ETH Zurich Creates Perfect and Certified Random Numbers with Two Qubits
Transforming an imperfect source of randomness into perfect random numbers is a task that classical physics deems impossible. A group from ETH Zurich, led by Renato Renner and Andreas Wallraff in the Department of Physics, has achieved this in the laboratory for the first time, utilizing two superconducting qubits in an entangled state and an improved version of the Bell test.
"It is almost impossible to create a perfect coin or die," observes Renner: no matter how symmetrical and smooth a die is, after many rolls, it will show one face slightly more frequently than others. The same applies to random number generators, including those exploiting quantum effects such as reflecting photons on a partially reflecting mirror: they maintain a slight systematic imbalance, a bias, which for most uses does not have significant consequences, but in the field of cryptography, even a minimal deviation opens a breach that an attacker can exploit.
How to Amplify Randomness
The apparatus consists of two superconducting chips cooled to a few thousandths of a degree above absolute zero, around 15 millikelvin, connected by a 30-meter-long tube, which is also cooled. Microwaves travel through the tube, putting the two qubits in entanglement: measuring one qubit, which randomly gives "0" or "1," determines the outcome on the other at a distance. The separation of 30 meters is key because even at the speed of light, information could not pass from one qubit to the other during measurement, thus closing the so-called locality loophole, one of the subtleties that could allow explaining correlations without invoking quantum mechanics.
This is the point that makes the entire operation possible, but first, it is necessary to understand what the Bell test measures. In the 1960s, physicist John Stewart Bell formulated an inequality, a numerical ceiling: if the outcomes of measurements on two particles were predetermined by some hidden property they carry, the statistical correlations between those outcomes could not exceed a precise value. Quantum mechanics, on the other hand, predicts that two entangled systems can correlate more strongly than that ceiling allows. Observing correlations in the lab that are consistently above the threshold, i.e., violating Bell's inequality, thus equates to demonstrating that no pre-existing information determined the results.
The result is precisely what is needed. The zeros and ones that come out of the measurement are not only hard to predict: they are genuinely unpredictable, because they are created at the moment of measurement itself and cannot be read in advance by anyone, not even by the person who built the apparatus. This is the guarantee that classical randomness cannot offer, as a number produced by a deterministic process remains, in principle, predictable by anyone knowing the rules.
However, there is a detail of the test that seems to short-circuit everything. To determine if the correlations exceed Bell's threshold, the two qubits are not always measured in the same way: with each repetition, a choice is made among some alternative measurements, the measurement bases, and it is precisely from the comparison of these combinations that the violation emerges. But the choice among those alternative measurements, to be valid, must be unpredictable; otherwise, the apparatus could "know" in advance how it will be interrogated and adjust accordingly, simulating the correlations. Thus, it falls to a random generator to decide each time the basis, and this is where the circle closes: that generator is precisely the imperfect source from which we started.
The knot unraveled because the guarantee of the test does not demand perfectly random choices: it only requires that the entry choices maintain a minimum of genuine unpredictability, a part that no one, not even a potential "opponent," could have fixed in advance. Even a biased generator maintains this, and the recent theoretical result on which the experiment rests demonstrates that this residue is sufficient to ensure certification.
There remains one last step, and to understand it, a clarification is needed. That the outcomes are genuinely unpredictable does not mean they are already uniform: the violation of Bell proves that there is authentic unpredictability in the raw sequence, but those bits remain marked by the imbalance of the starting source. Some configurations are thus slightly more likely than others, and part of the sequence may be somewhat predictable to anyone who knows the characteristics of the generator. The sequence, in short, is random in substance and yet irregular in form. Here, the extent of the observed violation serves a second purpose: besides certifying that unpredictability exists, it sets a definite lower limit, that is, it specifies how much is guaranteed regardless of how the individual bits appear distributed. Strong of that measure, a final algorithm, colloquially known as a randomness extractor, reworks the still biased sequence and distills a shorter one where each bit combination is equiprobable, perfectly uniform, and indistinguishable from ideal randomness.
This is where the method's name may be misleading. Randomness amplification does not multiply the random bits; rather, it returns significantly fewer than what it consumes: what it amplifies is their quality, bringing a slightly unpredictable source to a perfect degree of unpredictability.
The experiment belongs to the same line of the Bell test without loopholes carried out in 2023 by the same laboratory with superconducting circuits, now achieving a combination of high violation and high data acquisition rate, the two conditions that the protocol required simultaneously and which had never been obtained together before. Physical certification of randomness is, after all, a frontier already crossed: in 2025, a group from the University of Colorado Boulder and NIST presented the first certifiable random number generator, which we discussed at the time, capable of guaranteeing and verifying the unpredictability of the produced bits. The amplification adds to that framework the missing link: producing perfect randomness from a flawed starting source. The result, perfect and certified random numbers, is described in Nature.
Why It’s a Quantum Advantage
The protocol is device-independent: the certification assumes nothing about the internal working of the hardware and holds even if the device is defective or built by an opponent. Only the statistics of the measurements and the degree of violation of Bell's inequality matter. This is the point that separates the work from classical physics, as it has been demonstrated impossible to amplify the randomness of a weak source with purely classical means since 1986; therefore, the authors present the experiment as a definitive quantum advantage, a task unattainable for classical information processing.
The numbers from the test provide a measure of the undertaking and its current limits. According to the available documentation, the experiment lasted about nine hours, with 1.34 billion Bell tests conducted 50,000 times per second; against about five billion imperfect input bits, 45 million perfect and certified ones were extracted, tolerating an input imbalance of up to 0.75%. Those seeking technical details can find the full version, open access, in the preprint submitted by the authors themselves.
To make the difference tangible, the group encrypted the same image of a sheep with ordinary randomness and with the certified one: in the first case, the subject remains partially recognizable; in the second, it dissolves entirely into noise. In the group's intentions, a physically certified source could play a role for randomness similar to that of atomic clocks for measuring time. Possible applications range from the encryption of communications and digital identities to public randomness services for lotteries and blockchain, up to secure quantum communications: the robustness of an encryption depends on the quality of the randomness on which it relies, a theme we have already dealt with.