Pavel Sekatski

Jean-Daniel Bancal

Xavier Valcarce

Y.-Z Tan

Renato Renner

Nicolas Sangouard

Device-independent quantum key distribution from generalized CHSH inequalities

Device-independent quantum key distribution aims at providing security guarantees even when using largely uncharacterised devices. In the simplest scenario, these guarantees are derived from the CHSH score, which is a simple linear combination of four correlation functions. We here derive a security proof from a generalisation of the CHSH score, which effectively takes into account the individual values of two correlation functions. We show that this additional information, which is anyway available in practice, allows one to get higher key rates than with the CHSH score. We discuss the potential advantage of this technique for realistic photonic implementations of deviceindependent quantum key distribution.

Introduction

The aim of quantum key distribution (QKD) is to give two parties -Alice & Bob -the possibility to generate a secret key when they share a quantum channel. For instance, in the implementation proposed by Ekert [START_REF] Ekert | Quantum cryptography based on Bell's theorem[END_REF], the channel consists of a source producing entangled particles that are distributed to Alice & Bob. At each round, each of Alice & Bob measure one particle by choosing one out of several measurement settings. The claim that Alice's measurement results are secure, i.e. unknown to any third party -Eve -who may control the quantum channel, is guaranteed by inferring (from Alice and Bob's measurement results) that the source emits states close to pure bipartite entangled states. This ensures at the same time that Bob's results are correlated to Alice's ones if he chooses an appropriate measurement setting, i.e. Alice and Bob's measurement results can form a secret key.

Ekert suggested that the information about the key that may be available to an adversary can be quantified by choosing settings allowing Alice & Bob to violate a Bell inequality. This idea was later progressively formalised and led to what is now called device-independent QKD (DIQKD). In its simplest version, DIQKD is implemented by letting Alice choose randomly between two measurement settings at each round, A x where x ∈ {0, 1}, while Bob's measurement includes three possible settings, B y where y ∈ {0, 1, 2}. For settings x, y ∈ {0, 1}, the results -which can possibly take many values -are post-processed locally and turned into binary values A x , B y ∈ {-1, +1}. After several iterations, Alice and Bob communicate classically to estimate the CHSH score

S = A 0 ⊗ (B 0 + B 1 ) + A 1 ⊗ (B 0 -B 1 ) (1)
where A x ⊗ B y = p(A x = B y |x, y) -p(A x = B y |x, y) quantifies the correlation between the outcomes for measurement choices x and y, respectively. The remaining measurement setting y = 2 is chosen to generate an outcome B 2 that minimises the uncertainty with respect to A 0 . Alice then forms the raw key from the outcomes A 0 of the pairs that Bob measured with respect to y = 2.

We consider n such rounds, over which the source produces a tripartite state |Ψ ABE shared between Alice, Bob and Eve. Ref. [START_REF] Arnon-Friedman | Practical device-independent quantum cryptography via entropy accumulation[END_REF] showed that Eve's information is the same as in the case where the devices have no memory and behave identically and independently in each communication round of the protocol, up to corrections vanishing with n. In particular, we can write |Ψ ABE = |ψ ⊗n ABE where |ψ ABE is the tripartite state of a single round and consider the case where measurements are done successively on the state |ψ ABE .

In the asymptotic limit of large n, the number of secret bits per round obtained after one-way error correction and privacy amplification (i.e. the key rate) is then given by [START_REF] Devetak | Distillation of secret key and entanglement from quantum states[END_REF]

r = H(A 0 |E) -H(A 0 |B 2 ), ( 2
)
where H is the von Neumann entropy. Ref. [START_REF] Acín | From Bell's theorem to secure quantum key distribution[END_REF] showed that the conditional entropy H(A 0 |E) optimized over all states ψ ABE and measurements A x , B y compatible with the observed CHSH score S is lower bounded by

H(A 0 |E) ≥ 1 -h 1 + (S/2) 2 -1 2 (3)
where h denotes the binary entropy. This provides a lower bound on the key rate, as the conditional entropy H(A 0 |B 2 ) can be estimated directly from Alice and Bob measurement results associated to setting choices A 0 and B 2 . Interestingly, this bound is obtained device-independently, i.e. without assumptions on the dimension of quantum states and the calibration of measurements. This is not the case for standard (non-device independent) QKD protocols which are not based on the violation of a Bell inequality and whose security guarantees rely on the assumption that the source and measurements carry out precisely the operations foreseen by the protocol. This assumption is hard to meet in practice and leads to vulnerabilities, as demonstrated by hacking experiments [START_REF] Garcia-Escartin | Attacking quantum key distribution by light injection via ventilation openings[END_REF][START_REF] Lydersen | Hacking commercial quantum cryptography systems by tailored bright illumination[END_REF][START_REF] Weier | Quantum eavesdropping without interception: an attack exploiting the dead time[END_REF]38].

The robustness of device-independent quantum key distribution against these attacks makes it appealing, and a race between several experimental groups is ongoing to report the first proof-of-principle distribution of a key with a fully device-independent security. Measurement-DIQKD, a precursor of DIQKD where device-independence only applies to the measurement devices, but not to those used for state preparation [START_REF] Samuel | Side-channel-free quantum key distribu-tion[END_REF][START_REF] Lo | Measurement-device-independent quantum key distribution[END_REF], already admit a number of experimental implementations [START_REF] Comandar | Quantum key distribution without detector vulnerabilities using optically seeded lasers[END_REF][START_REF] Ferreira Da Silva | Proof-of-principle demonstration of measurement-device-independent quantum key distribution using polarization qubits[END_REF][START_REF] Liu | Experimental measurement-device-independent quantum key distribution[END_REF][START_REF] Rubenok | Real-world twophoton interference and proof-of-principle quantum key distribution immune to detector attacks[END_REF][START_REF] Tang | Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution[END_REF].

Let us note that the proof leading to the bound given in Eq. (3) only uses the knowledge of the CHSH score. This score is computed as a linear combination of the correlation functions A x B y , but the additional information provided by considering these correlations individually -which is anyway available in practice -might help to facilitate a realisation of device-independent quantum key distribution. This motivation is at the core of this work.

Concretely, we consider the individual values of two terms appearing in the CHSH score, namely

X = A 0 ⊗ (B 0 + B 1 ) , Y = A 1 ⊗ (B 0 -B 1 ) . ( 4
)
The use of values of X and Y proved to be useful for device-independent state certification by improving the certified fidelity from the CHSH score [START_REF] Valcarce | Self-testing two-qubit maximally entangled states with two binary measurements[END_REF]. It is also expected to be useful in DIQKD, as the knowledge of X and Y allows one to differentiate the contributions of the key generating measurement A 0 from the ones associated with A 1 , from which no key is generally extracted (see [START_REF] Schwonnek | Robust device-independent quantum key distribution[END_REF] for a noticeable exception).

Finally, in implementations of DIQKD with non-unit detection efficiencies where no-detection events are attributed a fixed value ±1, no-detections on Bob's side can only contribute to one of these two correlation functions (X or Y). The main result of this work is to confirm the intuition that the use of individual values of X and Y improves the bounds on Eve's information derived from the CHSH score, and hence the key rate of DIQKD.

Formulation of the problem

(Ω) 2 X model + sin(Ω) 2 Y model ≥ β, ( 5
)
where β is deduced from the observed quantities X and Y from the following formula

β = 1 2 (cos (Ω) X + sin (Ω) Y) . ( 6
)
(Further in the text, we will use a compact notation for sine S Ω = sin(Ω) and cosine C Ω = cos(Ω).) Obviously, Ω = π/4 reduces back to the CHSH constraint (up to normalization). Just like the CHSH score can be seen as the result of a test of the CHSH inequality, we can associate β to the test of a Bell inequality -a generalisation of the CHSH inequality -that is characterized in Ref.

[? ]. This characterization is also done below for the sake of completeness.

Reduction to qubits-The score β given in Eq. ( 6) is estimated when Alice and Bob choose the measurement A x , B y , x, y = 0, 1, which are observables with eigenvalues ±1. A simple lemma -the Jordan lemma [START_REF] Šupić | Self-testing of quantum systems: a review[END_REF] -tells us that such observables can be jointly block diagonalised with blocks of size 2 × 2, i.e.

A x = k A x,k B y = k B y,k , (7)
where, without loss of generality, we can assume the restriction to each qubit block to be a real Pauli operator satisfying A

A x,k = a k x • σ z σ x B y,k = b k y • σ z σ x (8)
where σ z and σ x are Pauli operators. The state |ψ ABE can be enforced to take the form

|ψ ABE = k,k √ p (k,k ) |ψ (k,k ) ABE , (9)
where p (k,k ) is a probability distribution and

|Ψ (k,k ) ABE ∈ C 2 A ⊗ C 2 B ⊗ H (4)
E , see Refs [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF][START_REF] Pironio | Device-independent quantum key distribution secure against collective attacks[END_REF] for detailed discussions. Given models with such measurements and state, the quantity of interest can be expressed as

H(A 0 |E) = k,k p (k,k ) H (k,k ) (A 0 |E) (10)
where

H (k,k ) (A 0 |E
) is Eve's conditional entropy for four-qubit models (including the two qubits from Eve's purification) involving real Pauli measurements.

If the minimization of

H (k ,k) (A 0 |E) over such models satisfying cos(Ω) 2 X model, k, k' + sin(Ω) 2 Y model, k, k'
≥ β provides a convex function of β, this function can be used directly as a lower bound on the quantity H(A 0 |E) through Eq. ( 10). If it is not convex, it can be convexified so as to apply to all possible mixtures of state and measurement, and thus again apply to Eq. [START_REF] Garcia-Escartin | Attacking quantum key distribution by light injection via ventilation openings[END_REF]. This convexity property allows us to reduce the general problem of finding the minimum of Eve's conditional entropy over all possible models to a minimization over four-qubit models with real Pauli measurements. We will come back to this convexification requirement later.

Noisy preprocessing-We consider a simple postprocessing of the raw key, known as noisy preprocessing [START_REF] Kraus | Lower and upper bounds on the secret-key rate for quantum key distribution protocols using one-way classical communication[END_REF][START_REF] Renes | Noisy processing and distillation of private quantum states[END_REF][START_REF] Renner | Information-theoretic security proof for quantum-key-distribution protocols[END_REF], which has been shown to be beneficial to reduce the requirement on the detection efficiency in photonic implementations of deviceindependent quantum key distribution [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF]. Once the raw key is obtained, Alice is instructed to generate a new raw key A 0 by flipping each bit of the initial raw key with a probability p. Such a pre-processing can be accounted by the model of the key generating measurement, by considering a new operator

A 0 = (1 -p)A 0 -pA 0 (11)
which is not a Pauli operator anymore. Note that we will often parametrise the amount of noise that Alice adds with a parameter q = (1 -2p) 2 .

Symmetrization-In order to simplify the analysis, it is convenient to consider a symmetrization step in which both parties, Alice and Bob, flip the outcomes of the key generating measurements depending on a public random bit string. This guarantees that bits of the raw key are random, i.e. H(A 0 ) = H( A 0 ) = 1. Importantly, one can show the equivalence of protocols with and without symmetrization, meaning that the symmetrization does not need to be implemented in practice, see [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF] for a complete description of the symmetrization step in the presence of noisy preprocessing.

Reduction to Bell diagonal states-

|ψ ABE = 4 i=1 L i Φ i AB |i E ( 12
)
where

|Φ i = {Φ + , Ψ -, Φ -, Ψ + } 4 i=1
, and without loss of generality, a partial ordering of the eigenvalues L 1 ≥ L 2 and L 3 ≥ L 4 can be imposed [START_REF] Pironio | Device-independent quantum key distribution secure against collective attacks[END_REF]. Note that the superscripts k, k are omitted in the tripartite state appearing in Eq. ( 12), i.e. |ψ ABE → |ψ

(k,k ) ABE .
Until the end of this section and in the next section which is dedicated to the resolution of the optimization presented in Eq. ( 19), we remove the index k, k for making the notation simpler and ask the reader to keep in mind that we consider the restriction to four qubit models with real Pauli measurements in this two sections.

Eve's conditional entropy-Eve's conditional entropy can be expressed as

H( A0|E) = H( A0) -H(ρE) + â=±1 p(â)H(ρ E|â ) (13)
where ρ E is the reduced state of Eve and ρE|â corresponds to Eve's state conditioned on Alice's noisy key bit A 0 being equal to â, which occurs with probability p(â). The equivalence of the protocol with the symmetrized one allows us to take H( A 0 ) = 1 and p(â) = 1 2 .

H(ρ E

) is given by the entropy H(L) of the probability vector L = (L 1 , . . . , L 4 ) while the term ρ

(α,β) E|â=+1 equals     L 1 0 C φ √ L 1 L 3 q S φ √ L 1 L 4 q 0 L 2 S φ √ L 2 L 3 q -C φ √ L 2 L 4 q C φ √ L 1 L 3 q S φ √ L 2 L 3 q L 3 0 S φ √ L 1 L 4 q -C φ √ L 2 L 4 q 0 L 4     (14)
where φ labels Alice measurement A 0 = cos(φ)σ z + sin(φ)σ x (we use the notation C φ = cos(φ) and S φ = sin(φ)). The two states ρ E|â=±1 are related by a simple unitary transformation and therefore have the same entropy, see App.A.2 for details. The expressions of these entropic quantities provide an explicit way to compute H( A 0 |E) as a function of the parameters L and φ. Let us now turn our attention to the constraints.

Quantum correlations in the (X,Y) plane -As mentioned earlier, we are considering quantum models with the values of correlators X and Y given by Eq. ( 4). Without loss of generality, we can assume X, Y ≥ 0, which can always be attained by relabelling the measurement outcomes of A 1 , B 0 and B 1 (i.e. without touching the angle φ).

In this positive quadrant of the plane, the local strategies are delimited by the CHSH inequality X + Y ≤ 2, i.e. the line connecting the deterministic strategies (X, Y) = (2, 0) and (X, Y) = (0, 2). This implies the following local bounds for the generalized CHSH tests

1 2 C Ω X + 1 2 S Ω Y ≤ B L Ω = max(C Ω , S Ω ). ( 15
)
To identify the upper limit of the quantum set, we consider the expected values of the generalized CHSH operator

B Ω = C Ω 2 A 0 ⊗ (B 0 + B 1 ) + S Ω 2 A 1 ⊗ (B 0 -B 1 ) . ( 16
)
To find its maximum value, we use the qubit parametrization of measurements A y , B y and parametrize the measurement angles on Bob's side as

B 0 + B 1 = (b 0 + b 1 ) • σ z σ x = 2C θ c • σ z σ x B 0 -B 1 = (b 0 -b 1 ) • σ z σ x = 2S θ c ⊥ • σ z σ x ( 17
)
with two arbitrary perpendicular unit vectors c and c ⊥ , and cos(2θ) = b 0 • b 1 . From the diagonalization of the operator on the right hand side of Eq. ( 16), one finds the quantum bound

B Q Ω = 1 (18)
attained at (X, Y) = (2 cos(Ω), 2 sin(Ω)) by a maximally entangled two qubit state and measurement settings a 0 • a 1 = 0 and b 0 • b 1 = cos(2Ω). It follows that Eve's information is constrained by the part of the quantum set lying between the line X+Y = 2 and the circle X 2 + Y 2 = 4. At this point, we can already conclude that any quantum model with (X,Y) lying on the circle satisfies H( Â0 |E) = 1 (except for the two points with X+Y= 2), since the underlying state of Alice and Bob has to be pure. This is a straightforward improvement over the CHSH bound.

Formulation of the problem to solve-The reductions introduced so far invite us to first solve the following optimization

I(β; Ω, q) = max L,φ,a 1 ,b 0 ,b 1 H(L) -H(ρ E|â=+1 ) s.t. B Ω (L, φ, a1, b0, b1) ≥ β ( 19
)
and then consider directly the solution I(β; Ω, q) if it is concave in β Ω or construct a concave function I(β; Ω, q) ≥ I(βΩ, q) to bound Eve's uncertainty using

H( A 0 |E) ≥ 1 -min Ω I C Ω X + S Ω Y 2 ; Ω, q . ( 20
)
Note that from the symmetries of the goal function H(L) -H(ρ E|â=+1 ) and the constraint B Ω , we can assume φ ∈ [0, π 4 ] for the key generating setting and L 1 -L 2 ≥ L 3 -L 4 in addition to L 1 ≥ L 2 and L 3 ≥ L 4 for the state, see App.A.1 for the details. Further note that we will often use a parametrisation of the tripartite state given by the following 3 component vector  

T z T x T p   =   L 1 -L 2 + L 3 -L 4 L 1 -L 2 -L 3 + L 4 L 1 + L 2 -L 3 -L 4   , ( 21
) with 0 ≤ T x ≤ T z ≤ 1 and T z + T x -1 ≤ T p ≤ 1 -(T z -T x ).
3 Bounding Eve's information with generalized CHSH tests

We are now ready to compute a bound on Eve's information as a function of the generalized CHSH score given in Eq. ( 6) by solving the optimisation problem given in Eq. [START_REF] Ma | Improved data post-processing in quantum key distribution and application to loss thresholds in device independent qkd[END_REF]. Among the parameters of the model in Eq. ( 19), the measurement setting a 1 , b 0 and b 1 only influence the constraint but not the goal function. Furthermore, it is shown in Ref. [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF]

B Ω (L, φ, a 1 , b 0 , b 1 ) ≥ β. ( 22
)
Second, we fix φ = φ * (L, β, Ω) to the optimal value for Eve, and maximize her information with respect to the state, that is, we solve

I(β; Ω, q) = max L H(L) -H(ρ E|â=+1 ; φ * (L, β, Ω)). (23)
We solve Eq. ( 22) in App. A.3. The expression of the optimal angle φ * depends on whether the parameter Ω exceeds π 4 . We treat the two cases Ω ≤ π 4 and Ω > π 4 separately.

The simple case with Ω ≤ π 4

For the Bell tests satisfying Ω ≤ π 4 , which include the CHSH test, the observed score β does not constrain the key generating setting φ but only the state L. As a result, there always exists a realization with the optimal angle φ * = 0 as long as the state is such that the Bell score can be attained, i.e. if

C 2 Ω T 2 z + S 2 Ω T 2 x ≥ β 2 Ω . ( 24
)
The maximization of the entropy then becomes possible, as for φ = 0 the conditional state ρ E|â=+1 is block diagonal and its entropy has a simple closedform expression. Such a maximization has been done for the CHSH case (Ω = π 4 ) in Ref. [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF], but Ref.

[37] pointed out that the analytical bounds on conditional entropies given in this reference assumes qubit attacks. The same bounds were derived using a different approach in [37], where it is also proved that these bounds are convex. The convexity results of [37], together with Jordan's lemma, imply that the obtained qubit bounds are in fact valid for any dimensions. The same convexity proof applies to the current situation with Ω ≤ π/4. For the sake of completeness, we provide in App. A.5 an alternative proof of convexity, which directly applies to the present case and to [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF]. We show in particular (see App. A.4)

I(β; Ω, q) = h q (z) = h(z) -h(n q (z)) with n q (z) = 1 + 1 -4 (1 -q) z(1 -z) 2 and z = 1 2   β 2 -C 2 Ω S Ω + 1   , ( 25
)
where h is the binary entropy. The concavity of I(β; Ω, q) and hence the convexity of Eve's entropy H( A 0 |E) follows from (see App. A.5)

d 2 dβ 2 h q z(β) = h q (z) z (β) 2 + h q (z)z (β) ≤ 0. ( 26
)
Finally, it remains to determine the optimal inequality to use for a given point (X,Y). h q (z) being a monotonic function of z, we derive the expression

z = 1 2   ( C Ω X+S Ω Y 2 ) 2 -C 2 Ω S Ω + 1   , ( 27
)
with respect to Ω to find its local maximum and verify that this value satisfies Ω ≤ π 4 . We find that for

4 -X 2 XY < 1 : z opt = 1 2 Y 4 -X 2 + 1 (28)
associated to the generalized CHSH test with

tan(Ω) = 4 -X 2 XY . (29) For 4 -X 2 XY ≥ 1 : z opt = 1 2   1 + X + Y 2 2 -1   , ( 30
)
which is the formula for the CHSH case Ω = π 4 [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF].

3.2

The complicated case with Ω > π 4

Bounding Eve's information from a numerical optimization

For the remaining Bell tests, with Ω > π 4 , the situation is different. Here, the generalized CHSH score β does not only constraint the state L but also the setting of the key generating measurement. In particular, we find that there are two different regions.

First, for the states falling in the range

S(β, Ω) = {L|(C 2 Ω T 2 z + S 2 Ω T 2 x ) ≤ β 2 ≤ (C 2 Ω T 2 x + S 2 Ω T 2 z )}, (31)
the constraint B Ω ≥ β can be satisfied with the measurement angle φ ≥ φ * (L, Ω, β), where cos

2 (φ * ) = c 2 * (L, Ω, β) is given by c 2 * (L, Ω, β) = (β 2 -S 2 Ω T 2 x )(C 2 Ω T 2 x + S 2 Ω T 2 z -β 2 ) C 2 Ω (T 2 z -T 2 x )(S 2 Ω T 2 z + S 2 Ω T 2 x -β 2 ) . ( 32
)
The constraint on the angle only becomes trivial, c 2 * = 1, on the boundary of the region S, where (

C 2 Ω T 2 z + S 2 Ω T 2 x ) = β 2 . Second, in the region where (C 2 Ω T 2 z + S 2 Ω T 2 x ) > β 2
the Bell score β can also be attained with φ = 0. However, there models provide less information to Eve as compared to these on the boundary (

C 2 Ω T 2 z + S 2 Ω T 2 x ) = β 2
, see the discussion at the end of App. A.4. So we can safely ignore this region.

To find the best strategy for Eve, it thus remains to solve

I(β; Ω, q) = max L∈S(Ω,β) H(L) -H(E|â = +1; c 2 * (L, Ω, β)). ( 33
)
This optimization only involves an analytic function of three parameters on a compact domain. It can be easily and time-efficiently solved by standard numerical methods. We now give an ansatz on the solution of the optimization given in Eq. ( 33), which allows one to speed up its numerical resolution even further.

Ansatz

First, we observe that the vector L saturating Eve's information only has two non-zero coefficients

L 1 = 1 -L 3 and L 2 = L 4 = 0, or T z = 1 and T x = T p .
With this observation, the previous optimization problem becomes a scalar optimization, that is

Ĩanz (β; Ω, q) = max β 2 -S 2 Ω C 2 Ω ≤T 2 x ≤ β 2 -C 2 Ω S 2 Ω h 1 + T x 2 -h 1 + T 2 x + c 2 * q(1 -T 2 x ) 2 . ( 34
)
Second, we see that the bound Ĩanz (β; Ω, q) is not concave for small β. However, we observe that its concave roof can be obtained by drawing a line which passes through the point

β = B L Ω = sin(Ω) I L (q) = I(B L Ω ; Ω, q) = 1 -h 1 + √ q 2 ( 35
)
which is tangent to the curve Ĩanz (β; Ω, q). The value of the generalized CHSH score at the tangent point can be found by solving

β * = argmin β I L (q) -Ĩanz (β; Ω, q) β -sin(Ω) . ( 36
)
Labeling I * (Ω, q) = Ĩanz (β * ; Ω, q), this leads to

I anz (β; Ω, q) = I * (Ω,q)(β-sin(Ω))-I L (q)(β-β * ) β * -sin(Ω) β < β * Ĩanz (β; Ω, q) β ≥ β * (37)
At this stage, we further observe that the optimal value of T 2 x for values of β ≥ β * coincides with its maximum possible value

T 2 x = β 2 -C 2 Ω S 2 Ω
, which defines I anz (β; Ω, q). In the Eqs. ( 36) and (37) we can now replace Ĩanz (β; Ω, q) with I anz (β; Ω, q), which does not involve any nolinear optimization.

While we believe this expression to be the true bound, we do not have a formal proof. Anyway, this conjectured expression helps to solve the optimization of interest.

Certified numerical solution

As mentionned before, the optimization in Eq. ( 33) can be easily solved by standard numerical methods. However, to provide a strict security guarantee to an actual implementation of DIQKD, such a numerical optimization would need to be done in a certified manner, with a formal proof that the obtained numbers lower bound Eve's conditional entropy on the whole domain. Below we present an algorithm which allows one to do such a certified optimisation based on the Lipshitz continuity of the goal function.

The algorithm is rather time-costly, but it only has to be used once the optimal experimental parameters are fixed through an ad hoc maximization of Eq. ( 33), cf. below.

Concretely, we present in this section an algorithm that approximates the set of possible strategies of Eve, delimited by the bound I(β, Ω, q), from the outside. To avoid the issue of concavity posed by Eq. ( 19), we rewrite the problem in the dual form in which we look for the tangent lines

f (t; Ω, q) = max L,φ H(ρ E ) -H(ρ E | Â0 ) + t β max (L,φ; Ω) β max (L, φ; Ω) = max a1,b0,b1 B Ω (L, φ, a 1 , b 0 , b 1 ), ( 38
)
to the curve I(β, Ω, q) with different slopes t. In Eq. ( 38) we used the fact that it is only the Bell score that depends on the measurement setting a 1 , b 0 , b 1 , so it can be maximized straightforwardly to define β max (L, φ; Ω), see App. A.6 for its closed form expression.

Before giving the details on the way we solve this dual form, let us shortly discuss on how it shall be used. We consider an actual implementation of DIQKD with fixed values of X * ,Y * and q * and for which there is an optimal value Ω * which saturates the minimum in Eq. ( 20)

H( Â0 |E) ≥ 1 -I(β * ; Ω * , q * ), (39)
with

β * = 1 2 (C Ω * X * + S Ω * Y * ).
Therefore, an optimal security guarantee for this particular implementation only requires the knowledge of the function I(β * , Ω * , q * ) on a single point. The same lower bond on Eve's conditional entropy can be obtained from the value of the dual bound f (t; Ω * , q * ) in Eq. ( 38) on a single point. Indeed, the concavity of I(β; Ω, q) ensures that there exists a value t * for which the inequality

f (t * ; Ω * , q * ) ≥ I(β; Ω * , q * ) + t * β (40)
is saturated at β = β * where f (t * ; Ω * , q * ) = I(β; Ω * , q * ) + t * β * . Using Eq. (38), we deduce that

H( Â0 |E) ≥ 1 -f (t * ; Ω * , q * ) + t * β * = 1 -I(β * ; Ω * , q * ). (41)
Hence, for a fixed experimental implementation of the protocol, it is sufficient to certify a single value of the function f (t * ; Ω * , q * ) in order to provide a strict and optimal security guarantee. Furthermore, the value t * is straightforward to find from the knowledge of Ω * , β * , q * and the function I(β; Ω, q).

We can now comment on the algorithm to provably upper bound the quantity in Eq. (38). While the algorithm used recently for the derivation of key rates in Ref. [START_REF] Schwonnek | Robust device-independent quantum key distribution[END_REF] could be easily adjusted to solve this problem, we propose a branch and bound approach.

Concretely, we first derive a parametrization of the set (L, φ) for which the goal function in Eq. ( 38) is Lipshitz continuous with a constant that we compute. Then, we obtain an upper bound on its value on the whole domain by computing the value of the function on a grid of points. Finally, the algorithm subsequently refines the grid around the points where the value of the function is large in order to approach, step by step, the global maximum. Additional details are given in the next three sections.

Lipshitz continuity of the entropy with respect to the angle -A key ingredient in the implementation of the desired certified algorithm is that the von Neumann entropy H(ρ) has a bounded gradient with respect to the following angle between the two states ρ and σ (see App. B.1)

A(ρ, σ) = arccos(F (ρ, σ)), ( 42
)
where the fidelity is defined as

F (ρ, σ) = tr| √ ρ √ σ|.
This angle is a metric on the set of states [START_REF] Nielsen | Quantum Computation and Quantum Information: 10th Anniversary Edition[END_REF]. More precisely, we show that for n-dimensional quantum states, the gradient of the entropy satisfies

dH dA < 4.023 n = 4 2 log(n) n ≥ 5. ( 43
)
This contrasts with the trace distance, another metric on the set of quantum states, for which the entropy has an infinite slope around non-full-rank states.

Bounding the gradient of the goal function-

To apply the continuity bound above to the goal function in Eq. (38), we use the following parametrization of the state

√ L =     cos(α) cos(µ) cos(α) sin(µ) sin(α) cos(ξ) sin(α) sin(ξ)     , (44)
so that the quantum models are described by four angles x = (α, µ, ξ, φ), (45)

with x ∈ [0, π 4 ] ×3 × [0, π 2 ]. Here, the condition µ, ξ ≤ π 4 follow from L 1 ≥ L 2 , L 3 ≥ L 4 . The bound α ≤ π 4 is a consequence of L 1 + L 2 ≥ L 3 + L 4
, which can be imposed on the states as an alternative to

L 1 -L 2 ≥ L 3 -L 4 , see App. A.1.
To obtain a bound on the gradient of the goal function

G(x) = H(L) -H(ρ E |â = +1) + t β max (L,φ; Ω) (46)
we bound the gradient of each term independently, as described in App. B.2 and B.3. For the entropic terms, we use Eq. ( 43), while the computation of the maximal gradient is quite straightforward for the CHSH score. Combining the three terms, we obtain a general bound

|∇ x G| ≤ 12.7 + 7 t (47)
on the whole domain of x.

With this global bound on the gradient, a certified maximization of the function G(x) can be obtained with a slight modification of the code that we developed in Ref. [START_REF] Valcarce | What is the minimum CHSH score certifying that a state resembles the singlet?[END_REF], which is available on GitLab. A detailed description of this code can be found in the App. B.4.

Results

Improved bound on Eve's conditional entropy-

In order to demonstrate the advantage of considering the pair of variables (X, Y) when bounding Eve's conditional entropy, we compute the bound on H( A 0 |E) for different values of X, Y and p and compare it to the bound obtained from the CHSH score [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF]. Because of the two regimes identified earlier, we compute both the optimal bound assuming Ω ≤ π/4 and the one assuming Ω > π/4 for each value of X and Y, and keep the best one. In the case Ω ≤ π/4, the optimal choice of Ω is readily given by Eq. ( 29). In the other case, we optimize the bound over Ω ∈ (π/4, π/2]. The difference between this optimal bound on H( A 0 |E) given X and Y and Eq. ( 3) is shown in Fig. 1. It shows that our bound on H( A 0 |E) is better than the one derived from the CHSH score, except along the line satisfying X(X + Y) = 4.

Implication for a practical realization of DIQKD-We now study the potential impact of our bound on practical realizations of DIQKD. In the limit of asymptotically many repetitions, an implementation is uniquely characterized by its key rate r, which is given in Eq. ( 2). In our case, this key rate is determined from three quantities: X, Y and Bob's uncertainty about Alice's key generating bit as a function of the noisification parameter, given by H( A 0 |B 2 ). Hence, in order to find the optimal design for an experimental implementation of DIQKD, we express the quantities setup X, Y,

H( Â0 |B 2 ) (48)
as a function of the model's parameters. Then, we maximize the key rate over these parameters: Solving this maximization gives a bound on the key rate ř, the values X * , Y * , H( A 0 |B 2 ) expected for a given implementation, as well as the optimal values of the parameters Ω * and q * for this implementation.

ř = max setup,Ω,q H( A0|E) -H( A0|B2) = max setup,Ω,q 1 -I C Ω X + S Ω Y 2 ; Ω, q -H( Â0|B2) (49)

SPDC-based implementation of DIQKD-

Photonic experiments using a source based on spontaneous parametric down conversion (SPDC) are one of the most promising setups for implementing DIQKD, as shown by recent experiments reporting on the violation of a Bell inequality without the fair sampling assumption [START_REF] Bg Christensen | Detection-loophole-free test of quantum nonlocality, and applications[END_REF][START_REF] Giustina | Bell violation using entangled photons without the fair-sampling assumption[END_REF][START_REF] Giustina | Significant-loophole-free test of Bell's theorem with entangled photons[END_REF][START_REF] Liu | Deviceindependent quantum random-number generation[END_REF][START_REF] Lynden K Shalm | Strong loophole-free test of local realism[END_REF][START_REF] Shen | Randomness extraction from bell violation with continuous parametric down-conversion[END_REF]. We consider such a setup in which an SPDC source is used to create and distribute polarization entanglement between distant parties who perform measurements as requested here in the proposed protocol. The main limitation in this setup is the overall detection efficiency, i.e. the possibility of losing a photon at any point between its creation at the source and its final detection. To reflect photon losses and nonunit detection efficiency, the transmission channel between the source and the parties is modeled as a lossy channel with an overall transmission η. It is also important to include the statistics of an SPDC source which does not produce a two-qubit state, but a state that contains vacuum and multiple photon components. We invite the reader to look at Ref. [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF] to get explicit expressions of the exact statistics created by this source as well as a description of tunable parameters.

When computing the key rate for an SPDC source with a security determined by the CHSH score, any values of X and Y with the same sum impose the same bound on Eve's conditional entropy H( A 0 |E). In a Eberhard-like scenario where a significant fraction of the entangled particles can be lost before yielding their measurement result, it is advantageous for Alice to use two measurement settings with different overlap with her Schmidt basis in order to maximize the CHSH quantity [START_REF] Eberhard | Background level and counter efficiencies required for a loophole-free einstein-podolsky-rosen experiment[END_REF]. It is then easier for Bob to guess the outcome of one of the two measurements (the one best aligned with the Schmidt basis). When the key rate is extracted from this measurement to minimize the cost of error correction (see Ref. [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF] for more details), the value of the X quantity is then larger than Y, as shown in Fig. 1. But in this case, the (X,Y) values are very close to the line X(X + Y) = 4, for which there is no advantage. Therefore, we only expect a small improvement in the key rate here.

Given the values shown in Fig. 1, a better bound on Eve's information would be obtained if the same CHSH value was obtained with the contributions from X and Y being inverted, i.e. with Y > X. However, this requires Alice to define her key-generating measurement as being the one less aligned with the Schmidt basis, hence leading to an increase of the error correction cost. In this case, both conditional entropies H( A 0 |E) and H( A 0 |B 2 ) are larger, and we need to check which one increases the most in order to infer a possible gain on the key rate. As it turns out, the tradeoff between these two entropies increase depends on the detection efficiency.

Namely, there are two regimes, as shown in Fig. 2. When the detection efficiency is larger than ∼ 0.923, relabelling the measurements in order to enter the region with Y > X (where inequalities with Ω > π/4 significantly improve the bound on H( A 0 |E)) is advantageous, because the increase in Bob's uncertainty H( A 0 |B 2 ) is smaller. The red curve in Fig. 1 shows the corresponding trajectory in the X-Y plane. When η < 0.923, the cost of error correction become prohibitive compared to the potential increase in Eve's uncertainty, and it is better to stay in the region X > Y, as represented by the yellow curve in Fig. 1. There, a small increase of the key rate is still found because the correlations do not satisfy Figure 2: Key rate achievable with a photonic setup as a function of the symmetric detection efficiency η. The dashed blue curve corresponds to the key rate achieved with noisification and a security based on the CHSH quantity alone; it is nonzero for efficiencies above ∼0.828 [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF]. The continuous red curve bases its security on the values of both X and Y (and also includes noisification). A significant increase of the key rate is possible for efficiencies above η > 0.923. At η = 1, the obtained key rate is 0.346 instead of 0.252. X(X + Y) = 4 exactly. However, this condition is only slightly violated, resulting in an increase in key rate smaller than ∼ 10 -4 , which is practically negligible. The critical detection efficiency then also remains at 82.8%, unchanged compared to a bound based on CHSH alone.

Comparison of qubit vs SPDC bounds-

To illustrate the impact of the photon statistics of SPDC sources on DIQKD, we now consider a simpler model in which the state shared between Alice and Bob is a two-qubit state:

|ψ = cos(θ) |00 + sin(θ) |11 . ( 50
)
We are not aware of physical setups allowing one to produce a state with θ = π/4 but not allowing for a different value of θ. Still, for the sake of the discussion, we distinguish between the cases where the state can be either constrained to be maximally entangled, i.e. θ = π/4, or can have an arbitrary parameter θ ∈ [0, π/4].

In Fig. 3, we report the critical detection efficiencies corresponding to various security analyses applied on these implementations. Like for the SPDC model, no advantage on the critical detection efficiency is found when using arbitrary two-qubit systems. A small advantage is however present when Figure 3: Comparison of the critical detection efficiencies for several setup models. Blue markers are for SPDC statistics, yellow ones for measurement on a maximally entangled two-qubit state, and red ones for measurement on an arbitrary two-qubit state. (a) is with security from CHSH following Eq. ( 3) and error correction based on the QBER [START_REF] Pironio | Device-independent quantum key distribution secure against collective attacks[END_REF], (b) Eq. ( 3) with error correction based on conditional entropy H(A|B) [START_REF] Ma | Improved data post-processing in quantum key distribution and application to loss thresholds in device independent qkd[END_REF], (c) security from CHSH with noisification and error correction based on H(A|B) following [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF], (d) security from X and Y with noisification and error correction based on H(A|B).

restricting to measurements on the singlet state. Still, this model is not optimal and it remains of course better to use partially entangled states. In fact, even partially entangled states produced by an SPDC source perform better.

In this respect, it is worth noticing here that the performance of an SPDC source is essentially comparable to that of an arbitrary two-qubit state once noisification is taken into consideration, i.e. the requirement on the detection efficiency is very similar. In the case with no noisification, the state produced by these physical sources do not have a better tolerance to losses than measurements on a maximally entangled state. Noisy preprocessing is thus a key ingredient for a first proof of principle implementation with an SPDC source [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF].

Discussion

In this paper, we introduced a refinement of the usual CHSH-based analysis of DIQKD experiments: Instead of projecting the measurement statistics onto a single line giving the CHSH score 2 √ 2(X + Y), we kept the information about the individual values of X and Y throughout the whole security analysis. We found that this refined analysis gives a more restrictive bound on the information available to the eavesdropper for almost all values X and Y in the quantum set.

When applying our results to photonic implementations of DIQKD with a SPDC source, we found that the key rate is improved by a factor going up to 37% for unit detection efficiency. On the other hand, we could not find any improvement for the critical detection efficiency as compared to the CHSH protocol with noisy processing presented in Ref. [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF]. However, we focused on a given photonic implementation, and the question of the most favorable optical setup combining squeezing operations, displacement operations, linear optical elements and photon counting techniques is still open. Advanced techniques using automated design of quantum experiments based on reinforcement learning which already proved to be useful to optimize the CHSH score [START_REF] Alexey A Melnikov | Setting up experimental Bell test with reinforcement learning[END_REF] are inspiring. Applying them to the proposed protocol in order to reduce the required detection efficiency for implementing DIQKD appears to be promising for future work.

Finally, we would like to remark that the certified numerical techniques we proposed also open up the possibility of bounding Eve's information reliably when more correlators, or even the full measurement statistics, are taken into account.

Note added

While writing this manuscript, we became aware of another manuscript [37] reporting on similar results. of single-photon detectors. A Analytical results

New

A.1 Parametrization of two-qubit models

Following the logic of [START_REF] Pironio | Device-independent quantum key distribution secure against collective attacks[END_REF], we assume, without loss of generality that after the qubit reduction, the state shared by Alice, Bob and Eve is of the form

|Ψ ABE = i=1 L i Φ i AB |i E ( 51
)
where we |Φ i = {Φ + , Ψ -, Φ -, Ψ + } 4 i=1 , with nonnegative L 1 ≥ L 2 and L 3 ≥ L 4 , and the measurements A x , B y appearing in the constraint are in the x-z plane

A x = a T x σ z σ x B y = b T y σ z σ x . ( 52
)
The key generating setting is explicitly parametrized by an angle φ

a 0 = C φ S φ . ( 53
)
(As mentioned in the main text we use a compact notation C φ = cos(φ) and S φ = sin(φ) throughout the paper.) One notes that the application of a unitary transformation σ Z on Alice's system is equivalent to changing the state and the measurements as

(L 1 , L 2 , L 3 , L 4 ) → (L 3 , L 4 , L 1 , L 2 ) a x → σ z a x b y → b y . ( 54
)
The two situations are completely equivalent for our purpose, so our parametrization of quantum models is actually redundant. To avoid this, we can introduce an order relation between the pairs of coefficients (L 1 , L 2 ) and (L 3 , L 4 ) (permuted by a basis transformation). In particular, we will impose

L 1 -L 2 ≥ L 3 -L 4 (55) below, but will also use L 1 + L 2 ≥ L 3 + L 4 for the certified numerical algorithm.
We also introduce a different parametrization of the probability simplex L with a vector T = (T z , T x , T p ) given by

     T z = (L 1 -L 2 ) + (L 3 -L 4 ) T x = (L 1 -L 2 ) -(L 3 -L 4 ) T p = L 1 + L 2 -L 3 -L 4 . (56) The conditions L 1 ≥ L 2 , L 3 ≥ L 4 and L 1 -L 2 ≥ L 3 -L 4 enforce 0 ≤ T x ≤ T z ≤ 1 T z + T x -1 ≤ T p ≤ 1 -(T z -T x ) (57)

A.2 Entropies of ρ E|â=±1

Having introduced a parametrization of quantum models, we now express the quantities of interest H(ρ E ), H(ρ E | Â0 ) and B Ω as functions of the distribution L describing the state |Ψ ABE and the measurement settings a x , b y . The marginal state of Eve is straightforward to write down:

ρ E =     L 1 L 2 L 3 L 4     . ( 58
)
For the conditional states, we have

ρ E|â=+1 = 2 trAB 1 + Â0 2 ⊗ 1BE |Ψ Ψ| ABE =    L1 0 C φ √ L1L3q S φ √ L1L4q 0 L2 S φ √ L2L3q -C φ √ L2L4q C φ √ L1L3q S φ √ L2L3q L3 0 S φ √ L1L4q -C φ √ L2L4q 0 L4    , (59)
where the factor of two arises because the probability to observe the outcome Â0 = 1 is simply 1 2 . The conditional state for the other outcome Â0 = -1 can be easily obtained by noticing that the two outcomes are interchanged by a mapping Â0 → -Â0 , i.e. with the inversion of the vector C φ S φ → -C φ S φ . Consequently, we have

ρ E|â=-1 =     1 1 -1 -1     ρ E|â=1     1 1 -1 -1     . ( 60
)
It follows that the entropies of both conditional states are equal and

H(ρ E | Â0 ) = 1 2 H(ρ E|â=+1 ) + 1 2 H(ρ E|â=-1 ) = H(ρ E|â=+1 ). (61)
Analogously to Eq. ( 60), there are unitary transformations (with different positions of 1 and -1 on the diagonal) that correspond to the transformations

C φ S φ → -C φ S φ and C φ S φ → C φ -S φ .
This implies that H(ρ E | Â0 ) and H( Â0 |E) do not depend on these sign changes, i.e. they are only functions of C 2 φ and S 2 φ .

A. [START_REF] Samuel | Side-channel-free quantum key distribu-tion[END_REF] Optimal key generating setting a 0

In this section, we give the minimal angle φ for which constraint B Ω ≥ β can be fulfilled for a given L. We first focus on the possible values of φ. The expected Bell score is straightforward to compute:

B Ω = 1 2 tr (((C Ω A 0 ⊗ (B 0 + B 1 ) + S Ω A 1 ⊗ (B 0 -B 1 )) ⊗ 1 E ) |Ψ Ψ| ABE ) = 1 2 C Ω a T 0 T z T x (b 0 + b 1 ) + 1 2 S Ω a T 1 T z T x (b 0 -b 1 ) (62)
From this expression we notice that any of the following transformations of the key generating setting:

a 0 → (-1) s1 (-1) s2 a 0 , (63)
with s 1 , s 2 ∈ {0, 1} can be compensated by applying the same transformation to the remaining settings a 1 , b y to give the same Bell score B Ω . Furthermore, we have seen that this transformation does not change Eve's conditional entropy H( Â0 |E). Therefore we can always restrict a 0 to the positive quadrant of the circle

φ ∈ [0, π 2 ] ( 64
)
without loss of generality. We now express the Bell score with Bob's settings parametrized as in Eq. ( 17):

B Ω = C Ω C θ a 0 • Z X ⊗ c • Z X +S Ω S θ a 1 • Z X ⊗ c ⊥ • Z X . ( 65
)
Computing the expected value of the operators on our Bell diagonal state gives

B Ω =C Ω C θ a T 0 T z T x c + S Ω S θ a T 1 T z T x c ⊥ . ( 66
)
We introduce an angle γ to parametrize the vectors c and c ⊥ :

c = C γ S γ , c ⊥ = -S γ C γ . ( 67
)
The maximization with the second setting of Alice is straightforward, that is

max a1 S θ a T 1 T z T x c ⊥ = S θ T z T x c ⊥ = |S θ | T 2 z S 2 γ + T 2 x C 2 γ .
The Bell score (optimized with respect to a 1 ) becomes

B Ω = C Ω C θ C φ S φ T T z T x C γ S γ + S Ω |S θ | T 2 z S 2 γ + T 2 x C 2 γ . Since T z , T x ≥ 0 and φ, Ω ∈ [0, π 2 ]
, we can also restrict the angle θ and γ to the interval [0, π 2 ] without loss of generality, and drop the absolute value:

|S θ | = S θ . The constraint B Ω ≥ β takes the form C Ω C φ S φ T T z T x C γ S γ ≥ β -S Ω S θ T 2 z S 2 γ + T 2 x C 2 γ C θ . ( 68
)
Recall that we wish to find the minimal φ for which this inequality can be fulfilled for at least one value of the free parameters θ and γ. We observe that if the right hand side (RHS) can become zero or negative by some choice of θ and γ, the constraint becomes trivial. Since T z ≥ T x , this is possible for

β 2 ≤ S 2 Ω T 2 z =⇒ φ * = 0. ( 69
)
In the following we assume that this is not the case, i.e. β 2 > S 2 Ω T 2 z . The angle θ only appears on the right of the inequality, so to satisfy the inequality our best choice is to minimize the RHS with respect to θ. The expression

β -S Ω S θ T 2 z S 2 γ + T 2 x C 2 γ C θ (70)
either has a local minimum that can be found by setting its derivative to zero, or there is no local minimum and the expression is minimal at the boundary θ = 0 since it diverges for θ → π 2 . Differentiating the expression with respect to theta, we find that a local minumum does exist at

S θ = S Ω T 2 z S 2 γ + T 2 x C 2 γ β , (71)
(recall the assumption above). Plugging this value into Eq. ( 68) allows us to rewrite the constraint as

C Ω C φ S φ T T z T x C γ S γ ≥ β 2 -S 2 Ω (T 2 z S 2 γ + T 2 x C 2 γ ), (72)
which we rewrite as

C φ S φ T v γ ≥ 1, with v γ = C Ω β 2 -S 2 Ω (T 2 z S 2 γ + T 2 x C 2 γ ) T z C γ T x S γ . ( 73
)
Now it becomes simple to check if the constraint can be satisfied at all. The vector v γ belongs to the positive quadrant of the plane with v 0 1 0 and v π/2 0 1 , hence the inequality a 0 •v γ ≥ 1 can be satisfied if and only if the length of the vector v γ reaches 1, i.e.

|v γ | 2 = C 2 Ω (T 2 z C 2 γ + T 2 x S 2 γ ) β 2 -S 2 Ω (T 2 z S 2 γ + T 2 x C 2 γ ) ≥ 1 (74)
for some γ. We rewrite this inequality as

1 2 T 2 z + T 2 x + (T 2 z -T 2 x )C 2γ C 2Ω -2β 2 ≥ 0. (75) Given that T 2 z ≥ T 2 x , the left hand side (LHS) is max- imal for γ = 0 if Ω ≤ π 4 and for γ = π 2 if Ω > π 4 . Hence, B Ω ≥ β can be fulfilled if and only if for Ω ≤ π 4 , C 2 Ω T 2 z + S 2 Ω T 2 x ≥ β 2 for Ω > π 4 , S 2 Ω T 2 z + C 2 Ω T 2 x ≥ β 2 .
(76)

Consider the first case Ω ≤ π 4 . Setting γ = 0 one verifies that if the constraint can be fulfilled, then it can be fulfilled with φ = 0:

1 0 T v 0 = C Ω T z β 2 -S 2 Ω T 2 x ≥ 1 ⇐⇒ C 2 Ω T 2 z + S 2 Ω T 2 x ≥ β 2 . ( 77
)
Hence, in this case the minimal possible angle is φ * = 0 as long as the Bell score can be attained as formalized by Eq. ( 76).

The other case Ω > π 4 is less trivial. Assume that the constraint can be satisfied,

S 2 Ω T 2 z + C 2 Ω T 2 x ≥ β 2 . We first check if φ = 0 is a solution 1 0 T v γ 2 = C 2 Ω C 2 γ T 2 z β 2 -S 2 Ω (T 2 z S 2 γ + T 2 x C 2 γ ) ≥ 1 ⇐⇒ C 2 γ (C 2 Ω T 2 z + S 2 Ω T 2 x -S 2 Ω T 2 z ) + S 2 Ω T 2 z ≥ β 2 (78) As S 2 Ω T 2 z + C 2 Ω T 2 x ≥ β 2 ≥ S 2 Ω T 2 z , the LHS is maximal for γ = 0. Therefore φ * = 0 iff C 2 Ω T 2 z + S 2 Ω T 2 x ≥ β 2 . ( 79
)
We now assume

S 2 Ω T 2 z + C 2 Ω T 2 x ≥ β 2 > C 2 Ω T 2 z + S 2 Ω T 2 x , ( 80
)
such that the constraint can be fulfilled but not with φ = 0. To find the minimal φ that allows to do so we look on the dependence of the length of the vector v γ on γ. We compute

d dγ |vγ| 2 = (T 2 z -T 2 x )C 2 Ω S2γ (β 2 -(T 2 z S 2 γ + T 2 x C 2 γ )S 2 Ω ) 2 ((T 2 z + T 2 x )S 2 Ω -β 2 ), ( 81
)
here (T 2 z + T 2 x )S 2 Ω ≥ S 2 Ω T 2 z + C 2 Ω T 2 x ≥ β 2 .
Thus the derivative is positive and the length of v γ is increasing with γ.

We can now give a simple geometrical interpretation to our problem of finding the minimal φ: for each value φ such that

C φ S φ T v γ ≥ 1 (82)
a line tangent to the unit circle at C φ S φ is also crossing the curve v γ . So for the minimal value φ * there is a line tangent to both v γ and the unit circle at C φ * S φ * . The equation of the line tangent to v γ reads (λ) = v γ + λv γ . This line is tangent to the unit circle if and only if the equation

|v γ + λv γ | 2 = 1 (83)
has only one solution, where the derivative is with respect to γ. This is a quadratic equation

λ 2 |v γ | 2 + 2λv γ • v γ + |v γ | 2 -1 = 0, (84)
which has a unique solution iff its determinant is zero

v γ • v γ 2 = |v γ | 2 |v γ | 2 -1 . ( 85
)
With

v γ = C Ω (β 2 -S 2 Ω (T 2 x C 2 γ + T 2 z S 2 γ )) 3/2 T z S γ (T 2 z S 2 Ω -β 2 ) -T x C γ (T 2 x S 2 Ω -β 2 ) (86)
lengthy but straightforward algebra gives

S 2 γ = - T 2 x (β 2 -T 2 x S 2 Ω )(β 2 -(T 2 z + T 2 x )S 2 Ω ) (T 2 z -T 2 x ) β 4 + S 2 Ω (T 2 x T 2 z -2β 2 (T 2 x + T 2 z )) + S 4 Ω (T 4 x + T 4 z ) . ( 87
)
To find that the minimal angle φ * note that for the tangent line

C φ * S φ * • v γ = 0, and therefore -S φ * C φ * = v γ |v γ |
. Plugging in the above equations we find

c 2 * (L, Ω, β) = cos 2 φ * (L, Ω, β) = (β 2 -S 2 Ω T 2 x )(C 2 Ω T 2 x + S 2 Ω T 2 z -β 2 ) C 2 Ω (T 2 z -T 2 x )(S 2 Ω T 2 z + S 2 Ω T 2 x -β 2 ) . ( 88
)
A.4 Eve's maximum information for Ω ≤ π 4

We here give details on the derivation of the formula [START_REF] Renner | Information-theoretic security proof for quantum-key-distribution protocols[END_REF] in the main text which corresponds to Eve's maximum information in the case Ω ≤ π 4 . For these inequalities we have seen that the constraint

C 2 Ω T 2 z + S Ω T 2 x ≥ β 2 can be fulfilled with c 2 * (L, β) = 1.
The choice of the measurement angle implies C φ = 1 implies a simple form for the state ?

ρ E|â=+1 =     L 1 0 √ L 1 L 3 q 0 0 L 2 0 - √ L 2 L 4 q √ L 1 L 3 q 0 L 3 0 0 - √ L 2 L 4 q 0 L 4     , (89)
with a closed form expression for its eigenvalues implying

H(ρ E|â=1 ) = H p =         1 2 L 1 + L 3 + 4L 1 L 3 q + (L 1 -L 3 ) 2 1 2 L 1 + L 3 -4L 1 L 3 q + (L 1 -L 3 ) 2 1 2 L 2 + L 4 + 4L 2 L 4 q + (L 2 -L 4 ) 2 1 2 L 2 + L 4 -4L 2 L 4 q + (L 2 -L 4 ) 2         . ( 90
)
The constraint on the generalized CHSH score leads to the following constraint on the vector L

T 2 Z T 2 X • C 2 Ω S 2 Ω = 2 (L 3 -L 4 ) (L 1 -L 2 ) C 2Ω + (L 1 -L 2 ) 2 + (L 3 -L 4 ) 2 ≥ β 2 . ( 91
)
Our goal is thus to find the components of the vector L maximizing H(L) -H(p) and satisfying the previous constraint. Inspired by Ref. [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF], we first introduce the following parametrization

L 1 = P x L 3 = P (1 -x) L 2 = (1 -P )y L 4 = (1 -P )(1 -y). ( 92
)
The partial ordering of the L coefficients implies

(1 -P )y ≤ P x ≤ (1 -P )y + 2P -1 (93)
which requires P ≥ 1 2 . The advantage of this parametrization comes from the fact that our figure of merit can be nicely rewritten as

H(L) -H(p) = P h q (x) + (1 -P )h q (y) h q (z) = h(z) -h(n q (z)) n q (z) = 1 + 1 -4 (1 -q) z(1 -z) 2 (94)
where

h(z) = -z log(z) -(1 -z) log(1 -z)
is the binary entropy function with the logarithm in base 2, while the constraint on the expected value of the generalized CHSH operator is given by S Ω (2P (x + y -1) -2y + 1)

2 + C Ω (1 -2P ) 2 ≥ β 2 (95)
For a fixed P, the curve in the (x, y)-plan that corresponds to a constant value β satisfies P dx = (1 -P ) dy. This remark allows one to maximize H(L) -H(p) along this curve and find that it is optimal for Eve to set x + y = 1, see appendix C2 in Ref. [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF] for the detailed argument. The symmetry of the function h q (x) = h q (1 -x) allows us to write the problem as max

x,P H(L) -H(p) = h q (x) s.t. (2P -1) 2 C 2 Ω + (1 -2x) 2 S 2 Ω ≥ β 2 . ( 96
)
As the goal function h q (x) does not depend on P , we can set its value to P = 1 because this is the value maximizing the LHS of the constraint inequality and allowing the largest possible interval for the remaining variable x. We thus get max

x,P H(L) -H(p) = h q (x) s.t. (1 -2x) 2 ≥ β 2 -C 2 Ω S 2 Ω . ( 97
)
Finally, as h q (x) is a monotonically decreasing function of x (see Ref. [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF]), it is optimal to set x to the least possible value compatible with the constraint. This implies

I(β; Ω, q) = h q (z) with z = 1 2   β 2 -C 2 Ω S Ω + 1   . ( 98
)
Let us now recall that the situation with

c 2 * (L, β) = 1 and C 2 Ω T 2 z + S Ω T 2
x ≥ β 2 also occurs in the case Ω > π 4 . The above proof guarantees that it is optimal for Eve to use strategies where the inequality is saturated C 2 Ω T 2 z + S Ω T 2 x = β 2 . Hence in the optimization problem for Ω > π 4 we can ignore all the strategies with C

2 Ω T 2 z + S Ω T 2 x > β 2 .

A.5 Concavity of h q • z(β)

Recall that in order to use the bound I(β; Ω, q) derived for two-qubit strategies in the previous section as a universal bound (valid for strategies in any dimension), we have to show that this function is concave. In this case, for any mixture of qubit strategies (enforced by the Jordan's lemma) with an average score β = i p i β i , Eve's information satisfies

Ī(β; Ω, q) = i p i I(β i ; Ω, q) ≤ I( β; Ω, q). ( 99
)
The concavity of I(β; Ω, q) = h q (z(β)) follows from the fact that its second derivative is negative

d 2 dβ 2 hq z(β) = h q (z) z (β) 2 + h q (z)z (β) ≤ 0, (100)
which we are going to show below. In this section we will use the natural algorithm instead of logarithm in base 2. The function h q (z) takes a positive real factor upon changing the base of the algorithm, so it is irrelevant for its concavity. Note first that z(β) ∈ [ 1 2 , 1] and

β 2 -C 2 Ω = S Ω (2z -1). (101)
Then consider the following identities

(z (β)) 2 = β 2 4S 2 Ω (β 2 -C 2 Ω ) = S 2 Ω (2z -1) 2 + C 2 Ω 4S 4 Ω (2z -1) 2 z (β) = -C 2 Ω 2S Ω (β 2 -C 2 Ω ) 3/2 = -C 2 Ω 2S 4 Ω (2z -1) 3 . ( 102
)
The identity (100) that we want to prove thus becomes

h q (z)(2z -1)(S 2 Ω (2z -1) 2 + C 2 Ω ) -2h q (z)C 2 Ω 4S 4 Ω (2z -1) 3 ≤ 0. ( 103
)
Multiplying by a positive fraction

4S 4 Ω (2z-1) 3 C 2 Ω
it can be straightforwardly simplified to the form

h q (z)(2z -1)(T 2 Ω (2z -1) 2 + 1) -2 h q (z) ≤ 0. ( 104
)
As h q (z) ≤ 0 was proven in [START_REF] Ho | Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution[END_REF]36], we have the inequality

h q (z)(2z -1) 2 T 2 Ω ≤ 0. ( 105
)
We use it to relax the inequality in Eq. ( 104) to

h q (z)(z - 1 2 ) -h q (z) ≤ 0. ( 106
)
At the point z = 1 2 the left hand side becomes zero, since h q ( 1 2 ) = 0 and |h q ( 1 2 )| < ∞, see below. From now on, we thus exclude the point z = 1 2 and consider z ∈ ( 1 2 , 1]. Now we can divide the whole expression by a strictly positive factor (z -1 2 ) 2 . We obtain 1 2

h q (z)(z -1 2 ) -h q (z)(z -1 2 ) (z -1 2 ) 2 ≤ 0, (107)
or 1 2

h q (z) z -1 2 = h q (z) 2z -1 ≤ 0. ( 108
)
In other words we want to show that the function

( * ) d dz h q (z) 2z -1 ≤ 0 (109)
on the interval z ∈ ( 1 2 , 1]. Let us now compute this function:

h q (z) 2z -1 = h (z) 2z -1 -h (n q (z)) n q (z) 2z -1 . ( 110
)
The last fraction can be simplified to

n q (z) 2z -1 = (2z -1)(1 -q) (2z -1) 1 -4 (1 -q) z(1 -z) = 1 -q 2n q (z) -1 . ( 111
)
Therefore

h q (z) 2z -1 = h (z) 2z -1 -(1 -q) h (n q (z)) 2n q (z) -1 = g(z) -(1 -q)g n q (z) , (112)
where

g(z) = h (z) 2z -1 = - log( z 1-z ) 2z -1 . ( 113
)
To complete the proof we thus need to show that ( * ) g (z) -(1 -q)g n q (z) n q (z) ≤ 0. (114)

From Eq. (111), we have

n q (z) = (1 -q) 2z -1 2n q (z) -1 , ( 115
)
so the inequality to be shown can be rewritten as

g (z) 2z -1 -(1 -q) 2 g (n q (z)) 2n q (z) -1 ≤ 0. ( 116
)
For q = 0 we have (1 -q) = 1 and n q (z) = z so the two terms are equal. The identity to be shown can then be expressed as

( * ) f (z, 0) -f (z, q) ≤ 0 with f (z, q) = (1 -q) 2 u(nq(z)) u(z) = g (z) 2z -1 = 1 z-1 + 1 z + 2 log z 1-z (2z -1) 3 , ( 117
)
which holds for q = 0 trivially. To show that it holds for all q it is sufficient to demonstrate that the function f (z, q) is increasing with q, i.e.

( * )

d dq f (z, q) ≥ 0, (118)
which we are going to show now. Using

d dq n q (z) = (1 -z)z 1 -4(1 -q)(1 -z)z = n q (z)(1 -n q (z)) (1 -q)(2n q (z) -1) (119) we obtain d dq f (z, q) = -2(1 -q)u n q (z) + (1 -q) 2 u n q (z) d dq n q (z) = -2(1 -q)u(n) + (1 -q)u (n) n(1 -n) 2n -1 (120)
for n > 1 2 , which is positive iff q = 1 or

( * ) u (n)n(1 -n) -2u(n)(2n -1) ≥ 0. ( 121
)
In the case q < 1, straightforward algebra allows to find a simple expression of the left hand side and rewrite the condition as

6n 2 -4n 3 -1 + 4(n 4 -2n 3 + 2n 2 -n) log n 1-n (2n -1) 4 n(1 -n) ≥ 0 ⇐⇒ 6n 2 -4n 3 -1 + 4(n 4 -2n 3 + 2n 2 -n) log n 1 -n ≥ 0 (122)
Changing the variable to x + 1 = n 1-n with x ≥ 0 we express the above inequality as

x(x 2 + 6x + 6) (x + 2) 3 -4 (x + 1)(x 2 + 3x + 3) (x + 2) 4 log(x + 1) ≥ 0 ⇐⇒ log(1 + x) ≤ x(x + 2)(x 2 + 6x + 6) 4(x + 1)(x 2 + 3x + 3) . ( 123
)
To prove this relation note that there is equality for x = 0, but the LHS increases slower than the RHS log (1 + x) ≤ x(x + 2)(x 2 + 6x + 6) 4(x + 1)(x 2 + 3x + 3) ⇐⇒

1 1 + x ≤ 1 4 9(x + 1) (x(x + 3) + 3) 2 + 1 (x + 1) 2 + 3 x(x + 3) + 3 + 1 ⇐⇒ x 4 (x + 2) 2 4(x + 1) 2 (x(x + 3) + 3) 2 ≥ 0, (124)
which concludes the proof.

Properties of h q ( 1 2 ) and h q ( 1 2 ) We start with the first derivative and want to show that h q ( 1 2 ) = 1/2. We have

h q (z) = h(z) -h(n q (z)) = h (z) -h (n q (z))n q (z) (125)
The binary entropy hits a maximum at z = 1/2 so h ( 12 ) = 0. For the second term, we use (115) to get

h (nq(z))n q (z) = -(1 -q) 2z -1 2nq(z) -1 log nq(z) 1 -nq(z) , ( 126
) (2z -1) = 0 at z = 1 2 , while | 1 -q 2n q (z) -1 log n q (z) 1 -n q (z) | z=1/2 | = | (1 -q) log 1+ √ q 1- √ q √ q | . ( 127
)
Changing the variable to x + 1 =

1+ √ q 1-
√ q with x ≥ 0 yields for the last expression

| 4(x + 1) log(x + 1) x(x + 2) | < ∞. (128)
It is obviously bounded for x > with any , and the fact that the limit x → 0 exists can be seen by straightforward application of l'Hôpital's rule. Hence,

h q ( 1 2 ) = 0. ( 129
)
We also wish to show that the second derivative h q ( 1 2 ) is bounded. To do so we compute

h q ( 1 2 ) = 2(1 -q) log 1+ √ q 1- √ q √ q -4. (130)
But as we have just shown that

| (1 -q) log 1+ √ q 1- √ q √ q | < ∞, (131)
the desired result

|h q ( 1 2 )| < ∞ (132) follows.
A.6 Maximization of the generalized CHSH score with respect to auxiliary settings

In the goal function

H(ρ E ) -H(ρ E |â 0 (q)) + t B Ω (L, φ, a 1 , b 0 , b 1 ) (133)
that a priori appears in Eq. ( 38), it is only the Bell score which depends on the auxiliaty measuremnt settigns a 1 , b 0 and b 1 . As t is always positive we can straigtforwardly maximise the score with respect to these settings. We thus define

β max (L, φ) = max a1,b0,b1 B Ω (L, φ, a 1 , b 0 , b 1 ), (134)
which actually appears in Eq. (38).

Let us now compute this expression starting from Eq. ( 66), that we put in the form

B Ω = C θ S θ • C Ω a T 0 TzCγ TxSγ S Ω a T 1 -TzSγ TxCγ . ( 135
)
This form makes the maximization with respect to θ and a 1 straightforward max θ,a1

B Ω = max a1 C Ω a T 0 T z C γ T x S γ 2 + S Ω a T 1 -T z S γ T x C γ 2 = C 2 Ω (C φ T z C γ + S φ T x S γ ) 2 + S 2 Ω T 2 z S 2 γ + T 2 x C 2 γ .
(136)

To find the maximum with respect to γ or c = Cγ Sγ it is convenient to write the expression inside the square root as max θ,a1

B Ω 2 = c T C 2 Ω C 2 φ T 2 z + S 2 Ω T 2 x C 2 Ω C φ S φ T z T x C 2 Ω C φ S φ T z T x C 2 Ω S 2 φ T 2 x + S 2 Ω T 2 z c. (137)
It is now obvious that the value is maximal if c is aligned with the eigenvector of the matrix which corresponds to the maximal eigenvalue. Therefore

β max (L, φ) = max θ,γ,a1 B Ω (L, φ, a 1 , b 0 , b 1 ), = Eig + C 2 Ω C 2 φ T 2 Z + S 2 Ω T 2 x C 2 Ω C φ S φ T z T x C 2 Ω C φ S φ T z T x C 2 Ω S 2 φ T 2 x + S 2 Ω T 2 z = 1 √ 2 C 2 Ω (C 2 φ T 2 z + S 2 φ T 2 ) + S 2 Ω (T 2 z + T 2 x )+ (C 2 Ω (C 2 φ T 2 z -S 2 φ T 2 x ) -S 2 Ω (T 2 z -T 2 x )) 2 + 4(C 2 Ω C φ S φ T z T x ) 2 1/2 . ( 138
)
B Numerical tool

B.1 Lipshitz continuity of von Neumann entropy

Consider two states ρ and σ on an n-dimensional Hilbert space, that are close in fidelity:

F (ρ, σ) = tr| √ ρ √ σ| = f. ( 139
)
Given the monotonicity of arccos in the range [0, 1], this condition can be equivalently written in terms of the angle A(ρ, σ) = arccos(F (ρ, σ))

A(ρ, σ) = a = arccos(f ). ( 140
)
The angle is a metric on the space of density operators [START_REF] Nielsen | Quantum Computation and Quantum Information: 10th Anniversary Edition[END_REF], in particular it satisfies the triangle inequality.

Next, note that the angle between two states is lower bounded by the angle between the ordered vectors made of their ordered eigenvalues

a = A(ρ, σ) ≥ A(p, q) = arccos ( √ p • √ q) , ( 141
)
with p = Eig ↓ (ρ), q = Eig ↓ (σ) such that p 1 ≥ p 2 ≥ . . . This inequality follows from

F (ρ, σ) = tr| √ ρ √ σ| = max U tr √ ρ ( √ σU ) ≤ √ p • √ q, (142)
where in second line we used the so-called von Neumann trace inequality [START_REF] Mirsky | A trace inequality of John von Neumann[END_REF]. This bound is useful because the entropies of the states match the entropies of the probability distributions

H(ρ) = H(p) H(σ) = H(q). ( 143
)
Let us now bound their difference

∆H = |H(ρ) -H(σ)| = |H(p) -H(q)|. ( 144
)
To do so, note that for any two unit vectors √ p and √ q on the n-sphere there exist a path γ connecting the two and such that the integral along the path satisfies

√ q √ p dA = A(p, q) ≤ a. ( 145
)
Let us bound the variation of the entropy along the path. To this end, we associate a probability distribution r to each vector v on the path γ, with r i = (v (i) ) 2 (note that the vectors along the curve remain in the positive part of the n-sphere v (i) ≥ 0). A step dA from v along the path corresponds to some deformation of the vector given by

v dA → v + v ⊥ dA, ( 146
) with v • v ⊥ = 0. From H(r) = - i (v (i) ) 2 log((v (i) ) 2 ) ( 147
)
we compute the entropy variation for an infinitesimal increment of the angle

| dH dA | = 2| i v (i) v (i) ⊥ ( 1 log e (2) + log((v (i) ) 2 ))| = 2| i v (i) ⊥ v (i) log((v (i) ) 2 )| = 2 |v ⊥ • w| ≤ 2||w|| (148)
where we defined a vector w as

w i = v (i) log((v (i) ) 2 ) = √ r i log(r i ). Hence we obtain | dH dA | ≤ 2 i r i log 2 (r i ), (149)
and it remains to bound the expression on the RHS.

To do so, we will construct a concave upper bound on the function

c(r) = r log 2 (r) (150
we see that the function is concave c ≤ 0 on the interval r ∈ [0, 1 e ], and convex on the complement. To get a concave upper-bound we look for a line passing by r = 0 and c(1) = 0 and tangent to c(r). In the (r, c)-plane the equation of a line tangent to c(r) at r is given by

r (λ) = r c(r) + 1 c (r) λ. ( 152
)
It passes through the point r (λ) = (1, 0) iff c(r) + c (r)(r -1) = 0 log(r)(-2r + log(r) + 2) = 0 with solutions

r 1 = -1 2 W 0 (-2 e 2 ) ≈ 0.203 r 2 = 1 (153)
where W 0 is the principal branch of the Lambert Wfunction. The second solution r 2 = 1 is irrelevant. From the first solution we can construct a concave upper bound

c(r) ≤ ĉ(r) = c(r) r ≤ r 1 c(r 1 ) 1-r 1-r1 r > r 1 . ( 154
) Note that r 1 < 1 e .
Finally with the concave bound ĉ it is easy to obtain

i r i log 2 (r i ) = i c(r i ) ≤ i ĉ(r i ) = n i 1 n ĉ(r i ) ≤ n ĉ i r i n = n ĉ 1 n . ( 155
)
So for entropy susceptibility we get

| dH dA | ≤ 2 n ĉ( 1 n ) (156)
For n ≤ 4 one has 1 n > r 1 , while for n ≥ 5 the contrary is true, 1 n < r 1 . Therefore we can have a more explicit expression

| dH dA | ≤ 4 r 1 (1 -r 1 ) √ n -1 n ≤ 4 2 log(n) n ≥ 5 , ( 157
)
where we used the equationlog(r 1 ) = 2(1 -r 1 ) to compute c(r 1 ). In particular we get for n = 4

ĉ 1 4 = c(r 1 ) 1 -1/4 1 -r 1 < 1.011. ( 158
)
and deduce

| dH dA | ≤ 2 4 ĉ 1 4 < 4.023. ( 159
)
To bound the global entropy difference, we simply integrate along the curve γ to get

∆H ≤ √ q √ p |dH| ⇔ ∆H ≤ √ q √ p | dH dA | dA < 4.023 A(ρ, σ). ( 160
)
As a side remark, we note that for n ≥ 5, we get

B.2 Continuity of the goal function

The entropy term -To apply the continuity bound previously described to our situation, let ρ, ρ be the states on Â0 E produced by measurements along angles φ, φ on the states |Ψ ABE with the weight L, L respectively. Our aim is to bound

H( Â0 |E) ρ -H( Â0 |E) ρ . We use H( Â0|E)ρ -H( Â0|E)ρ = H(ρE) -H(E| Â0)ρ -H(ρ E ) + H(E| Â0)ρ ≤ H(ρE) -H(ρ E ) + H(E| Â0)ρ -H(E| Â0)ρ (163)
and bound the two last terms independently. For the first term involving H(ρ E ) ρ , things are straightforward. The states of Eve ρ E = diag(L) are 4dimensional and independent of φ, so

|H(ρ E ) L +H(ρ E ) L | ≤ 4.023 arccos( √ L• √ L ). ( 164
)
For the other term, we note

H(E| Â0 ) ρ -H(E| Â0 ) ρ = H( Â0 E) ρ -H( Â0 E) ρ = |H(ρ) -H(ρ )| (165) as H( Â0 ) = 1. Since Â0 E is 8-dimensional we get H(E| Â0 ) ρ -H(E| Â0 ) ρ ≤ 2 log(8) A(ρ, ρ ) = 6 A(ρ, ρ ). (166)
Given that ρ = ρ(L, φ) and ρ = ρ(L , φ ), we can use the triangle inequality to write

A(ρ, ρ ) ≤ A(ρ(L, φ), ρ(L , φ)) + A(ρ(L , φ), ρ(L , φ )). ( 167
)
For A(ρ(L, φ), ρ(L , φ)) we note that both states result from the action of the same CPTP map on two initial state |Ψ(L) ABE and |Ψ(L ) ABE . By the dataprocessing inequality (inherited by the angle from the fidelity F ) we have

A(ρ(L, φ),ρ(L , φ)) ≤ A(|Ψ(L) ABE , |Ψ(L ) ABE ) = A(L, L ) = arccos( √ L • √ L ). (168)
To bound the other term A(ρ(L , φ), ρ(L , φ )) we note that if we apply a channel that performs a Z measurement followed by noisy preprocessing to the state e iφY A /2 ⊗ 1 BE |Ψ ABE , this produces exactly the state ρ on Â0 E; analogously, applying the same channel to the state e iφ Y A /2 ⊗ 1 BE |Ψ ABE produces the state ρ . Therefore the data-processing inequality implies F (ρ, ρ ) is lower-bounded by

F e iφY A /2 ⊗ 1BE |Ψ , e iφ Y A /2 ⊗ 1BE |Ψ = Ψ| e i(φ -φ)Y A /2 ⊗ 1BE |Ψ = cos φ -φ 2 + i sin φ -φ 2 Ψ| (YA ⊗ 1BE) |Ψ ≥ cos φ -φ 2 , since Ψ| (YA ⊗ 1BE) |Ψ ∈ R. (169)
Putting these together, we conclude that (for |φ - (176)

B.3 Gradient of the goal function

We will now combine all the elements to upper bound the gradient of the goal function G(L, φ; Ω, q) = H(ρE)-H(E|â0(q))+tβmax(L, φ). (177)

We parametrize the vector L with the help of the angles as in Eq. (44), such that the "model" is described by four angles (L, φ) ω = (α, µ, ξ, φ).

(178)

We will bound the gradient of the goal function with respect to this parametrization.

We start with the gradient of the angle. for dω i = dα, dµ or dξ, one easily finds

|∇A(ω)| ≤ 3 2 . ( 181
)
We thus get from Eq. ( 171)

|d(H(ρ E ) -H(E|â 0 (q)))|

≤

B.4 Lipschitz function certified maximization on a compact space

General approach -In this section section we explain how we obtain a certified maximum of a Lipschitz function f : R n → R with a Lipschitz constant Λ, i.e. a bounded gradient |∇f | ≤ Λ, on a closed domain

D = {x =    x 1 . . . x n    ∈ R n | x i ∈ [τ i , µ i ], ∀ i}. ( 187
)
We start by meshing D into an hypercube grid graph G(s) with element of size s. If possible, we take s so that s evenly divides µ i -τ i for all i. We label the center of each hypercube c so that each first neighbor in a given direction is separated by s, e. Numerical realisation -While Eq. ( 192) gives the optimal maximum on f , it is however impracticable using numerical resources, due to the obvious need of discretization. A first naive approach is to relax the problem by setting a lower bound on s. This is, with the lower bound s ≥ ε, Resource wise, this method is cumbersome. Indeed, setting ε to a small value compared to the domain space, i.e. ε min i (τ i -µ i ), will result in a high number of hypercubes to explore. Furthermore, for a given step s, the number of hypercubes scales exponentially with the dimension n. Speed-up using a guess on the maximum -Providing a guess on the maximum of f may significantly speed up the previous method. Such a maximum can be found using an optimization algorithm without guarantees of optimality (BFGS, CMA, and others...). Denote such a maximum as ν. We start by setting a not-too-small step, s 0 , so that the number of hypercubes composing the grid graph, G 0 (s 0 ), is reasonnable. For each hypercube h 0 ( c) we start by computing the potential maximum,

ξ 0 ( c) = f ( c) + √ nΛ 2 s 0 . ( 194
)
We then compare this value to ν. In the case where ν > ξ 0 ( c), we pass to the next hypercube since the guessed maximum is higher than the potential maximum value of f in h 0 ( c). Otherwise, we mesh h 0 ( c) into a new hypercube grid graph G 1 (s 1 ) of element of size s 1 = s 0 /2. For all of the new generated hypercubes, h 1 ( c) ∈ G 1 (s 1 ), we compute the potential maximum ξ 1 ( c) using Eq. ( 195). This method is applied recursively until either all new hypercubes of graph G k m satisfy ν > h m ( c), or we reach the minimum step s m ≤ ε. An upper bound of f is thus given by the maximum ξ m ( c)

max(ξ m ( c)) = f ( c) + √ nΛ 2 s m ( 195
)
where s m = s 0 /2 m .

Figure 1 :

 1 Figure 1: Difference between the bound on Eve's conditional entropy H( A 0 |E) computed as a function of X and Y, and as a function of the CHSH quantity S = 2 √ 2(X + Y), for p = 0. In presence of noisification (i.e. p > 0), the advantage follows a similar distribution, but is smaller in magnitude. The CHSH bound is only optimal along the curve X(X + Y) = 4. The advantage on the right-hand side of this curve is obtained with Ω < π/4, and on the left-hand side with Ω > π/4. The yellow (red) curve shows the trajectory in the X-Y plane which optimizes the key rate in an optical implementation of DIQKD for low (high) detection efficiencies. At the efficiency η = 0.923, it is better to switch from one curve to the other one (at the transition between full and dashed curves).

  ) defined on [0, 1]. By computing the second derivative c (r) = 2 1 + log e (r) r log e (2) 2

  , we get H( Â0 |E) ρ -H( Â0 |E) ρ ≤ 10.023 arccos( √ L • √ L ) + 3 |φ -φ | (171)The Bell score -Next we wish to bound the increment |dβ max (L, a 0 , Ω)| for infinitesimal changes of the parameters (dL, dφ). It is actually straightforward to bound the gradient of the Bell score before the maximization with respect to a 0 , b 0 , b 1 , so we just need to be careful to apply this bound on β max . First, note that B Ω (L, φ, a 1 , b 0 , b 1 ) is a positive smooth infinitely differential function of all its parameters. For a fixed Ω, let us group these parameters in two vectors x = (a 1 , b 0 , b 1 ) and y = (T z , T x , a 0 ). We then formally definef (x, y) = B Ω (L, φ, a 1 , b 0 , b 1 ) g(y) = max x f (x, y) = β max (L, a 0 , Ω). (172)We are interested in bounding |dg(y)| as a function of dy. Consider two values of the parameter, y 1 and y 2 , and definex1 = argmax x f (x, y 1 ) x2 = argmax x f (x, y 2 ),(173)such that g(y 1 ) = f (x 1 , y 1 ) and g(y 2 ) = f (x 2 , y 2 ). Without loss of generality we assume g(y 1 ) ≥ g(y 2 ) and consider the difference|g(y 1 ) -g(y 2 )| = |f (x 1 , y 1 ) -f (x 2 , y 2 )| ≤ |f (x 1 , y 1 ) -f (x 1 , y 2 )| ≤ max x |f (x, y 1 ) -f (x, y 2 )|(174)Taking the limit y 2 → y 1 we get |dg(y)| ≤ max x |∇ y f (x, y) • dy|. (175) Using the expression (66) for B Ω (L, φ, a 1 , b 0 , b 1 ) we then get |dβ max (L, φ)| ≤

  It satisfiesdA = |A(L(ω), L(ω + ndω))| |∇A(ω)| dω|, (179)with a unit vector n = (n α , n µ , n ξ , 0). For the fidelity one findsF (L(ω), L(ω + ndω)) = L(ω) • L(ω + dω i )

2 ≤ x i ≤ c i + s 2 ,

 22 g. for c and its neighbor c in the direction + e 1 center c, h( c), element of G, is thus defined ash( c) = {x ∈ R n |c i -s ∀i ∈ {1, . . . , n}}. (189)Given the Lipschitz constant Λ, the function f in a given hypercube h( c) is upper bounded byf (x) ≤ f ( c) + √ nΛ 2 s, ∀x ∈ h( c). (190)Trivially, an upper bound on the maximum of f over D is given by, f over D can thus be obtained by taking the smallest possible step, i.e.

  If the constraints appearing in the minimization problem do not depend on the marginal probabilities p(A

x |x) and p(B y |y) of Alice and Bob respectively, the symmetrization step previously presented reduces the model of the state to a Bell-diagonal structure

  For the gradient of the Bell score contribution|∇β max (L, φ)| we note that |dT z |, |dT x | ≤ 2 |dα| + |dµ| + |dξ| ,

	10.023	2 3	dα 2 + dµ 2 + dξ 2 + 3dφ	(182)
	and
	|∇(H(ρ E ) -H(E|â 0 (q))|
		2 ≤ 10.023 2 3	+ 9 < 12.7	(183)
					(184)
	which implies form (176) that
	|∇β max (L, φ)| ≤ t 3 × 4 2 + C 2 Ω ≤ 7t	(185)
	Finally, for the goal function
		|∇G| ≤ 12.7 + 7 t .	(186)

Acknowledgments

We thank Stefano Pironio for pointing out that the convexity argument provided in [13] was not complete, see the discussion in Sec. 3.1 and App. A.5. We acknowledge funding by the Swiss National Science Foundation (SNSF), through the Grants PP00P2-179109 as well as via the National Center for Competence in Research for Quantum Science and Technology (QSIT).


Sarra Bekri

Florie Desriac

Magalie Barreau

Thomas Clamens

Thibault Gallavardin

Patricia Le Nahenec-Martel

Julien Vieillard

Yazid Datoussaid

Noureddine Choukchou-Braham

Olivier Lesouhaitier

Xavier Franck

Stéphane Leleu
email: stephane.leleu@univ-rouen.fr.

Journal Pre-proofs New Antibacterial Cadiolide Analogues active Against Antibiotic Bacterial Resistant Strains

Keywords:

The synthesis of new cadiolide analogues was carried out using a one-pot multi component synthesis. The antibacterial activity of these molecules was evaluated on standard and antibiotic resistant bacterial strains chosen for their involvement in human health or in food-born poisoning. Four molecules have shown good activities with MICs of 2 g/mL -1 . The introduction of an indole group or the conversion of the lactone into lactam have highlighted two new families of molecules with promising antibacterial activity. In addition, most of these active molecules are devoid of cytotoxic activity against keratinocyte cells.

The use of antibiotics in therapeutic treatments significantly increased life expectancy. However, their intensive and repeated use, or even misuse, for both human and animal treatment in the hospital or agricultural environments has contributed to the development of resistant strains. The fight against this phenomenon is becoming a major public health issue. For this reason, numerous research groups and pharmaceutical industries have focused their work on the design and the discovery of new antibacterial compounds.

The most critical antibiotic-resistant strains requiring urgent new drug discovery have been recently reassessed by The World Health Organization (WHO). 1 Among these strains Acinetobacter baumannii (carbapenem-resistant), Pseudomonas aeruginosa, (carbapenem-resistant), Enterobacteriaceae (carbapenemresistant), Enterococcus faecium, (vancomycin-resistant), Staphylococcus aureus (methicillin-resistant (SARM) and vancomycin-intermediate and resistant) represent the strains frequently encountered in hospital whose are responsible of hospital-acquired infection.

In this global context of the race to discover new antibacterial compounds, numerous ways have been investigated, such as antimicrobial peptides produced by mammals or insect 2 or chemically modified antimicrobial peptides 3 or natural product from the marine world. 4 Since the late 1990s, new natural marine brominated butenolides were isolated from ascidian or tunicates, representing the cadiolide family (Figure 1). 5 The cadiolides (A-F), rearranged cadiolide I and hydroxylated cadiolide derivatives (G-H, J-M) have shown potential antibacterial activities on a large range of bacterial strains. 6

Figure 1: natural cadiolides A-M

Since their discovery, few research groups have tackled their synthesis as well the synthesis of analogues. In 2005, Pouliot and Boukouvalas 7 were the first to publish the synthesis of cadiolide B followed by us 8 in 2013 with a one-step multicomponent strategy. In 2015, Boukouvalas reported an elegant stepeconomical strategy by Diels-Alder cycloaddition-cycloreversion towards these molecules. 9 While using a multicomponent synthetic strategy, we have been able to obtain a large number of cadiolide analogues to study their structure-activity relationship, 10 in particular by obtaining more or less brominated molecules or/and by introducing new functional groups like furoyl instead of benzoyl. Thus, some cadiolide analogues showed greater antibacterial activity than natural products with non-resistant gram positive or negative strains like Bacillus cereus, Staphylococcus aureus, Enterococcus faecalis, Bacillus subtilis, Salmonella typhi, Escherichia coli and Erwinia carotovora. In some cases, the obtained activities were similar or better than broad-spectrum antibiotics such as tetracycline. This structure-activity relationship study also revealed that the phenolic hydroxyl group plays an important role and that the overall optimal bromine atom number is 3 to 4. Importantly, we showed that the substitution of a benzoyl group by a furoyl group allowed improving their biological activities. More recently, Boukouvalas et al. 11 synthesized and evaluated other cadiolide analogues that showed activities in inhibiting bacterial biofilm formation. Thus, in view of these promising results, we have decided to extend this structure-activity relationship study with resistant or not bacterial strains by varying the position of the furyl group around the furanonic skeleton, and by increasing the structural diversity with the introduction of new heterocyclic moieties such as thiophene and indole in replacement of the furyl group that we introduced earlier. 10 Indeed, during a study of structure-activity relationship with heterocyclic chalcone analogues, Tran et al. have shown that the substitution of a furyl group by a thiophenyl or pyriridinyl group could bring, in some cases, an improvement of the antibacterial activity. 12 But, rather than pyridine we have preferred to introduce an indole group which is more easily functionalizable and can play an important role in antibacterial activity. 13 Finally, we wanted to check if the central furanonic skeleton has a great importance on antibacterial activities and made the choice to convert the lactone ring into a lactam.

Scheme 1: Synthetic route to cadiolide derivatives

From suitable dioxinones, ketoalcohols and aldehydes (prepared according to reported procedure, Figure 2), 8,10 more than ten cadiolide analogues were synthesized using our one-step multicomponent reaction (Scheme 1) including the family of furan 5a-c (yields ranging from 18 to 28 %), thiophene 6a-d (yields ranging from 25 to 96 %), indole 7a-b (yields ranging from 6 to 9 %), lactam 8 (total yield 27 %, Z/E mixture: 55/45), 14 and bis-furan 9a-b (yields ranging from 16 to 88 %), cadiolide analogues (yield 16 %) (Table 1).

Figure 2 : list of dioxinones, ketoalcohols and aldehydes used

In order to have a point of comparison with our previously obtained results, 9 we included in the evaluation of the antibacterial activities the caliolide derivative 4 which had shown the best activities, and also synthetized for the first time the natural cadiolide D. In the present study, we have evaluated both the anti-bacterial activity of natural product cadiolide D and 13 new cadiolide analogues using both standard and antibiotic resistant-bacterial strains and, for the most active compounds, their cytotoxicity against keratinocyte cells.

Biological activity results

All 13 cadiolide analogues and cadiolide D were screened in vitro for their potential antibacterial activity against 4 Gram negative bacteria and 7 Gram positive bacteria. These bacteria have been chosen for their implications either in human health or in food-born poisoning (see material and methods). No cadiolides have exhibited activity against Gram negative bacteria until 256 µg.mL -1 (Data not shown). In contrast, in the case of Gram positive bacteria, antibacterial activity has been observed against almost all target bacteria with MICs values between 2 and 256 µg.mL -1 . The best activity is obtained with the indole derivatives 7a,b with MICs of 2 µg.mL -1 , below the reference compound 4 for most of the strains. When a phenol group is substituted by a furan group 5a-c, the activity is greatly reduced with respect to the strains tested, more strongly for bis-furan analogues 9a,b. On the other hand, when a phenol group is substituted by a thiophene 6a-d, the activity becomes similar or even better than the reference compound 4 except for 6c. Concerning the position of substituted group-activity relationship, when the furan group is in the methylidene position such as in 5c, the activity observed is slightly reduced compared to furan derivatives 5a,b. This effect is more strongly accentuated when it is a thiophene group which is in this same position such as in 6c compared to the other positions of thiophen group 6a,b. As underlined in our previous report, 8 we can see an effect of the number of bromine atom on the activity by comparing the compounds 6c and 6d. Overall, we can pay particular attention to the influence of the phenol group substitution combined with the influence of a comparable number of bromine (i.e. 4, 5c and 7a). Thus, we note that the substitution of the methylidene position by an indole group 7a compensates for the negative effect of the decrease in the number of bromine atoms on the activity. Interestingly, for the lactam derivative 8 a good activity is observed, comparable to the reference compound 4 thus opening the way towards the development of a new family of nitrogenated cadiolide derivative with a serious advantage of significant substitution variability on the nitrogen atom. Furthermore, it is interesting to note that the indole derivatives 7a,b are more potent against the two clinical resistant isolates tested (EMRSA-17 and VRE) than the compound 4 suggesting the absence of crossed resistance with cadiolide derivatives. Nmethylated indole 7b has similar activity than free indole 7a, suggesting that further functionalization of cadiolide analogues via the indole position is possible without loss of activity.

The result of the antibacterial activity, described above has allowed us to select four compounds (i.e. 4, 7a,b and 8) at a concentration of 160 µl.ml -1 to evaluate their impact on cultured keratinocytes cells in order to identify any cytotoxic effect of these selected compounds. Since these compounds have been dissolved in DMSO, a same concentration (0.64 %) of DMSO needed for a good solubility has been used as a control (Cells + DMSO; Figure 3). We first observed that keratinocytes cells are sensitive to DMSO alone. Our result show that the three compounds 4, 7a and 7b are devoid of cytotoxic activity against keratinocyte cells. In contrast, the compound 8, used in the same condition, provoked an increase in term of cytotoxicity towards keratinocyte cells (55.7 ± 2.7 % of LDH release versus 23.7 ± 1.4 % of LDH release in control cells with DMSO). However, it is important to keep in mind, that cultured cells such as keratinocyte used in this study, are particularly sensitive, suggesting that it would be efficient, in the future, to test the toxicity of 8 against complex organisms such as the worm Caenorhabditis elegans or mice. In any case, our cytotoxic approach clearly demonstrated that 4, 7a and 7b have no toxic activity towards keratinocyte cells. All together, our combined biological data (antibacterial activity and cytotoxicity) strongly suggest that the compounds 4, 7a and 7b could have a major interest to reduce bacterial infection, while maintaining host cells integrity. In will be interesting in the future to modify slightly these compounds to obtain even more active molecules in particular by introducing a water-solubilizing function on the nitrogen atom of the indole group despite a higher cytotoxicity, the antibacterial activity of compound 8 is very encouraging and opens a way towards a new family of antibacterial molecules inspired by the cadiolide skeleton.

Figure 3 :

 3 Figure 3 : Cytotoxicity evaluation. Effect of 4, 7a,b and 8 cardiolides derivatives on LDH release by keratinocytes HaCaT cells after 24h of contact. Data are the mean of seven measurement from two independent experiment. Dotted line corresponded to the control condition (cells exposed to DMSO). Black bar represented the maximum of cells death (100 % of LDH release), NS : Not significantly different.

Table 1 .

 1 Structures of synthetized cadiolide analogues and antibacterial activities of synthetized cadiolide analogues and cadiolide D. MIC results of three independent experiments (µg.mL -1 ). Bold numbers show the values obtained for the four most active compounds.

	Analog	B. cereus	B. subtilis	M.luteus	E. faecalis NCTC 12697	S. aureus NCTC12493	S. aureus EMRSA-17	VRE
	cadiolide D	32	64	64	64	32	64	64
	D b 4	8	16	8	16	8	8	32
	5a	16	32	32	128	32	64	64
	5b	16	16	16	32	32	64	64
	5c	32	32	32	128	32	64	128
	6a	4	8	8	32	8	16	32
	6b	8	8	8	16	16	16	8
	6c	64	32	128	64	32	256	32
	6d	8	4	32	32	8	32	32
	7a	2	4	2	16	2	8	8
	7b	4	8	8	8	2	4	8
	8	4	8	16	16	8	16	16
	9a	128	256	256	256	64	128	256
	9b	16	32	32	64	16	64	64
	Gentamycin	0.25	0.25	0.25	8	0.5	>64	8
	Vancomycin	1	0.5	≤0.13	4	1	2	>64

Acknowledgments

This work was funded by a national scholarship for study abroad PNE given by the Algerian ministry of higher education and scientific research to Sarra Bekri. This work was supported by Normandie Université, INSA Rouen, Université Rouen Normandie, CNRS and Labex SynOrg (ANR-11-LABX-0029). We are grateful to Albert Marcual (CNRS) for HRMS analyses. We wish to warmly thanks Professor Mathew Upton from the University of Plymouth for supporting MIC experiments.

Supplementary Material

Supplementary material of this article can be found online.

Click here to remove instruction text...