to a nonlocal game (the reduction is explained in Section 5).
The intuition to keep in mind for the definition is as follows: each player in the nonlocal game receives her input from one of the input locations and puts her output along the paths of the star.Each player also puts some outputs inside their box of the star.In order for it to be possible to implement the strategy locally, we must have the outputs of each player be causally independent of the inputs of the other players.We ensure this by checking that the forward lightcone of one player's input misses the locations of the other players' outputs.
Definition 4.8 (Causality-respecting patterns).Let S = (L f , BAD in , BAD out ) be a circuit specification.Let P = {(u (i) , Γ (i) ) i } be an input pattern.We say that a pair (u (i) , Γ (i) ) is individually-S-causal with respect to P if the following hold:4 (a) For each u j ∈ u (i) , the forward lightcone of u j misses Γ (i) , except possibly near u j .More precisely, (b) For all (u (j) , Γ (j) ) ∈ P (with j = i) and for all k, the forward lightcone of u Furthermore, we say that a pair (u, Γ) is S-valid if the following conditions hold.
(d) Every input location lies outside of BAD in , i.e. u j ∩ BAD in = ∅ for all u j ∈ u.
We say that an input pattern P is S-causal if every (u (i) , Γ (i) ) ∈ P is individually-S-causal and S-valid with respect to P, and the stars Γ (i) are pairwise disjoint.
Finally, we introduce a distribution on input patterns so that for any reasonable circuit specification S, a sample from the distribution gives an S-causal pattern with high probability (see Section 4.3 and Section 4.4).Definition 4.9 (Random input patterns).Let L, N ≥ 1, ℓ ≥ 1, and 1 ≤ r ≤ N be integer such that ℓ uniformly at random among the T boxes that partition the i-th square S (i) , for j ∈ {1, . . ., ℓ}, a vertex u (i) j uniformly at random within the j-th selected box.Finally, select a star ℓ ) uniformly at random.Return the input pattern P = {(u (i) , Γ (i) )} 1≤i≤r .

Single-input patterns
We'd like to show that patterns in the support of D (r) are "very nearly" S-causal for most S in the sense that removing only an exponentially small fraction of inputs yields an S-causal pattern.To warm up, we argue that for any (B, R in , R out )-bounded circuit specification S, an input pattern sampled from the distribution D (1) introduced in Definition 4.9 is S-causal with high probability.We use this single-input analysis later to show that in a many-input pattern, most of the inputs are individually-S-causal.
In this subsection only, we use M instead of N to denote the grid size.We do this because the distribution D (r) (N, L) can be (informally) thought of as the direct product of r copies of D (1) (M, L), and the former is of greater interest to us.
be drawn from the distribution D (1) introduced in Definition 4.9.Then the probability that (u, Γ) is not individually-S-causal with respect to P is at most 16(L 2 (R out + B)/M 2 ) + ℓR out /L.Moreover, the probability that P is not S-valid is at most 8R in /M 2 .Overall, the probability that where the O notation hides factors polynomial in ℓ.
Proof.We check all conditions in Definition 4.8.Since our pattern contains only one (input, star) pair, condition (b) (which restricts the interactions between pairs) is satisfied automatically.Now we check conditions (a) and (c).Call a box bad if it intersects BAD out .Under D (1) there are ⌊M/(2L + 1)⌋ 2 ≥ 1/4(M/2L) 2 possible box locations.The probability that any box is bad is then at most 16L 2 R out /M 2 = O(L 2 R out /M 2 ).There are at least L/ℓ = Ω(L) possible choices for the paths of Γ.Since all such choices are disjoint, the probability that Γ ∩ X = ∅ for some subset X is at most ℓ |X| /L.Letting X = BAD out ∪ i L f (u i ), then |X| ≤ R out + ℓB, we see that the probability of violating condition (a) or condition (c) is at most O ℓR out +ℓ 2 B L .
Similarly, since the u j are chosen independently, for any u = u ′ ∈ {u 0 , u 1 , . . ., u ℓ } the probability that Finally we check condition (d), S-validity.Any u j is chosen among (2L + 1) 2 ≥ M 2 /8 = Ω(M 2 ) possibilities, so the probability that u j ∈ BAD in is 8R in /M 2 = O(R in /M 2 ); we conclude by the union bound, and absorb the parameter ℓ in the O(•).

Arbitrary-input patterns
We extend the argument from the previous section to the case where the input pattern contains more than one input.
Lemma 4.11 (Random input patterns are usually causal).Let N ≥ 1, 1 ≤ r ≤ N and 1 ≤ B, R in , L ≤ N/4 be integer.Let S = (L f , BAD in , ∅) be a circuit specification for GRID N that is (B, R in , 0)-bounded.Then the probability that an input pattern P chosen according to D (r) (M, L) (as defined in Definition 4.9) is not Proof.Let P = {(u (i) , Γ (i) )} be an input pattern in the support of D (r) (M, L).For i ∈ {1, . . ., r} let X i be the indicator variable that the pair (u (i) , Γ (i) ) is not individually-S-causal with respect to P. Let Y i be the indicator that (u (i) , Γ (i) ) is not S-valid.
By definition of D (r) (M, L) the stars Γ (i) are disjoint.Therefore, to see that P is S-causal, it suffices to check that each input is S-valid and individually-S-causal with respect to P. This is true if and only if ∑ i X i = 0 and ∑ i Y i = 0.In the following, we bound the probability of these events.
The main observation in the proof is to note that for any i, where we define out ), and Indeed (12) follows by noting that, for this definition of BAD (i) out , condition (c) of being individually-S (i)causal (see Definiton 4.8) implies all conditions of being individually-S-causal for S = (L f , BAD in , ∅).
In the event that P (j) is S-valid for all j = i (that is, when ∑ j =i Y j = 0) we know that L f (u (k) j ) ≤ B for each (j, k) ∈ {1, . . ., ℓ} × {1, . . ., r}, and thus that |BAD Using that the distribution of a single pair (u (i) , Γ (i) ) from P is distributed as in D (1) (M, L) (for an appropriate choice of a square), it follows from the first bound given in Lemma 4.10 that for any i ∈ {1, . . ., r}, Applying the union bound, where the last line follows from (13).
Applying the second bound in Lemma 4.10 it follows that Applying a union bound over the r patterns P (j) , it follows that Removing one term from the sum, we also get that for each i, Pr(∑ j =i Y j = 0) = O(r 2 R in /N 2 ).To conclude we write where the third line uses ( 14) and ( 15) and the fourth uses (15).
In the previous lemma, we aimed to show that a random input pattern P is S-causal.In this case, we can define a game from P so that in this game, a shallow circuit with specification S can be simulated by a set of spacelike-separated players.This simulation is perfect when P is exactly S-causal.If P deviates from S-causality on a constant fraction of inputs, then this simulation loses only a constant amount of accuracy.In the next lemma, we'll aim for the weaker condition on P, with the result that the condition fails with exponentially small probability, rather than just inverse-polynomially small.We'll use this directly in proving Theorem 1.2, an exponential soundness bound for our randomness generation protocol.Lemma 4.12 (Random input patterns are almost always constant-fraction-causal). Let N ≥ 1, 1 ≤ r ≤ N and 1 ≤ B, R in , L ≤ N/4 be integer.Let S = (L f , BAD in , ∅) be a circuit specification for GRID N that is (B, R in , 0)-bounded.Consider an input pattern P chosen according to D (r) (M, L).Define two subsets of P P VAL = (u, Γ) ∈ P |(u, Γ) is S-valid , P CAUS = (u, Γ) ∈ P |(u, Γ) is individually-S-causal with respect to P VAL .
Then the following bounds on the sizes of P VAL and P CAUS hold: for any t > 0, where p = rB(16rL 2 /N 2 + ℓ/L).
For later convenience, we note that bounds ( 16) and ( 17) can be combined by a union bound to obtain Proof.Let P = {(u (i) , Γ (i) )} be an input pattern chosen at random according to the distribution D (r) (M, L).
For i ∈ {1, . . ., r} define BAD out ) be a specification on the grid GRID

(i)
M associated with the i-th input, where M = ⌊N/ √ r⌋.Similarly, define the specifications S (<i) = (L f , BAD in , BAD <i out ), and S (>r−i) = (L f , BAD in , BAD

>(r−i) out
)), seen as a specification on the grid GRID

(i)
M associated with the i-th input.Let X i be the indicator variable for the event that the pair (u (i) , Γ (i) ) is not individually-S (i) -causal with respect to P VAL .
Define Y i (resp.Z i ) as the indicator variable for the event that the pair (u (i) , Γ (i) ) is not individually-S (<i) -causal (resp.individually-S (>r−i) -causal) with respect to the pattern whose only pair is (u (i) , Γ (i) ).We claim that X i = Y i ∨ Z r−i , or equivalently, ¬X i = ¬Y i ∧ ¬Z r−i .This follows by noting that, in Definition 4.8, condition (a) of X i , Y i and Z r−i are all equivalent.Condition (b) of X i is equivalent to the event that condition (c) of both Y i and Z r−i is true.And, finally, condition (c) of X i is vacuous and conditions (b) of both Y i and Z r−i are vacuous.
Similarly, note that whenever P (i) is individually-S (i) -causal with respect to P VAL , it is also individually-S-causal with respect to P VAL .This follows by noting that for the given definition of BAD (i) out , condition (c) of being individually-S (i) -causal with respect to P implies conditions (b) and (c) of being individually-S-causal with respect to P VAL .Therefore, ∑ i X i is an upper bound on the number of P (i) which are not individually-S-causal with respect to P VAL .Put differently, ∑ i X i is a lower bound on the size of P CAUS .
From the assumption that the circuit specification S is (B, R in , 0)-bounded, and since BAD (i) out is defined as a union of the lightcones of only the valid pairs (u (k) , Γ (k) ), it follows that for all i, BAD (i) out ≤ rB.This immediately implies BAD <i out ≤ rB and |BAD >i out | ≤ rB.Let Y <i = {Y k |k < i} and Z >i = {Z k |k > i}.Note that Y i (resp.Z i ) depends only on the underlying circuit C together with the selection of pairs in squares S (j) for j ≤ i (resp.j ≥ i).It follows from the first bound in Lemma 4.10 that and similarly Let p = O(rB(16rL 2 /N 2 + ℓ/L)) denote the maximum of the bounds on the right-hand side of ( 19) and (20), and assume p ≤ 1. and Additionally, it always holds that where the last inequality follows from the assumption that p ≤ 1.Similarly, Thus, both Ȳn , and Zr−n form super-martingale sequences for increasing n.Defining Ȳ0 = Zr = 0 and applying Azuma's inequality gives and Replacing t with t/2 proves (16).It remains to show (17).Let V i be the indicator variable for the event that (u (i) , Γ (i) ) is S-valid.Notice that the V i are independent: the (u (i) , Γ (i) ) are chosen independently within the disjoint squares S (i) , and the condition of being S-valid refers only to the underlying circuit and not to interactions between distinct (u, Γ) pairs.Moreover, it follows from the second condition in Lemma 4.10 that where M = ⌊N/ √ r⌋ as in Definition 4.9.Therefore, by Hoeffding's inequality:

Derandomization
Lemma 4.11 states that if a pattern is chosen according to the distribution D (r) (M, L), then it is S-causal with probability that is close to 1, regardless of the choice of S. The following lemma shows that it is possible to partially derandomize the distribution, at little loss in the success probability.
Lemma 4.13.Let N ≥ 1 be an integer and η > 0. Let L, B, R in , r be integer such that Then using O(log 2 N) uniformly random bits it is possible to sample from a distribution D (r) on input patterns P for GRID N such that for any circuit specification S that is (B, R in , 0)-bounded, P is S-causal with probability 1 − O(N −η ), and a random (u, Γ) ∈ P is valid with probability O(R in /N 2 + N −η ).
Proof.The choice of parameters made in the lemma is such that r 3 BL 2 /N 2 = O(N −η ) and r 2 B/L = O(N −η ), so Lemma 4.11 gives that P sampled according to D (r) is S-causal with probability 1 − O(N −η ), and a random (u, Γ) ∈ P is valid with probability O(R in /N 2 ).
A pattern in the support of D (r) (M, L) can be specified using O(r log(N)) uniformly random bits: for each i ∈ {1, . . ., r}, there are O(log N) random bits to specify the locations of the u (i) j , and O(log N) additional bits to specify the star that connects the u (i) j .Given any choice of such random bits, and a fixed circuit specification, by Savitch's theorem it is possible to decide whether the pattern is S-causal in O(log 2 N) space, given read-only access to the circuit graph determining S.This allows us to apply the INW pseudorandom generator for small-space circuits [INW94] with O(log 2 N) seed to obtain the claimed result, with the additional error O(N −η ) being due to the pseudorandom generator.

Circuit games
Let N ≥ 1 be an integer grid size.Let r ≥ 1 be an integer number of repetitions.Let G be a (ℓ, k, m) stabilizer game.In this section we design a circuit game G = G G,N,r associated with (G, N, r) in a way that the circuit game has similar completeness and soundness properties as G (more precisely, as a rotated, stretched game obtained from G, using the stars in an input pattern P associated with (G, N, r) that is provided as input to the circuit to define the length of the stretches; see Section 3.2 for the definition of rotated and stretched games).
We first give a general definition that specifies what we mean by a "circuit game".
Definition 5.1 (Circuit game).Given input and output sets I, O respectively, a circuit game is a relation R ⊆ I × O, together with a probability distribution π on I.We say that a circuit C wins the circuit game (R, π) with probability p if, on average over an input x ∈ I sampled according to π, the circuit returns an output y ∈ O such that (x, y) ∈ R with probability p.
To specify the relation associated with the circuit game we will construct from G it is convenient to first introduce a quantum circuit that succeeds in the game with certainty.This is done in Section 5.1.In Section 5.2 we give the definition of the circuit game.

Completeness
Informally, the game G G,N,r is obtained by "planting r copies of G in the grid GRID N ".Let P be an input pattern associated with (G, N, r).Let k = max j k j be the maximum number of qudits used by a player in the honest strategy for G, |ψ the (kℓ)-qubit state used in the strategy (padded if needed), and D the depth of a circuit that prepares |ψ from |0 .Assume that D ≥ 2. We describe a depth (D + 1) quantum circuit C ideal that takes an input from and returns a string in the output set In ( 24) we have used the vertices in Γ (i) j and the u (i) j to label indices of the elements of O.Note that these are always distinct.In Section 5.1.2we show how to modify the format for the input and the output in a way that the circuit can be made geometrically local on a 2D grid.
The computation performed by the circuit C ideal proceeds in three stages: • In the first stage, the circuit initializes a lattice of qudits as follows.Each vertex in GRID N is associated with 4k qudits, organized in 4 groups of k that we call the "left", "right", "top" and "bottom" groups associated with that vertex.Each of these groups is initialized in a maximally entangled state with the group from the neighboring grid vertex that is closest to it, i.e. the "top" group at vertex (i, j) is associated with the "bottom" group at vertex (i, j + 1), etc.In addition, for each center location g (i) of a star Γ (i) in P, the circuit creates the state |ψ on the (kℓ) qudits associated with the ℓ vertices (g (i) 1 , . . ., g ℓ ); for each vertex g (i) j , a group of qudits is used that is not connected to the next vertex in the path Γ (i) j .This step can be implemented in depth max(2, D). • In the second stage, the circuit implements an entanglement transfer protocol as described in Section 5.1.1,using each of the ℓ simple paths that form a star Γ (i) from P to route the qudits of |ψ .The measurement outcomes in (Z d ) 2k from the teleportation measurements obtained at each vertex in Γ (i) are recorded at the location at which they are obtained, and will eventually form part of the output of the circuit.This step can be completed in depth 1.
• In the last stage, the circuit implements the honest quantum strategy for the game G, using locations u (i) j indicated in P to specify the k qudits to be used by the j-th player (the group used is the one closest to the endpoint of the path Γ (i) j ), and x (i) j as the player's question.The outcomes obtained are returned as part of the output.This step can be completed in depth 1, and can be executed in parallel with the previous step.
The following lemma states that outputs generated by this circuit satisfy the win condition for an associated rotated, stretched game.
Lemma 5.2.Let G be an (ℓ, k, m) stabilizer game, 1 ≤ r ≤ N, and P an input pattern associated with (G, N, r).Let x (1) , . . ., x (r) be an arbitrary tuple of r queries for G.For all i ∈ {1, . . ., r} and j ∈ {1, . . ., ℓ} let (r d be the outputs generated by an execution of C ideal on input P and (x (1) , . . ., x (r) ).Then for any i ∈ {1, . . ., r}, {(r ..,ℓ} is a valid ℓ-tuple of answers for the players in the rotated stretched game G S,R Γ (i) , on query x (i) .Proof.The lemma follows from the definition of C ideal , the properties of the entanglement transfer protocol stated in Lemma 5.5, and the definition of the rotated, stretched game.

Entanglement transfer
We introduce a simple procedure for routing entanglement along a path, such that nearest neighbors on the path have been initialized in a maximally entangled state.This is a standard calculation; for completeness we include the details.
a maximally entangled state on four qudits.Then upon measuring the qudits in registers B and C in the Bell basis {X x ⊗ Z y |EPR d : x, y ≤ d}, the post-measurement state is equal (up to global phase) to Proof.We evaluate the post-measurement state by computing the result of applying the measurement projector onto the state Lemma 5.4 (Entanglement transfer II).Let n ≥ 1, and L 1 , . . ., L n , R 1 , . . ., R n qudit registers such that each L i is maximally entangled with R i .Suppose one performs (n − 1) Bell basis measurements on qudit pairs (R 1 , L 2 ), . . ., (R n−1 , L n ), so that the post measurement state of the i-th pair is Proof.The (n − 1) Bell basis measurements commute, so we can think of them as being performed in sequence, performing the measurement on (R k , L k+1 ) at the k-th step.Using Lemma 5.3 and induction, one can check that after the k-th measurement, the qudits (L 1 , R k+1 ) are in post-measurement state Lemma 5.5 (Low-depth state teleportation).Let k ≥ 1 be an integer and |ψ a k-qudit state that is locally maximally mixed in the sense that the marginal density matrix at any one qudit is the maximally mixed state.Let N ≥ 1 and A and B be ordered lists of vertices in GRID N with |A| = |B| = k.Let Γ j 1≤j≤k be a set of k vertex-disjoint, even-length paths on the grid, each with one endpoint in A and one endpoint in B.
For any i ∈ {1, . . ., k} denote the points of To each of the "odd-even" qudit pairs (v 1 , v 2 ), (v 3 , v 4 ), . . ., (v l−1 , v l ) apply a gate taking the two qudit state to |EPR d .Next, measure each of the "even-odd" qudit pairs (v 0 , v 1 ), (v 2 , v 3 ), . . ., (v l−2 , v l−1 ) in the Bell basis.Let X a i j ⊗ Z b i j |EPR d be the post-measurement state of the j-th pair.Let P be the weight k Pauli operator supported on the qudits of B such that the i-th qudit of P acts as X a i Z −b i .Then the post-measurement state of the qudits in B is P |ψ .Proof.We analyze the circuit one path at a time.Fix i ∈ {1, . . ., k}.Let x i ∈ A be one endpoint of P i and y i the other.Suppose that |φ is any locally maximally mixed state on a set C of qubits with Now suppose we apply V and then apply the entangling gates and measurements along Γ i .By Lemma 5.4, the state of qudits y i and The equality in (27) can be verified by noticing that Z ⊗ Z † stabilizes |EPR d .Applying V † gives Notice that the operation along the path commutes with V. Therefore, applying V, applying that operation, and then applying V † is equivalent to just applying that operation.Notice that the resulting state continues to be locally maximally mixed.Therefore, we can apply the above repeatedly until all of the path circuits have been applied.Then the final state is as desired.

Geometric locality
We explain how to modify the input and outputs sets I and O specified in ( 23) and ( 24) respectively in a way that both input and output are Boolean strings of the same length that can be organized in a 2-dimensional pattern and such that the circuit described in Section 5.1 can be implemented in the same depth (D + 1) using only geometrically local gates.
Recall that the input to the circuit consists of an input pattern P = {(Γ (i) , u (i) )} 1≤i≤r together with an r-tuple of queries {(x Recall also that we think of the circuit as being organized on an N × N grid of vertices, such that each vertex contains 4 groups of k qudits, each group facing one of the vertex' nearest neighbors on the grid.We index the input and output sets by grid vertices, with each vertex associated with an element taken from a constant-size alphabet Σ that is defined in (29) below.
Each star Γ (i) specifies ℓ paths Γ (i) j from the central box to the noncentral boxes.Assign to one point in each noncentral box the label u (i) j .Also assign to ℓ points inside the central box the labels g (i) j .Extend the paths Γ (i) j so that their endpoints are u (i) j and g (i) j .We naturally distribute each question x (i) j at the grid vertex indicated by u (i) j .
For each edge (v, w) in the path, at vertex v (resp.w) we include a symbol that indicates that a teleportation measurement is to be performed between the group of k qudits nearest to vertex w (resp.v).For any grid vertex v, the output of the circuit at vertex v is either an answer in G, a (i) j ∈ (Z d ) m j , or a teleportation measurement outcome, which is an element of (Z d ) 2k .A question x (i) j is an element of (Z k d ) m j .This leads us to a circuit specification that considers the input and output sets where m = max j m j and we fixed an arbitrary embedding of the natural input and output alphabets in Σ.
Note that not all input strings are used; since we consider the parameters d, m, k to be constants (depending only on the type of stabilizer game chosen), the cardinality of the alphabet Σ is constant.

Circuit game definition
Having specified the ideal (or, "honest") quantum circuit that we have in mind, we are ready to give a formal definition of the circuit game associated with r copies of a stabilizer game G. Recall the definition of the distribution D (r) on input patterns given in Definition 4.9.
Definition 5.6.Let G be an (ℓ, k, m) stabilizer game and 1 ≤ r ≤ N integer.The circuit game G G,N,r is a game on the input and output sets defined in (29).The input distribution π is obtained by independently sampling an input pattern P according to D (r) and a tuple of r independent queries (x (1) , . . ., x (r) ) for G, and encoding them as an element of I as described in Section 5.1.2.The relation R ⊆ I × O is defined as the support of the output distribution of the circuit described in Section 5.1, when it is provided an input in the support of π.
Skipping ahead, we note that in Section 6.2 we consider a slight variation of the circuit game G G,N,r from Definition 5.6, where the r query tuples to G are no longer independent and the win condition is relaxed to allow failure in some of the game instances.These modifications allow us to obtain a circuit game whose inputs can be sampled using few random bits (polylogarithmic in N), and that can be won with high probability by a circuit whose gates are subject to a limited amount of noise.

Soundness
We describe a reduction from circuit strategies (i.e.circuits with constant fan-in and bounded depth) in the circuit game introduced in Definition 5.6 to strategies for the players in the game G.The next lemma refers to the notions of lightcone, input pattern, and circuit specification introduced in Section 4.1 and Section 4.2, and of rotated, stretched and repeated game introduced in Section 3.2 and Section 3.3.Lemma 5.7 (Circuit locality implies local simulation).Let G = G G,N,r be a circuit game as in Definition 5.6.Let P = {(u (i) , Γ (i) )} 1≤i≤r be an input pattern in the support of the input distribution for G. Let C be a circuit with fan-in K and depth D that wins with probability p in G G,N,r , for some 0 ≤ p ≤ 1, conditioned on the input pattern being P.
Let η > 0. Let L f be the lightcone function obtained from the circuit graph, and S = (L f , BAD in , ∅) an associated circuit specification.Assume that P is S-causal and that a fraction at least 1 − δ of all input pairs (u, Γ) ∈ P are S-valid, for some δ ∈ [0, 1].
Then there exists an (rℓ)-player strategy in the r-repeated rotated stretched game G ′ = ((G r ) S Γ ) R , for some Γ depending on C that is defined in the proof, such that with probability at least p the strategy succeeds in a fraction at least 1 − δ of the game instances.
Proof.An input to the circuit C consist of two parts: the pattern P = {(u (i) , Γ (i) )} 1≤i≤r , and the queries {(x ℓ )} 1≤i≤r , that are embedded in the input to the circuit as described in Section 5.1.2.By assumption there is a fraction at most δ of (u (i) , Γ (i) that are S-valid.For the remainder of the argument, ignore those vertices (equivalently, relabel r to (1 − δ)r).When designing a strategy for the players in the game, the players associated to ignored vertices ignore their question and return a random answer.
The assumption that P is S-causal implies that for each i ∈ {1, . . ., r} each of the vertices v ∈ Γ (i) has a backwards lightcone that includes at most one of the input locations u (i) j .Moreover, all vertices in Γ (i) ∩ Box(u (i) j ) have a backwards lightcone that includes no other input location than u (i) j .We define an (rℓ)-player strategy in the rotated, stretched game G ′ .For each i ∈ {1, . . ., r}, partition Γ (i) into sets Γ (i) j , j ∈ {1, . . ., ℓ}, such that the only input location in the backwards lightcone of any vertex in Γ (i) j is u (i) j .Note that the lightcones may intersect at other grid vertices.Recall that by definition each wire of C is associated with the space C d ′ , where d ′ = |Σ| with Σ the input alphabet for the circuit game.We now describe an unambiguous way to generate a density matrix σ Figure 2: Illustration of the construction in the proof of Lemma 5.7.A circuit with two input locations u 1 , u 2 (case r = 1 and ℓ = 2).The star Γ has two simple paths linking the center vertices g i with u i , for i = 1, 2.
The forward lightcones of u 1 and u 2 do not intersect at any vertex in Γ.The output vertices along Γ are partitioned into Γ1 and Γ2 in a way that all vertices within a lightcone of an input location u i are associated with the index i.
on (C d ′ ) ⊗rℓ , together with an assignment of each qudit of σ to a player (i, j), using the circuit C and the fixed input pattern P.
We define σ as the output of the circuit C, when certain inputs have been fixed, and certain wires have been traced out.For all input grid vertices that are not an input location u (i) j , hard-wire the input to |0 .Execute the circuit until a vertex v of the circuit graph that is in the forward lightcone of an input vertex associated with location u (i) j has to be considered.Since no input has been hard-wired for that vertex, the circuit cannot proceed.There are two cases: • If the forward lightcone of v intersects the forward lightcone of two different input locations u (i) j , then no vertex in the forward lightcone of that location can be on any of the stars Γ (i ′ ) for i ′ = i (as otherwise the vertex would be a vertex of Γ whose backwards lightcone contains two distinct input locations).In that case, trace out the vertex.
• In all other cases, vertex v is in the forward lightcone of a single input location u (i) j .In this case, give the circuit wire associated with that vertex (in the state that it currently is) to player (i, j).
Finally, split the unassigned vertices on any path Γ (i) j in an arbitrary way among the players; the set Γ(i) j is defined as the set of vertices from the star Γ (i) assigned to the j-th player.All remaining unassigned vertices are traced out.
This procedures specifies the state σ shared by the players (see Figure 2 for an illustration).It remains to define their observables.Once the game starts, each player uses its input x (i) j in location u (i) j (encoded as an input to the circuit game, as specified in Section 5.1.2),and proceeds to complete the execution of the circuit on the qudits that it holds.If a gate has an output wire that points to a qudit that is not in the player's possession, the player measures the qudit and ignores the outcome.Finally, the player measures all qudits in the locations Γ (i) j in the computational basis, and returns them as its answer (decoded as an answer in G, as specified in Section 5.1.2).
The fact that this strategy for the players has the same success probability in G ′ as the circuit C in the circuit game G G,N,r follows from the fact that the success criterion in G G,N,r only involves output vertices that are along the stars Γ (i) , and it can be verified that the joint operations performed by the players in the above-defined strategy correctly compute the reduced density matrix computed by the circuit on all those output vertices.Finally, using Lemma 5.5 it can be verified that the success criterion in the circuit game matches the win condition for the rotated stretched game.
Remark 5.8.The proof of Lemma 5.7 establishes a stronger statement than claimed in the lemma, that will be useful later.Specifically, the reduction from a circuit to a strategy for the players in G ′ constructed in the proof applies whenever the input pattern P chosen in the circuit game is S-causal for S the circuit specification derived from C.Moreover, whenever this is the case the reduction yields a strategy for the players that exactly reproduces the (suitably decoded) output distribution of the circuit, on any choice of queries x (i) .
We end this section with the proof of Theorem 1.2, that specifies a circuit game for which there is a very large separation between the optimal winning probabilities of classical low-depth and quantum circuits.
Theorem 1.2 (Exponential Soundness, restated).Let N ≥ 1 be an integer.There exists a circuit game G N such that the input and output sets are GRID N ′ for some N ′ = O(N), and such that the following hold: • (Completeness) There exists a depth-4 quantum circuit that succeeds at G N with probability 1.
• (Soundness) For any η > 0 there is a constant c > 0 depending on η only such that any classical circuit of depth D ≤ c log N has success probability at most exp(−Ω(N η )) in the game.
Proof.Let G N = G G,N,r be the circuit game introduced in Definition 5.6, where the stabilizer game G is instantiated as the GHZ game from Definition 3.15, and let π and P be the input distribution and input pattern introduced in Definition 5.6 respectively.Completeness: By Lemma 5.2 the circuit C ideal , as defined from the game G N at the beginning of Section 5.1, wins the game G N with probability at least (ω * (G)) r , where ω * (G) is the optimal entangled winning probability for the stabilizer game G. Since ω * (G) = 1 it follows that C ideal succeeds at G N with probability 1.As noted after Definition 3.15, the shared state |ψ GHZ in the optimal strategy for the GHZ game can be prepared starting from |000 by a circuit of depth 3. It follows by definition that C ideal has depth at most 4.This establishes the completeness part of the corollary.
Soundness: Fix an η ∈ (0, 1 7 ).Let C be a classical circuit with fan-in K and depth D ≤ c log N (for c a sufficiently small constant depending on η) that wins with probability p win in G G,N,r .We show that if p win is too large, then there is a good classical strategy for the players in the game GHZ ⌊r/2⌋ , the ⌊r/2⌋-repeated GHZ game as defined in as in Definition 3.11.For an input pattern P in the support of D (r) , say that P has a large S-causal subpattern if there exists a subpattern P ′ ⊆ P such that P ′ is S-causal and |P ′ | ≥ ⌊r/2⌋.Define q as q = 1 − Pr (P has a large S-causal subpattern) .
We first show an upper bound on q.For any pattern P let P core = P VAL ∩ P CAUS , where as in Lemma 4.12 By construction P core is always S-causal.To prove an upper bound on q it suffices to place a lower bound the probability that |P core | ≥ ⌊r/2⌋.Recall that the classical circuit C has fan-in K, depth D ≤ c log N, and circuit specification S = (L f , BAD in , ∅).By Lemma 4.3, we may choose c as a function of η such that S is (B, R in , 0)-bounded, where B = O(N η ) and R in = O(N 2−η ).By (18) we get where p = rB(16rL 2 /N 2 + ℓ/L).Here ℓ = 3, and the other parameters depend on N. To set parameters, first recall that B = O(N η ) and R in = O(N 2−η ).Set t = r/10, r = Θ(N η ), and L such that L = O(N 1−3η ) and L = Ω(N 4η ).Then p = O(1) and rR in /N 2 = O(1).By choosing the constants appropriately, we can ensure that With this choice of parameters, by (31) we get that |P core | ≥ r/2 with probability at least 1 − 4 exp (−r/800).
To conclude, note that whenever P contains a S-causal subpattern P ′ ⊆ P such that |P ′ | ≥ r/2 it follows from Lemma 5.7 and Remark 5.8 that the circuit C implies a strategy for (rℓ/2) classical players in the repeated game GHZ ⌊r/2⌋ .Using that the maximum success probability of classical players in GHZ is 3/4 and that the classical value multiplies under repetition (since the players are distinct) it follows that the implied strategy has success probability at most (3/4) ⌊r/2⌋ .

Randomness generation
In this section we give the construction of a circuit game such that any low-depth circuit that succeeds in the game with non-negligible probability must generate outputs that have large min-entropy, even conditioned on the inputs and side information that may be correlated with the initial state of the circuit.
The main idea for the construction is to embed a large number of copies of a simple stabilizer game G in a circuit game, as described in Section 5. (We use the Mermin 3-player GHZ game [Mer90a], though a similar reduction could be performed starting from any stabilizer game whose quantum value is larger than its classical value.)Using the reduction from Lemma 5.7, it follows from Remark 5.8 that the output distribution of any circuit that wins with non-negligible probability in the circuit game can be deterministically mapped to a (stretched, rotated) variant of the r-fold parallel repetition, with r independent groups of players, of G.This reduction implies that, to bound the output entropy of the circuit, it suffices to place a lower bound on the output entropy of any strategy in the parallel repeated game.
To accomplish this last step we employ the framework based on the Entropy Accumulation Theorem (EAT) [DFR16] introduced in [AFDF + 18], including the improvements from [DF18].This framework allows to place a linear (in the number of repetitions) lower bound on the amount of min-entropy generated in the sequential repetition of a nonlocal game, using a lower bound on the function that measures the von Neumann entropy generated in a single instantiation of the game as a function of the success probability.Our setting of parallel repetition is more constrained (thus in principle easier to analyze) than the sequential setting, but the results from [AFDF + 18, DF18] still give the best rates for both settings.
In Section 6.1 we start by establishing a bound on the single-round randomness for the three-player GHZ game that takes the form required to apply the framework from [AFDF + 18].In Section 6.2 we combine this bound with the reduction from circuit games to nonlocal games shown in Section 5 to deduce a family of randomness-generating circuit games.

Randomness generation from the GHZ game
We briefly recall the formalism from [AFDF + 18], when tailored to our setting (in particular, we focus on processes specified by quantum strategies in a nonlocal game, instead of arbitrary quantum channels in [AFDF + 18]).The main definition that is needed is that of a min-tradeoff function, which specifies a lower bound on the amount of randomness generated in a single execution of a nonlocal game, as a function of the player's probability of winning in the game.We give the definition for stabilizer games, as introduced in Definition 3.1.Definition 6.1 (min-tradeoff function).Let G be an (ℓ, k, m) stabilizer game.Fix a set of measurements {M x j } for the ℓ players in the game.For any ω ∈ [0, 1], let Σ(ω) denote the set of states ρ P 1 •••P k R such that when the players' state is initialized to ρ (with player i being given register P i ), the players' strategy wins the game with probability ω. 6Then a real affine function f on [0, 1] is called an (affine) min-tradeoff function for G and {M where the entropy is evaluated on the post-measurement state M(ρ) obtained after application of the players' measurements, and Q and A are random variables that represent inputs (distributed according to π) and outputs for the players in G.If f is a min-tradeoff function for a game G and every possible set of measurements {M x j } for the players, then we simply say that f is a min-tradeoff function for G.
To illustrate the definition we apply results from [WBA18] to give a min-tradeoff function for the Mermin GHZ game introduced in Definition 3.15.It is well-known (and easily verified) that the best classical strategy for this game succeeds with probability 3 4 .This in particular implies that any strategy that wins with probability strictly larger than 3 4 cannot be deterministic, hence generates randomness.The following bound shown in [WBA18] provides a tight lower bound on the conditional entropy present in the outputs of any strategy that succeeds with sufficiently large probability.7 Lemma 6.2 ([WBA18]).Let τ = (ρ, {M x j }) be a strategy with success probability ω ≥ 7 8 in the game GHZ, where ρ is a density matrix on the provers' registers P 1 • • • P ℓ and an arbitrary auxiliary register R. Then where Q is a random variable that denotes the query to the players, and A 1 , A 2 are random variables that denote the answers a 1 , a 2 ∈ Z 2 from the first two players.
Note that for ω = 1, the bound (32) gives 2 bits of entropy, which is clearly optimal.If ω = 1 − ε for small ε, the bound degrades as 2 − O( √ ε).Following the framework from [AFDF + 18], the bound provided in Lemma 6.2 already implies a linear lower bound on the entropy generated by the sequential repetition of the GHZ game.For our purposes it will be convenient to have a bound on the entropy generated by the stretched, rotated variant of the GHZ game, as introduced in Section 3.2.Corollary 6.3 (min-tradeoff function for GHZ).Let 7 8 < p s < 1.Let Γ be a tuple of sets as in Definition 3.10.Then the function g p s : [0, 1] → R defined by is a min-tradeoff function for the rotated stretched game GHZ S,R Γ .
Proof.First we observe that the bound (32) from Lemma 6.2 applies equally to the the rotated stretched game GHZ S,R Γ , for any fixed Γ. Indeed, fix a strategy (ρ, {M x j }) in GHZ S,R Γ .Using Lemma 3.9 we obtain a strategy τ ′ = (ρ, {M ′ x j }) for GHZ that has the same success probability.Furthermore, in the coarsegraining of the strategy the answers A 1 , A 2 , A 3 ∈ Z 2 in τ ′ are a deterministic function of the answers A 1 , A 2 , A 3 ∈ Z 2 × (Z 2 2 ) |Γ 1 | in GHZ S,R Γ , where the second factor is for the stretched rotation string.Therefore the same bound on randomness generation that applies to GHZ applies to GHZ S,R Γ (as long as all outputs in the game are included, which is the case for the definition of a min-tradeoff function).
To conclude, note that the right-hand side of (32) is a convex function of ω, hence it is at least its tangent at any point.
Recall that our goal is to generate a large amount of randomness by requiring a circuit to play multiple copies of the game GHZ in parallel.Towards this, we introduce a partially derandomized variant of the repeated game, where the inputs are chosen according to a very biased distribution in order to save on the randomness required to generate them.The resulting game is a direct analogue of the protocol for randomness expansion from the CHSH game given in [DF18].Definition 6.4.Let r ≥ 1 be an integer.Let p, γ ∈ [0, 1].Let Γ be a tuple of sets as in Definition 3.10.Let GHZ S,R r,Γ,p,γ denote the r-fold repetition, as in Definition 3.11, of the rotated, stretched game GHZ with the following two modifications: • The r queries, instead of being sampled independently, are chosen according to the following distribution: first, select a subset S ⊆ {1, . . ., r} by including each element independently with probability p; second, select queries x (1) , . . ., x (r) ∈ X such that x (i) is sampled as in GHZ when i ∈ S, and x (i) ← x for i / ∈ S, where x is an arbitrary, but fixed, query in GHZ; • It is only required that the win condition is satisfied for a fraction at least (1 − γ) of the tuples of answers a (i) such that i ∈ S (there is no requirement for i / ∈ S).
Corollary 6.3 shows that any sufficiently successful strategy in the (rotated, stretched) game GHZ must generate outputs that contain a constant amount entropy.It is therefore natural to expect that a strategy for the repeated game from Definition 6.4 should generate a linear (in the number of repetitions) amount of entropy.The difficulty is to obtain a bound on the entropy generated, conditioned on having produced outputs that satisfy the win condition of the game, but without placing an implicit assumption on the intrinsic winning probability of the strategy (which would be difficult to estimate).Moreover, the fact that the strategy involves all players simultaneously measuring parts of the same entangled state introduces correlations that prevent a direct treatment using techniques appropriate for the simpler case of i.i.d.(identically and independently distributed) outputs.
The Entropy Accumulation Theorem, as applied in [AFDF + 18], is designed specifically to address these difficulties, and indeed guarantees that the repeated game 6.4 generates a linear amount of min-entropy.Here we use the improved results from [DF18], 8 that give good bounds even when the "test probability" p from Definition 6.4 can be very small.Lemma 6.5.Let r ≥ 1, p, γ ∈ [0, 1], and ε > 0. Let (ρ, {M x j }), where ρ is a density matrix on the player's private registers together with an ancilla register E, be a strategy for the (3r) players in GHZ S,R r,Γ,p,γ that succeeds with probability at least ε.Let Q = (Q (1) , . . ., Q (r) ) (resp.A = (A (1) , . . ., A (r) )) be random variables associated with the players' answers in each copy of GHZ; note that each Q (i) (resp.A (i) ) is itself a 3-tuple.Let ρ s AQE denote the state of AQE conditioned on the players succeeding in the game (the players' private registers are traced out).Then Note that the lower bound provided in (33) is non-trivial as soon as p = Ω(log N/r) and ε is at least inverse-polynomially large (smaller ε is also possible, but requires a larger p).
Proof.The proof is identical to the proof of [DF18, Theorem 6.1], that applies to the CHSH game.The only change needed is to use the min-tradeoff function from Corollary 6.3 instead of the min-tradeoff function g * for the CHSH game used in [DF18].The bound (33) follows from the bound stated in [DF18, Theorem 6.1] by noting that d f dω (1 − γ) is bounded by a universal constant.

Randomness generation from low-depth circuits
Using the technique to embed a stabilizer game into a circuit game described in Section 5 we can leverage the randomness generation results from the previous section to obtain a family of circuit games for certified randomness expansion.First we define the circuit games that we consider by introducing a randomnessefficient, noise-tolerant modification of the game from Definition 5.6.Even though we will eventually instantiate the definition with G = GHZ, we give the definition for a general stabilizer game.Definition 6.6.Let G be an (ℓ, k, m) stabilizer game and N ≥ 1 an integer.Let L, B, R in , r be parameters that satisfy the constraints (22) for some constant η > 0. Let p, γ ∈ [0, 1].The circuit game G G,N,r,p,γ is defined as the game G G,N,r with the following modifications: 1.The input pattern P is sampled according to the distribution D (r) from Lemma 4.13; 2. The tuple of queries (x (1) , . . ., x (r) ) for G is sampled by first, selecting a subset S ⊆ {1, . . ., r} by including each element independently with probability p; second, selecting queries x (1) , . . ., x (r) ∈ X such that x (i) is sampled as in G when i ∈ S, and x (i) ← x for i / ∈ S, where x is an arbitrary, but fixed, query in G; 3. It is only required that the win condition is satisfied for a fraction at least (1 − γ) of the tuples of answers a (i) such that i ∈ S (there is no requirement for i / ∈ S).
As shown in Lemma 4.13, it is possible to sample an input pattern from D (r) using O(log 2 N) random bits.In addition, it is possible to sample inputs as in Definition 6.6 using O(H(p)r) random bits.So, if p = Θ(log N/r), then it is possible to sample inputs in G G,N,r,p,γ using O(log 2 N) random bits.(To this count, one may add O(log 3 N) random bits, sufficient to extract near-uniform random bits from the output of the circuit by using a seed-efficient randomness extractor [DPVR12].) The following theorem places a lower bound on the amount of randomness generated by a circuit that succeeds with non-negligible probability in the circuit game from Definition 6.6, when the stabilizer game G is instantiated as the GHZ game from Definition 3.15.
r disjoint squares S (1) , . . ., S (r) of side length M each. 5Partition each square into T = ⌊ M 2L+1 ⌋ 2 boxes of side length (2L + 1), in an arbitrary way.For each possible choice of (ℓ + 1) distinct boxes b 0 , b 1 , . . ., b ℓ within a square, fix a collection STARS(b 0 , . . ., b ℓ ) of L/ℓ stars such that • each star has b 0 as its central box and b 1 , . . ., b ℓ as its other boxes, • the total length of the paths in any star is at most 2ℓM, and • the paths of the distinct stars are vertex-disjoint.Consider the following distribution D (r) (M, L) on input patterns on GRID N .For each i ∈ {1, . . ., r} select b (i) 0 , . . ., b Definition 2.2 (Strategy).Let ℓ ≥ 1 be an integer, and G an ℓ-player nonlocal game.An ℓ-player strategy τ = (ρ, {M x i }) for G consists of an ℓ-partite density matrix ρ ∈ H 1 ⊗ • • • ⊗ H ℓ , and for each i ∈ {1, . .., ℓ} a collection of measurement operators {M a ix i } a i ∈A i on H i indexed by x i ∈ X i .