Optimal verification of the Bell state and Greenberger–Horne–Zeilinger states in untrusted quantum networks

Bipartite and multipartite entangled states are basic ingredients for constructing quantum networks and their accurate verification is crucial to the functioning of the networks, especially for untrusted networks. Here we propose a simple approach for verifying the Bell state in an untrusted network in which one party is not honest. Only local projective measurements are required for the honest party. It turns out each verification protocol is tied to a probability distribution on the Bloch sphere and its performance has an intuitive geometric meaning. This geometric picture enables us to construct the optimal and simplest verification protocols, which are also very useful to detecting entanglement in the untrusted network. Moreover, we show that our verification protocols can achieve almost the same sample efficiencies as protocols tailored to standard quantum state verification. Furthermore, we establish an intimate connection between the verification of Greenberger–Horne–Zeilinger states and the verification of the Bell state. By virtue of this connection we construct the optimal protocol for verifying Greenberger–Horne–Zeilinger states and for detecting genuine multipartite entanglement.

Unfortunately, not much is known about quantum verification in untrusted networks despite its significance.* zhuhuangjun@fudan.edu.cnThis is because not all parties in the networks are honest, and the verification problem gets much more complicated in the presence of dishonest parties.In particular, traditional tomographic approaches are not applicable in the network setting even if their low efficiency is tolerable.Also, most alternative approaches, including direct fidelity estimation [39] and quantum state verification (QSV) [40][41][42][43][44][45], are not applicable, although QSV can address the adversarial scenario in which the source is not trustworthy [43][44][45].DI QSV [46] based on selftesting [22,[47][48][49][50][51][52] can be applied in the network setting in principle, but is too resource consuming and too demanding with current technologies.For the Bell state and GHZ states, optimal verification protocols are known when all parties are honest [42,[53][54][55][56][57][58].In the network setting, however, only suboptimal protocols are known in the literature [23][24][25][26]29].
In this paper, we propose a simple approach for verifying the Bell state over an untrusted network in the semidevice-independent (SDI) scenario in which one party is not honest.Only local projective measurements are required for the honest party.In addition, we establish a simple connection between verification protocols of the Bell state and probability distributions on the Bloch sphere and reveal an intuitive geometric interpretation of the performance of each verification protocol.By virtue of this geometric picture, we construct the optimal and simplest protocols for verifying the Bell state, which can also be applied to detecting entanglement in the untrusted network.Moreover, we determine the sample efficiencies of our SDI verification protocols in addition to the guessing probabilities.
Furthermore, we establish an intimate connection between the verification of GHZ states and the verification of the Bell state.Thanks to this connection, efficient protocols for verifying GHZ states can easily be constructed from the counterparts for the Bell state.Notably, this connection enables us to construct the optimal protocol for verifying GHZ states and for detecting genuine multipartite entanglement (GME).To put our work in perspective, we also provide a detailed comparison between SDI QSV considered in this work and standard QSV as well as DI QSV based on self-testing.For the Bell state and GHZ states, SDI verification can achieve almost the same sample efficiency as standard QSV; by contrast, the sample efficiency in the DI scenario is in general quadratically worse in the infidelity unless there exists a suitable Bell inequality for which the quantum bound coincides with the algebraic bound.

Verification of the Bell state
Suppose two distant parties, Alice and Bob, want to create the Bell state |Φ = (|00 + |11 )/ √ 2 as follows: Bob first prepares |Φ in his lab and then sends one particle of the entangled pair to Alice using a quantum channel.To verify this state Alice can perform a random projective measurement from a set of accessible measurements and then ask Bob to guess the measurement outcome given the measurement chosen.Each projective measurement is specified by a unit vector r on the Bloch sphere, which specifies the two outcomes P ± = (I ± r • σ)/2, where σ is the vector composed of the three Pauli matrices.If Bob is honest and prepares the target state |Φ , then his reduced states corresponding to the two outcomes P + and P − have mutually orthogonal supports, so he can guess the measurement outcome with certainty by performing a suitable projective measurement.
If Bob is not honest and tries to prepare a different state ρ instead of |Φ , then his guessing probabilitythe probability of successful guess-would be limited.In this case, Alice cannot distinguish two states that can be turned into each other by local operations of Bob; nevertheless, she can verify whether the state prepared is indeed |Φ up to these local operations.Let ρ ± = tr A (ρP ± ) be the unnormalized reduced states of Bob.To guess the measurement outcome of Alice, Bob can perform a twooutcome POVM {E + , E − } to distinguish ρ + and ρ − .By the Helstrom theorem [59], the maximum guessing probability γ(ρ, r) over all POVMs (or projective measurements) reads γ(ρ, r) = (1 + ρ + − ρ − 1 )/2.
Recall that a general two-qubit state has the form where σ j , σ k are Pauli matrices (also denoted by X, Y, Z), a and b are the Bloch vectors of the two reduced states, and T is the correlation matrix.If ρ is pure, then we can deduce (cf.Supplementary Note 1), To understand the geometric meaning of γ(ρ, r), note that the set of vectors { √ T T T r : |r| = 1} forms a rotational ellipsoid, which is called the correlation ellipsoid and denoted by E ρ as illustrated in Fig. 1 (cf. the steering ellipsoid [60,61]).The semi-major axis v and semiminor axis of E ρ have length 1 and C, respectively, where C is the concurrence of ρ [1,62].In addition, the radius √ T T T r is determined by C and the angle between r and the semi-major axis as follows, A verification strategy of Alice is determined by a probability distribution µ on the Bloch sphere, which specifies the probability of performing each projective measurement.Given the strategy µ and the state ρ, the maximum average guessing probability of Bob reads where the bias is a weighted average of radii of the correlation ellipsoid.Denote by γ 2 (C, µ) the maximum guessing probability over all pure states with concurrence at most C. Note that maximizing γ(ρ, µ) for a given concurrence amounts to choosing a proper orientation of the correlation ellipsoid so as to maximize the weighted average of radii, as illustrated in Fig. 1.This intuition leads to the following theorem as proved in Supplementary Note 1.
where the maximization in Eq. ( 6) is over all unit vectors.
Any unit vector v that maximizes the integration in Eq. ( 6) is called an intelligent direction.For a given concurrence, the guessing probability is maximized when the major axis of the correlation ellipsoid parallels an intelligent direction.When C = 1, the correlation ellipsoid is a sphere, in which case Theorem 1 yields g(C, µ) = 1 and γ 2 (C, µ) = 1.When C = 0, the correlation ellipsoid reduces to a line segment, in which case we can deduce Notably, entanglement can be certified in the shared system when the guessing probability surpasses the threshold γ * 2 (µ).The relation between the guessing probability and concurrence for various verification protocols are illustrated in Fig. 2.
Alternative strategies of the adversary So far we have assumed that the state ρ prepared by Bob is a two-qubit pure state and ρ A := tr B (ρ) is supported in the local support of the target Bell state, that is, the subspace spanned by |0 and |1 .Can Bob gain any advantage if ρ A is not supported in this subspace?The answer turns out to be negative.Now Alice can first perform the projective measurement {P A , I − P A } with P A = |0 0| + |1 1| and then apply a verification protocol as before if she obtains the first outcome and reject otherwise.The maximum guessing probability γ(C, µ) of Bob for any pure state with C(ρ) ≤ C is the same as before as shown in the following lemma and proved in Supplementary Note 3.
When the distribution µ is clear from the context, γ * 2 (µ) and γ * (µ) are abbreviated as γ * 2 and γ * for simplicity.Above results can be extended to mixed states, although our main interest are pure states.Let γ(C, µ) be the maximum guessing probability of Bob over all states with concurrence at most C. Define γ2 (C, µ) in a similar way, but assuming that ρ A is supported in the support of P A .By the following theorem proved in Supplementary Note 4, γ(C, µ) and γ2 (C, µ) are weighted averages of γ * (µ) and γ(1, µ) = 1.
Fidelity as the figure of merit Next, we consider the fidelity as the figure of merit, which is more natural for QSV.Here we assume that Bob controls the whole system except that of Alice, so we can assume that the state ρ prepared by Bob is pure.Define the reduced fidelity where the maximization is taken over all local unitary transformations on H B .Denote by γ F (F, µ) the maximum guessing probability over all pure states with F B (ρ) ≤ F .Define γ F 2 (F, µ) in a similar way, but assuming that ρ A is supported in the support of The following theorem proved in Supplementary Note 5 clarifies the relations between γ F (F, µ), γ F 2 (F, µ), and γ 2 (C, µ).The guessing probabilities γ F (F, µ) for various verification protocols are illustrated in Fig. 3.
Equation ( 14) offers the best linear upper bound for γ F (F, µ) when 1/2 ≤ F ≤ 1 and demonstrates the robustness of the verification protocol.Theorems 1 to 3 corroborate the significance of the threshold γ * in verifying the Bell state and entanglement in the SDI scenario.Moreover, the threshold γ * determines the sample efficiency, as we shall see shortly.Therefore, γ * can be regarded as the most important figure of merit for characterizing the performance of a verification protocol.

Simplest and optimal verification protocols
Here we propose several concrete verification protocols, including the simplest and optimal protocols.The main results are summarized in Table I and illustrated in Fig. 2; more technical details can be found in Supplementary Note 9.
In the simplest verification protocol, Alice can perform two projective measurements r 1 and r 2 with probabilities p 1 and p 2 , respectively.Here the maximum guessing probability γ(C, µ) only depends on the angle between r 1 and r 2 in addition to the probabilities p 1 and p 2 .Moreover, γ(C, µ) is minimized when r 1 • r 2 = 0 and p 1 = p 2 = 1/2, in which case we have and the guessing probability threshold is γ * = (2+ √ 2)/4.When r 1 = (1, 0, 0) T and r 2 = (0, 1, 0) T for example, we get the XY protocol.Previously, Ref. [23] proposed an equivalent protocol, but neither derived the exact formula for the guessing probability nor proved the optimality of the XY protocol among all two-setting protocols.
To determine the optimal protocol, we need to minimize g(C, µ) over µ.By Theorem 1 (cf.Lemma S1 in Supplementary Note 2), g(C, µ) is convex in µ, so g(C, µ) is minimized when µ is the uniform distribution on the Bloch sphere, which yields the isotropic protocol with and the guessing probability threshold is γ * = 3/4.Protocols based on the Pauli Z measurement and measurements on the xy-plane are of special interest to the verification of GHZ states as we shall see shortly.Prominent examples include the XY Z protocol (cf.Fig. 1), equator protocol, equator+Z protocol, polygon protocol, and polygon+Z protocol (see Supplementary Note 9).

Sample efficiency
To construct a practical verification protocol, it is crucial to clarify the sample efficiency.Although this problem has been resolved in standard QSV [42][43][44], little is known about the sample efficiency in the DI and SDI scenarios [46].Here we clarify the sample efficiency of our verification protocols in the SDI scenario.Consider a quantum device that is supposed to produce the target state |Φ ∈ H, but actually produces the states ρ 1 , ρ 2 , . . ., ρ N in N runs.Our task is to verify whether these states are sufficiently close to the target state on average.Here the reduced fidelity is a natural choice for quantifying the closeness since Alice is ignorant to the local unitary transformations acting on Bob's system.To guarantee that the average reduced fidelity of the states ρ 1 , ρ 2 , . . ., ρ N is larger than 1 − with significance level δ (confidence level 1 − δ), the number of tests required is determined in Supplementary Note 6, with the result Note that the sample efficiency is determined by the threshold γ * = γ * 2 defined in Eq. ( 8).The minimum threshold γ * = 3/4 is attained for the isotropic protocol, in which case N ≈ (2 ln δ −1 )/ , which is comparable to the number (3 ln δ −1 )/(2 ) required in standard QSV [42,53].So the Bell state can be verified in the SDI scenario almost as efficiently as in the standard QSV.Our protocol can achieve the optimal sample complexity because it is tied to a steering inequality whose quantum bound coincides with the algebraic bound.In contrast, the sample complexity in the DI scenario is quadratically worse in the scaling with 1/ , that is, N ∝ (ln δ −1 )/ 2 [46] (cf.Supplementary Note 7).Here γ(C) (γ(C)) is the maximum guessing probability for pure (mixed) states with concurrence at most C, and v(C = 0) is an intelligent direction for C = 0. Entanglement can be certified when the guessing probability surpasses the threshold γ * = γ(0) = γ(0).The XY protocol and isotropic protocol are the simplest and optimal verification protocols, respectively.All protocols listed, except for the isotropic protocol, can be generalized to GHZ states.

Protocol
Threshold any direction Equator any vertex direction In standard QSV, the Bell state and GHZ states can be verified with the same sample complexity [42,57].In the SDI scenario, the isotropic protocol is chosen for verifying the Bell state and the optimized equator+Z protocol is chosen for verifying the GHZ states.In the DI scenario, the Mermin inequality is employed for verifying the three-qubit GHZ state [46,50].Here the significance level is chosen to be δ = 0.01.

Verification of the GHZ state
Next, consider the GHZ state |G n = (|0 ⊗n + |1 ⊗n )/ √ 2 of n-qubits with n ≥ 3. To verify this state, the n parties can randomly perform certain tests based on local projective measurements.In each test, the verifier (one of the parties) asks each party to perform a local projective measurement as specified by a unit vector on the Bloch sphere and return the measurement outcome.If all parties are honest, then only the target state |G n can pass all tests with certainty, so the GHZ state can be verified.In the presence of dishonest parties, let D be the set of dishonest parties, who know which parties are honest or dishonest and who may collude with each other; let H be the set of honest parties (including the verifier), who do not know which other parties are honest or dishonest.The goal is to verify |G n up to local unitary transformations on the joint Hilbert space of D [23,24].Assuming |D|, |H | ≥ 1, then |G n may be regarded as a Bell state shared between H and D. So the verification of the GHZ state is closely tied to the verification of the Bell state.Actually, there is no essential difference when |H | = 1.
However, a key distinction arises when |H | ≥ 2 because each member of H can only perform local projective measurements on his/her party.So the potential tests that the verifier can realize are restricted.Careful analysis in Supplementary Note 10 shows that only two types of tests for verifying the GHZ state |G n can be constructed from local projective measurements.In the first type, all parties perform Z measurements, and the test is passed if they obtain the same outcome.In this way the verifier can effectively realize the Z measurement on V H , where V H is the two-dimensional subspace spanned by j∈H |0 j and j∈H |1 j .
In the second type of tests, party j performs the X(φ j ) measurement with j φ j = 0 mod 2π, where X(φ j ) = e −iφj |0 1| + e iφj |1 0| corresponds to the Bloch vector (cos φ j , sin φ j , 0) T , and each φ j is decided by the verifier.The test is passed if the number of outcomes −1 is even.Suppose φ 1 , φ 2 , . . ., φ n are chosen independently and uniformly at random from the interval [0, 2π).Then φ In this way, the verifier can effectively realize the X(φ) measurement on V H , where φ is completely random.
A similar result holds when φ j are chosen independently and uniformly at random from the discrete set {2kπ/M } M −1 k=0 with M ≥ 3 being a positive integer.By the above analysis, the verifier can effectively realize projective measurements along the z-axis or on the xy-plane when represented on the Bloch-sphere of V H , but not other projective measurements (assuming |H | ≥ 2).Each verification protocol of the GHZ state corresponds to a probability distribution µ on the Bloch sphere that is supported on the equator together with the north and south poles.Moreover, for all protocols in Table I except for the isotropic protocol (cf.Supplementary Notes 9 and 10), the guessing probabilities are the same as in the verification of the Bell state.To be specific, γ(C, µ) and γ F (F, µ) can be defined as before; Theorems 1, 3, and Lemma 1 still hold, except that now C refers to the bipartite concurrence between H and D. Although variants of the XY protocol and equator protocol were proposed previously [23,24], such exact formulas for the guessing probabilities are not known in the literature.To optimize the performance, µ should be uniform on the equator, which leads to the equator+Z protocol; the optimal probability p Z for performing the Z measurement depends on C or F as before.
A quantum state ρ is genuinely multipartite entangled (GME) if its fidelity with the GHZ state tr(ρ|G n G n |) is larger than 1/2 [64].The GME can be certified if the guessing probability surpasses the detection threshold γ F (1/2) = γ * .This threshold is minimized at the special equator+Z protocol with p Z = 4/(4 + π 2 ) ≈ 0.288, in which case we have This threshold is only 2.5% higher than the optimal threshold 3/4 for certifying the entanglement of the Bell state based on the isotropic protocol.The sample efficiency for verifying the GHZ state can be determined following a similar analysis applied to the Bell state.The formula in Eq. ( 18) still applies, except that the choice of verification protocols is restricted.Now the minimum of γ * is achieved at a special equator+Z protocol [cf.Eq. ( 20)].So the GHZ state can be verified in the SDI scenario with almost the same efficiency as in the standard QSV [57], as illustrated in Fig. 4. In the DI scenario, by contrast, it is in general impossible to achieve such a high efficiency unless one can construct a Bell inequality for which the quantum bound coincides with the algebraic bound [46].Notably, the three-qubit GHZ state can be verified with such a high efficiency by virtue of the Mermin inequality [46,50].
It should be pointed out that all our protocols for verifying GHZ states are applicable even in the presence of an arbitrary number of dishonest parties as long as the verifier is honest.Meanwhile, these protocols are useful for detecting GME.For some cryptographic tasks such as anonymous quantum communication, the security for all honest parties can be guaranteed at the same time with the assistance of a trusted common random source (CRS) [23].In this case, the number of honest parties can affect the security parameter.

III. DISCUSSION
We proposed a simple and practical approach for verifying the Bell state in an untrusted quantum network in which one party is not honest.We also established a simple connection between verification protocols of the Bell state and probability distributions on the Bloch sphere together with an intuitive geometric picture.Based on this connection, we derived simple formulas for the guessing probability as functions of the concurrence and reduced fidelity.Meanwhile, we clarified the sample efficiency of each verification protocol and showed that the sample efficiency is determined by the threshold in the guessing probability.Moreover, we constructed the optimal and simplest protocols for verifying the Bell state, which are also very useful to detecting entanglement in the untrusted network.
Furthermore, we reduce the verification problem of GHZ states to the counterpart of the Bell state, which enables us to construct the optimal protocol for verifying GHZ states and for detecting GME.Our work shows that both Bell state and GHZ states can be verified in the SDI scenario with the same sample complexity as in standard QSV.By contrast, the sample complexity in the DI scenario is in general quadratically worse.This work is instrumental to verifying entangled states in untrusted quantum networks, which is crucial to guaranteeing the proper functioning of quantum networks.In addition, this work is of intrinsic interest to the foundational studies on quantum steering.In the future, it would be desirable to generalize our results to generic bipartite pure states, stabilizer states, and other quantum states.

SUPPLEMENTARY MATERIAL
In this Supplementary Material we provide rigorous proofs for the Theorems and Lemmas presented in the main text together with some auxiliary results.First, we prove several key results on the guessing probability, including Eqs. ( 2), (3), and Theorem 1 in the main text.Then we prove Lemma 1 and Theorem 2 after summarizing the basic properties of the guessing probability.Next, we consider the fidelity as the figure of merit and prove Theorem 3. Next, we determine the sample efficiencies of our verification protocols and explain the significance of the guessing probability threshold.Next, we compare the sample efficiency of semi-device-independent (SDI) quantum state verification (QSV) with standard QSV and device-independent (DI) QSV based on self-testing.Next, we propose a number of concrete protocols for verifying the Bell state, including protocols based on polygons and platonic solids; the properties of these protocols are discussed in detail.Finally, we establish an intimate connection between the verification of GHZ states and the verification of the Bell state, which enables us to construct efficient and even optimal protocols for verifying GHZ states.In the course of study, we introduce the concept of compatible measurements, which is of interest beyond the main focus of this work.

SUPPLEMENTARY NOTE 1: GUESSING PROBABILITY
Here we prove several key results on the guessing probability, namely, Eqs. ( 2), (3), and Theorem 1 in the main text.
Proof of Eq. (2).Recall that any two-qubit state has the form After Alice performs the projective measurement r • σ, the unnormalized reduced states of Bob associated with the two outcomes read If ρ is pure, then ρ + −ρ − has at most one positive eigenvalue and one negative eigenvalue.So |a • r| ≤ T T r and which confirms Eq. ( 2).
Proof of Eq. (3).If ρ is a pure state with concurrence C, then its correlation matrix T has three singular values 1, C, C, and so does T T .Accordingly, T T T has three eigenvalues 1, C 2 , C 2 .The semi-major axis v of the correlation ellipsoid happens to be an eigenvector of T T T with eigenvalue 1.Therefore, which implies Eq. (3).
Proof of Theorem 1.Given any unit vector v on the Bloch sphere, there exists a two-qubit pure state ρ with concurrence C and correlation matrix T such that v is an eigenvector of T T T associated with the eigenvalue 1.In other words, the semi-major axis of the correlation ellipsoid of ρ can be chosen to coincide with v.So Theorem 1 follows from Eqs. ( 2) and (3) in the main text.
Theorem 1 implies that where both maximizations are taken over two-qubit pure states.This result corroborates the intuition that the maximum guessing probability is nondecreasing with the concurrence.

SUPPLEMENTARY NOTE 2: BASIC PROPERTIES OF THE GUESSING PROBABILITY
Here we summarize the basic properties of the guessing probability γ 2 (C, µ) and the function g(C, µ).
If µ 1 and µ 2 can be turned into each other by an orthogonal transformation, then g(C, µ 1 ) = g(C, µ 2 ), so Therefore, g(C, µ) for given C is minimized when µ is the uniform distribution on the Bloch sphere.
The verification matrix of the distribution µ is defined as which is a 3 × 3 positive-semidefinite matrix with trace 1, that is, tr[ Ξ(µ)] = 1.The operator norm (the largest eigenvalue) of Ξ(µ) is bounded from below by 1/3, that is, Ξ(µ) ≥ 1/3.The distribution µ and the corresponding protocol are balanced if Ξ(µ) is proportional to the identity matrix, in which case the lower bound Ξ(µ) ≥ 1/3 is saturated.
As we shall see shortly, the properties of g(C, µ) is closely tied to the verification matrix Ξ(µ).For example, an upper bound for g(C, µ) can be constructed from Ξ(µ), as shown in the following lemma.
The inequality is saturated if there exists a unit vector v in the eigenspace of Ξ(µ) associated with the largest eigenvalue and |r • v| is a constant in the support of µ except for a set of measure zero.Any such unit vector, if it exists, represents an intelligent direction.
Proof of Lemma S2.Let v be an arbitrary unit vector in dimension 3. The upper bound in Eq. (S12) follows from Eq. ( 6) in the main text and the following equation where Ξ is an abbreviation of Ξ(µ).Here the first inequality is due to the concavity of the square-root function and is saturated iff |r • v| is a constant in the support of µ except for a set of measure zero; the second inequality is saturated iff v is an eigenvector of Ξ with the largest eigenvalue Ξ .So the inequality in Eq. (S12) is saturated iff there exists a unit vector v that belongs to the eigenspace of Ξ associated with the largest eigenvalue and |r • v| is a constant in the support of µ except for a set of measure zero.In addition, any such unit vector, if it exists, represents an intelligent direction.
By contrast, a lower bound for g(C, µ) can be constructed by choosing v as an eigenvector of Ξ(µ) associated with the largest eigenvalue.Alternative lower bounds are presented in the following lemma.
The bound in Eq. (S14) is nearly tight when C → 1.To see this point, note that where we have kept the first-order approximation in 1−C.This equation implies that so the bound in Eq. (S14) is nearly tight when C → 1.
Proof.When C 2 = 1, we have g(C 2 ) = 1, so Eq.(S19) reduces to the equation and so follows from Eq. (S14).When 0 ≤ C 1 ≤ C 2 < 1, Eq. (S19) can be derived as follows Here the first inequality follows from the facts that g(C, µ) is nondecreasing and convex in C; the second inequality follows from Eq. (S20).
Proof.According to Lemma S4, we have which implies Eq. (S22).Here the last inequality follows from Lemma S3.Equation (S23) follows from Eq. (S22) and the equality γ 2 (C, µ) = [1+g(C, µ)]/2 in Eq. ( 5) in the main text.Lemma S6.Suppose the strategy µ satisfies dµ(r)r = 0. (S26) Then g * (µ) defined in Eq. (7) in the main text can be expressed as where the first maximization is over all measurable subsets of the Bloch sphere, and the second maximization is over all unit vectors on the Bloch sphere.In addition, v is an intelligent direction at C = 0 iff it satisfies the following two conditions, Proof.Let R be any measurable subset of the Bloch sphere and R its complement; then we have by the assumption Eq. (S26).Therefore, here the inequality is saturated if R is the region determined by the inequality r By plugging Eq. (S31) into Eq.( 7) in the main text we obtain which confirms the first equality in Eq. (S27).The second equality in Eq. (S27) follows from the equation below, In view of Eq. (S27), this condition holds iff the conditions in Eq. (S28) hold.

SUPPLEMENTARY NOTE 3: PROOF OF LEMMA 1
Here we prove Lemma 1 presented in the main text, which shows that Bob cannot increase the guessing probability by preparing a higher-dimensional state ρ whose local support for Alice is not contained in the local support of the target Bell state.
Let ρ A = tr B (ρ) and let be the projector onto the local support of the target Bell state.Before proving Lemma 1, it is instructive to give formal mathematical definitions of γ 2 (C, µ) and γ(C, µ): Here the constraint ρ 2 = ρ means ρ is a pure state, while the constraint P A ρ A = ρ A means ρ A is supported in the support of P A (the local support of the target Bell state).By definition we have To prove the equality γ(C, µ) = γ 2 (C, µ), it suffices to derive the opposite inequality.
Proof of Lemma 1.If Alice performs the projective measurement {P A , I − P A } on the state ρ, then the probability of obtaining the first outcome is q = tr[(P A ⊗ I B )ρ].When q > 0, after obtaining this outcome, the state ρ turns into Note that tr B (ρ ) is supported in the support of P A .In addition, the concurrence of ρ obeys the upper bound C(ρ ) ≤ min{C(ρ)/q, 1}.(S40) When q > 0 and C(ρ) ≤ q, the guessing probability of Bob satisfies Here the first inequality follows from the definition of γ 2 (C, µ); the second inequality follows from the inequality C(ρ ) ≤ C(ρ)/q and the monotonicity of γ 2 (C, µ) in C (cf. Lemma S1); the third inequality follows from Eq. (S23) in Lemma S5.When 0 < q ≤ C(ρ) ≤ 1, the guessing probability of Bob satisfies where the first inequality follows from the fact that γ 2 (C, µ) ≤ 1 and the last inequality follows from Eq. (S15) in Lemma S3.

SUPPLEMENTARY NOTE 4: PROOF OF THEOREM 2
Here we prove Theorem 2 presented in the main text, which determines the maximum guessing probability for mixed states.
Proof of Theorem 2. The third equality in Eq. ( 10) in the theorem follows from Eq. ( 8) in the main text and the equality γ * (µ) = γ * 2 (µ).The second equality in Eq. ( 10) is equivalent to the following equality given that γ * (µ) = γ * 2 (µ).Suppose ρ is the state prepared by Bob and ρ A = tr B (ρ) is supported in the support of P A defined in Eq. (S35).Let ρ = j q j ρ j be any convex decomposition of ρ into pure states such that C(ρ) = j q j C j , where C j = C(ρ j ) is the concurrence of ρ j .Note that tr B (ρ j ) is supported in the support of P A and C j ≤ 1 for each j.Then the guessing probability of Bob satisfies γ(ρ, µ) ≤ j q j γ(ρ j , µ) ≤ j q j γ 2 (C j , µ) Here the third inequality follows from the convexity of γ 2 (C, µ) in C (cf. Lemma S1); the last equality follows from the facts that γ 2 (1, µ) = 1 and γ * 2 (µ) = γ 2 (0, µ).As an implication of Eq. (S46), we have To prove the second equality in Eq. (10), it remains to prove the opposite inequality to Eq. (S47), that is, Let ρ 1 be a pure product state such that tr B (ρ 1 ) is supported in the support of P A and that γ(ρ 1 , µ) = γ * 2 (µ).
Let ρ 2 be a Bell state such that tr B (ρ 2 ) is supported in the support of P A and that the support of tr A ρ 2 is orthogonal to that of tr A ρ 1 .Then γ(ρ 2 , µ) = 1 and By setting p = C, we can deduce Eq. (S48), which implies Eq. (S45) and the second equality in Eq. ( 10).
Suppose ρ is the state prepared by Bob; here the support of ρ A = tr B (ρ) is not restricted in contrast to the above discussions.Let q = tr[(P A ⊗ I B )ρ] and then C(ρ ) ≤ min{C(ρ)/q, 1}.When q > 0 and C(ρ) ≤ q, the guessing probability of Bob satisfies Here the first inequality follows from the definition of γ2 (C, µ); the second inequality follows from the inequality C(ρ ) ≤ C(ρ)/q and the monotonicity of γ2 (C, µ) in C according to Eq. (S45); the third inequality also follows from Eq. (S45).When 0 < q ≤ C(ρ) ≤ 1, the guessing probability of Bob satisfies where the last inequality follows from Eq. (S45) again.
Equations (S52) and (S53) together imply that This equation holds even when q = 0, in which case we have γ(ρ, µ) = 0.As a corollary of Eq. (S54) we can deduce Here the last equality follows from the monotonicity of γ2 (C, µ) in C by Eq. (S45).Given the opposite inequality by definition, we conclude that γ(C, µ) = γ2 (C, µ), which completes the proof of Eq. ( 10) and Theorem 2.
To complement Fig. 2 in the main text, the relation between the guessing probability and concurrence in the mixed-state scenario is illustrated in Supplementary Figure 1.Here the XY protocol and isotropic protocol are introduced in the main text, while other protocols are proposed in Supplementary Note 9.

SUPPLEMENTARY NOTE 5: FIDELITY AS THE FIGURE OF MERIT
Here we discuss in more details the properties of the guessing probabilities γ F 2 (F, µ) and γ F (F, µ) and then prove Theorem 3 presented in the main text.
To start with we give formal mathematical definitions of γ F 2 (F, µ) and γ F (F, µ): where ρ A = tr B (ρ) and P A is the projector onto the local support of the target Bell state as defined in Eq. (S35).Note that F B (ρ) ≥ 1/2 for any two-qubit pure state ρ that satisfies

(S59)
Lemma S7 in particular implies that Proof.If ρ is a pure state that satisfies the condition P A ρ A = ρ A , then ρ is a two-qubit state and has the form in Eq. (S1).In addition, we have where T is the correlation matrix appearing in Eq. (S1) and T 1 = tr √ T T T .This equation implies Eq. (S58) in Lemma S7.Equation (S59) follows from Eq. (S58) above and Theorem 1 in the main text.
Lemma S8 follows from Lemmas S1 and S7.Lemma S9 follows from Lemmas S3 and S7 Proof of Lemma S10.When F = 1, Lemma S10 holds trivially since q can only take on the value 1.To prove Lemma S10 when 0 < F < 1, it suffices to prove the following inequality which implies that which confirms Eq. (S64) and implies Lemma S10.Here the second inequality follows from Eq. (S63).
Lemma S11.Suppose ρ is a bipartite state shared between Alice and Bob.Then Proof of Lemma S11.Let ρ A = tr B (ρ), q = tr(P A ρ A ), and If q = 0, then If 0 < q ≤ 1, then tr B (ρ ) is supported in the support of P A .In addition, we have where the inequality is due to the fact that F B (ρ ) ≥ 1/2 since ρ is a two-qubit pure state with the same local support for Alice as the target Bell state.
If F B (ρ) > 0, then q > 0, and Eq.(S72) implies that so Eq.(S69) still holds.Here the first inequality follows from the definition of the guessing probability γ F 2 (F, µ), and the last inequality follows from Lemma S10 together with the constraint
To prove Eq. ( 13) in Theorem 3, note that where the inequality follows from Lemma S11 and the monotonicity of γ F 2 (F, µ) in F as shown in Lemma S8.When 1/2 ≤ F ≤ 1, we have γ F (F, µ) ≥ γ F 2 (F, µ) by definition, so Eq.(S74) implies that which confirms Eq. ( 13).Here the second equality follows from Eq. ( 12) in Theorem 3 and the third equality follows from Theorem 1.When 0 ≤ F ≤ 1/2, let ρ = |Ψ Ψ | be a pure product state that satisfies then we have In conjunction with Eq. (S74), we conclude that Here the second equality follows from Eq. ( 12) in Theorem 3; the third equality follows from the definition in Eq. ( 8) in the main text, and the last equality follows from Lemma 1.By virtue of Theorem 1 and Eqs. ( 7) and ( 8) in the main text, we can also derive a more explicit expression for γ F (F, µ), Finally, we can prove Eq. ( 14) in Theorem 3. When 1/2 ≤ F ≤ 1, Eq. ( 14) follows from Eqs. ( 12) and ( 13) in Theorem 3, and it offers the best linear upper bound for the guessing probability γ F (F, µ).When 0 ≤ F ≤ 1/2, Eq. ( 14) follows from Eq. ( 13) and the simple inequality γ * (µ) ≥ 1/2, which is clear from Eq. ( 8) in the main text.This observation completes the proof of Theorem 3.

SUPPLEMENTARY NOTE 6: SAMPLE EFFICIENCY OF SDI QSV
In this section we clarify the sample efficiency of SDI QSV over an untrusted quantum network, in which some parties, but not all, are honest.For simplicity, let us first consider the verification of the two-qubit Bell state |Φ = (|00 +|11 )/ √ 2. To quantify the closeness between the actual state ρ and the target state |Φ , here we adopt the reduced fidelity as defined in Eq. ( 11) in the main text, where the maximization is taken over all local unitary transformations on H B .
A key to determining the sample efficiency is the relation between the guessing probability and the reduced fidelity as presented in Theorem 3 in the main text.The linear upper bound for γ F (F, µ) in Eq. ( 14) is particularly important and is reproduced below, Given a verification protocol specified by the distribution µ and any state ρ with F B (ρ) ≤ 1− , then the probability that ρ can pass one test satisfies Now suppose the states ρ 1 , ρ 2 , . . ., ρ N prepared in N runs are independent of each other.Let j = 1 − F B (ρ j ); then the probability that these states can pass all N tests satisfies the following inequalities, where ¯ = j j /N is the average infidelity.In order to ensure the condition ¯ < with significance level δ (confidence level 1 − δ), that is, to ensure the condition j p j ≤ δ when ¯ ≥ , it suffices to perform tests, which scale as N = O(1/(1 − γ * ) ).This equation demonstrates the importance of the threshold γ * in determining the verification efficiency.A small threshold γ * means a high efficiency.
The minimum threshold γ * = 3/4 is achieved for the isotropic protocol (cf.Supplementary Note 9 or Table I in the main text), in which case we have Surprisingly, this number is comparable to the number (3 ln δ −1 )/(2 ) required in standard QSV [5,12].Therefore, SDI verification of the Bell state is almost as efficient as standard QSV.The sample efficiencies of the isotropic protocol and several other protocols in the SDI scenario are illustrated in Supplementary Figure 2.
The above results can be generalized to the verification of the GHZ state following a similar analysis as presented in the main text.Now the threshold is minimized at an equator+Z protocol with γ * ≈ 0.769 (cf.Accordingly, the number of tests required to achieve infidelity and significance level δ reads As in the verification of the Bell state, this number is comparable to the number (3 ln δ −1 )/(2 ) required in standard QSV [13].
To understand the efficiency of our verification protocols proposed for the the SDI scenario, note that each protocol is tied to a steering inequality whose quantum bound and algebraic bound are both equal to 1.This bound corresponds to the maximal probability of passing each test on average and can be attained by a quantum strategy.In addition, the guessing probability threshold is the maximal guessing probability that can be achieved by a classical strategy.As we shall see in Supplementary Note 7, such a high efficiency cannot be achieved in the DI scenario in general unless there exists a suitable Bell inequality for which the quantum bound coincides with the algebraic bound.
Comparison with Refs.[1,2] Here we compare our results with previous results in Refs.[1,2], which studied the self-testing of the Bell state in the one-sided DI scenario, which corresponds to the SDI scenario considered in this work.Both works focused on the steering inequality [1,2]  2 .Both works Refs.[1,2] provided robust self-testing statements in the one-sided DI scenario.For the steering correlation S ≥ 2−ε, Ref. [1] obtained an analytic bound of 13 √ ε and a numeric bound of √ ε on the trace distance with the target state, while Ref. [2] obtained an analytic bound of (3 √ 2+8) √ ε+ε/2.For comparison, here we analyze the performance of the XY protocol with respect to the trace distance.Since the guessing probability in the XY protocol can be rewritten as γ = 1  2 + S 2S Q , combining Eq. (S82), the reduced infidelity can be bounded from above as 1 Ref. [1] also studied the verification of the tripartite GHZ state in both 1-trusted setting and 2-trusted setting, which correspond to different types of multipartite EPRsteering.Numerical results are obtained for both settings based on steering inequalities derived from the Mermin inequality.The scenario considered in this work is more similar to the 2-trusted setting since we assume that each party can only perform local projective measurements.Our result shows that the robustness in the SDI scenario is higher than that in the DI scenario, which is consistent with the result in Ref. [1].
Comparison with Refs.[23,24] Next we compare our results with previous results in Refs.[3,4], which studied the verification of GHZ states in the SDI scenario as considered in this work.The XY protocol considered in this work is equivalent to the protocol proposed in Ref. [3], and the equator protocol is equivalent to the θ-protocol proposed in Ref. [4].The authors of Refs.[3,4] derived the guessing probability thresholds γ * = 1 2 + 1 2 √ 2 ≈ 0.854 for the XY protocol and γ * = 1 2 + 1 π ≈ 0.818 for the θ-protocol.In addition, they derived the relation between the guessing probability and the reduced infidelity for both protocols.However, this relation is suboptimal compared with our result in Eq. (S83), which offers the best linear upper bound for the guessing probability.
In addition to the efficiency advantage mentioned above, the main merit of our work is to propose a simple approach for determining all potential tests of the GHZ state that are based on local projective measurements.In particular, we prove that only two types of tests can be constructed from local projective measurements (cf.Supplementary Note 10).By virtue of this result, we determine the optimal protocol for verifying the GHZ state and for certifying GME.Such optimality results are difficult to establish and are thus quite rare in the DI and SDI scenarios.Meanwhile, our XY Z protocol, which requires only three measurement settings, is more efficient than all protocols known in the literature even based on infinite measurement settings.The protocols in Refs.[3,4] are suboptimal because they employ only the second type of tests and their theoretical analyses are suboptimal.

SUPPLEMENTARY NOTE 7: COMPARISON WITH STANDARD QSV AND DEVICE-INDEPENDENT QSV
To put our work in perspective, in this section we compare SDI QSV with standard QSV [5][6][7] and DI QSV [8] based on self-testing [9,10].To start with, it is instructive to clarify the assumptions underlying these frameworks.In standard QSV, all parties that implement the verification protocol are trustworthy, although the source of the quantum system is not necessarily trustworthy.In DI QSV, the source is not trustworthy and is usually treated as a black-box; meanwhile, all the parties that implement the verification protocol (or the underlying measurement devices) are not trustworthy.In this regard, SDI QSV lies between standard QSV and DI QSV in that some parties are honest, but some others may be dishonest.In a word, the assumptions are strongest in standard QSV and weakest in DI QSV.Accordingly, it is easier to realize standard QSV in experiments than SDI QSV, which in turn is easier than DI QSV.
The verification problems in the three scenarios can all be summarized as follows.A quantum device is supposed to produce the target state |Ψ ∈ H, but actually produces the states ρ 1 , ρ 2 , . . ., ρ N in N runs.For simplicity we assume that the states prepared in different runs are independent of each other.Our task is to verify whether these states are sufficiently close to the target state on average.It should be pointed out that the quantification of closeness depends on the specific scenario under consideration.

Standard quantum state verification
In standard QSV [5][6][7], all parties implementing the verification protocol are trustworthy; in other words, the measurement devices are trustworthy.A verification pro-tocol for a given target state |Ψ is composed of a number of binary tests represented by two-outcome measurements {E l , I − E l }.Here the test operator E l corresponds to passing the test and satisfies the condition E l |Ψ = |Ψ , so that the target state |Ψ can always pass the test.Suppose the test {E l , I − E l } is performed with probability p l ; then the verification operator is given by Ω = l p l E l .If Ψ|ρ j |Ψ ≤ 1 − , then the average probability that ρ j can pass each test satisfies [5,6] tr(Ωρ where β(Ω) denotes the second largest eigenvalue of Ω, and ν(Ω) := 1 − β(Ω) is the spectral gap from the maximum eigenvalue.
To guarantee that the average infidelity satisfies ¯ < with significance level δ, it suffices to perform [5,6] tests, which scale as N = O(1/ν(Ω) ).To minimize the number of tests, we need to maximize the value of the spectral gap ν(Ω) over all protocols based on LOCC, which is usually extremely difficult if not impossible.So far sample-optimal protocols have been found only for limited classes of states.Fortunately, this problem has been resolved for the Bell state [5,11,12] and GHZ states recently [13].In both cases, the maximum spectral gaps read ν(Ω) = 2/3, and the numbers of required tests are given by Device-independent quantum state verification Device-independent QSV [8] can be viewed as a verification procedure in the black-box scenario in which measurement devices cannot be trusted.A key for constructing DI verification protocols is self-testing [9,10], by which quantum states can be certified up to local isometries using only the nonlocal statistics.For example, the maximum quantum bound 2 √ 2 of the Clauser-Horne-Shimony-Holt (CHSH) inequality [14] certifies the singlet [15].The maximum quantum bound 4 of the Mermin inequality [16] certifies the tripartite GHZ state [17].Robustness is the main focus of most studies on selftesting when the correlations achieved deviate from the ideal ones.
On the other hand, to construct a practical DI verification protocol, a self-testing protocol is not enough by itself, unless practical issues like sample efficiency and confidence level can be clarified.Unfortunately, the sample complexity of DI QSV has received little attention until the recent work of Dimić et al. [8] although there are numerous works on self-testing (see Ref. [10] for a review).Following Refs.[8,17], here we discuss the sample efficiency of DI verification of the tripartite GHZ state based on self-testing results tied to the Mermin inequality.
In self-testing, the extractability [17] is used to quantify the closeness between the actual state ρ and the target state |Ψ ; it is defined as where the maximization is taken over all local isometries.Suppose the Bell inequality B is used to self-test the target state |Ψ .Denote by β C and β Q the maximal classical bound and quantum bound of B, respectively.To determine the sample complexity, we need to clarify the relation between the extractability and the Bell violation.
The extractability-violation trade-off is characterized by the function ] defined as [17]: where S B (β) denotes the set of quantum states that can achieve the violation β for the Bell inequality B. This function sets a lower bound on the extractability given the observed violation β.
To be concrete, let us consider self-testing of the tripartite GHZ state using the Mermin inequality.Recall that the Mermin operator reads where A j are binary observables (with eigenvalues ±1) for Alice (the observables for Bob and Charlie have the same structure).The quantum bound of the Mermin inequality is β Q = 4, which coincides with the algebraic bound.The extractability-violation function was determined in Ref. [17], with the result where β Q = 4 is the quantum bound and β * = 2 √ 2 is the threshold violation [17].Notably, for any state ρ with Θ(ρ, Ψ) ≤ 1 − , the Bell violation β it can achieve satisfies Since the quantum bound coincides with the algebraic bound for the Mermin inequality, the self-testing procedure determined by Eq. (S95) can be turned into a DI verification protocol with four tests chosen with probability 1/4 each.Note that the target GHZ state can always pass each test.It remains to establish the relation between the guessing probability and the extractability.For a generic state ρ, the average probability of passing each test reads p = 1 2 + β 2β Q , where β is the Bell violation.If Θ(ρ, Ψ) ≤ 1 − , then Eq. (S97) implies that Now we are ready to estimate the number of copies needed to achieve a given extractability in DI verification of the tripartite GHZ state.Suppose the states ρ 1 , ρ 2 , . . ., ρ N prepared in N runs are independent of each other.Then the probability that these states can pass all N tests is upper bounded by where 1 − ¯ denotes the average extractability.In order to insure the condition ¯ < with significance level δ, it suffices to perform (S100) tests.Surprisingly, the scaling behaviors of N in and δ for DI QSV are the same as the counterparts for standard QSV and SDI QSV considered in this work; moreover, the constant coefficients for the three scenarios are quite close to each other.
It should be pointed out that the above analysis is applicable only when the quantum bound of the underlying Bell inequality coincides with the algebraic bound.If this condition does not hold, then the situation gets more complicated [8], and the optimal scaling behaviors shown in Eq. (S100) cannot be guaranteed.Now the number of tests required reads where c is a constant characterizing the linear dependence between the extractability and the Bell violation.For example, Eq. (S101) holds in DI verification of the Bell state based on the CHSH inequality.Here the sample efficiency is suboptimal compared with the counterparts in standard QSV and SDI QSV (cf.Supplementary Note 6).

SUPPLEMENTARY NOTE 8: VERIFICATION PROTOCOLS BASED ON DISCRETE DISTRIBUTIONS
Recall that each verification protocol of the Bell state is specified by a probability distribution on the Bloch sphere.In practice, it is usually more convenient to choose a discrete distribution as specified by a weighted set {r j , p j } j , where S = {r j } j is a set of unit vectors on the Bloch sphere, and {p j } j is a probability distribution.This weighted set means the projective measurement r j is performed with probability p j .When all the probabilities p j are equal, the weighted set {r j , p j } j is abbreviated as S = {r j } j to simplify the notation.All results presented in the main text and in this Supplementary Material hold for discrete distributions as well states of qubit j can be distinguished with certainty by performing the projective measurement associated with the Bloch vector r j .In addition, given the measurement outcomes of other qubits, measurement of the remaining qubit will yield one outcome with certainty, which corresponds to passing the test.In this way, the local projective measurements specified by the set {r 1 , r 2 , . . ., r n } can be used to construct a nontrivial test for the GHZ state |G n in which no projective measurement on any qubit is redundant.
Conversely, if the set {r 1 , r 2 , . . ., r n } is not compatible, then the measurement outcome of some party is unpredictable even if the measurement outcomes of all other parties are known.Consequently, any outcome reported by this party would pass the test, and such a test is not useful in the presence of dishonest parties.To construct tests for verifying the GHZ state, therefore, we can focus on compatible measurements, whose properties are clarified in the following lemma.Lemma S14.The set {r 1 , r 2 , . . ., r n } of local projective measurements is compatible iff either one of the following two conditions holds: 1. r j = (0, 0, ±1) T for each j.
Here the condition j φ j = 0 mod π means j φ j is an integer multiple of π.Note that −r j and r j correspond to the same projective measurement, except for the labeling of the two outcomes.By replacing some r j with −r j if necessary, the two conditions in Lemma S14 can be simplified as 1. r j = (0, 0, 1) T for each j.
The two types of compatible measurements determined in Lemma S14 can be used to construct two types of tests for verifying the GHZ state.
Proof of Lemma S14.If either one of the two conditions in Lemma S14 holds, then it is easy to verify that the set {r 1 , r 2 , . . ., r n } of local projective measurements is compatible.
Conversely, suppose the set {r 1 , r 2 , . . ., r n } is compatible.If each Bloch vector r j lies on the equator and thus has the form (cos φ j , sin φ j , 0) T for some azimuthal angle φ j , then the two eigenstates of the operator r j • σ read (|0 ± e iφj |1 )/ √ 2. After the projective measurements of all parties except for party k, the two possible reduced states of party k read Next, suppose at least one r j , say r 1 , does not lie on the equator.Then r 1 = (sin θ cos φ, sin θ sin φ, cos θ) T with 0 ≤ θ ≤ π, 0 ≤ φ < 2π, and θ = π/2.The two eigenstates of the operator r 1 • σ have the form

FIG. 1 .
FIG.1.Geometric illustration of the XY Z protocol in the Bloch sphere.For a given concurrence C, the guessing probability is maximized when the semi-major axis v of the correlation ellipsoid parallels one of the eight intelligent directions.

FIG. 2 .
FIG. 2. The guessing probability γ(C) = γ2(C) as a function of the concurrence C for various verification protocols of the Bell state.Here the XY protocol and isotropic protocol are introduced in the main text, while other protocols are proposed in the Supplementary Material.

FIG. 4 .
FIG.4.Sample complexities for verifying the Bell state and GHZ states in three different scenarios.In standard QSV, the Bell state and GHZ states can be verified with the same sample complexity[42,57].In the SDI scenario, the isotropic protocol is chosen for verifying the Bell state and the optimized equator+Z protocol is chosen for verifying the GHZ states.In the DI scenario, the Mermin inequality is employed for verifying the three-qubit GHZ state[46,50].Here the significance level is chosen to be δ = 0.01.

Supplementary Figure 1 .
The guessing probability γ(C) = γ2(C) as a function of the concurrence C in the mixed-state scenario and for various verification protocols of the Bell state.

TABLE I .
Concrete protocols for verifying the Bell state in an untrusted quantum network.
and µ 1 , µ 2 are two probability distributions on the Bloch sphere.Similarly, γ 2 (C, µ) is nondecreasing in C and is convex in C and µ, respectively.
Table I).Supplementary Figure2.Number of copies needed to verify the Bell state in the SDI scenario for various verification protocols.Here the XY protocol and isotropic protocol are introduced in the main text, while other protocols are proposed in Supplementary Note 9.The significance level is chosen to be δ = 0.01.
)where Z, X are trusted Pauli measurements on Alice's side and Z , X are untrusted measurements on Bob's side.Both quantum bound and algebraic bound of this inequality are S Q = 2, which can be achieved by the quantum strategy with ideal measurements on the Bell state |Φ = (|00 + |11 )/ √ 2. Verification protocol based on this steering inequality is essentially equivalent to the XY protocol considered in this work, which can be regarded as a steering inequality with quantum bound 1 and classical bound γ * = 1 2 + 1