Quantum random number generator using a cloud superconducting quantum computer based on source-independent protocol

Quantum random number generator (QRNG) relies on the intrinsic randomness of quantum mechanics to produce true random numbers which are important in information processing tasks. Due to the presence of the superposition state, a quantum computer can be used as a true random number generator. However, in practice, the implementation of the quantum computer is subject to various noise sources, which affects the randomness of the generated random numbers. To solve this problem, we propose a scheme based on the quantum computer which is motivated by the source-independent QRNG scheme in optics. By using a method to estimate the upper bound of the superposition state preparation error, the scheme can provide certified randomness in the presence of readout errors. To increase the generation rate of random bits, we also provide a parameter optimization method with a finite data size. In addition, we experimentally demonstrate our scheme on the cloud superconducting quantum computers of IBM.

Quantum random number generator using a cloud superconducting quantum computer based on source-independent protocol Yuanhao Li 1,2 , Yangyang Fei 1,2* , Weilong Wang 1,2* , Xiangdong Meng 1,2 , Hong Wang 1,2 , Qianheng Duan 1,2 & Zhi Ma 1,2 Quantum random number generator (QRNG) relies on the intrinsic randomness of quantum mechanics to produce true random numbers which are important in information processing tasks. Due to the presence of the superposition state, a quantum computer can be used as a true random number generator. However, in practice, the implementation of the quantum computer is subject to various noise sources, which affects the randomness of the generated random numbers. To solve this problem, we propose a scheme based on the quantum computer which is motivated by the source-independent QRNG scheme in optics. By using a method to estimate the upper bound of the superposition state preparation error, the scheme can provide certified randomness in the presence of readout errors. To increase the generation rate of random bits, we also provide a parameter optimization method with a finite data size. In addition, we experimentally demonstrate our scheme on the cloud superconducting quantum computers of IBM.
Random number generators play an important role in many fields, such as cryptography 1 and scientific simulations 2 . Different applications require different levels of randomness. For the applications which require the random numbers to be statistically unbiased, pseudo random number generators (PRNGs) or classical random number generators relying on deterministic algorithms or physical processes have been widely used 3,4 . Although their output sequences may appear random and usually have a perfect balance between 0 and 1, the predictability and strong long-range correlation may result in security loopholes when employed in some applications, particularly in cryptography and quantum key distribution 5,6 .
To solve this problem, based on the intrinsic uncertainty of quantum mechanics, quantum random number generators (QRNGs) can produce unpredictable random numbers and have attracted great attention in the past few years. Nowadays, many QRNG protocols implemented in optics have been proposed by using different randomness sources, including single photon detection [7][8][9] , vacuum state fluctuation [10][11][12] , laser phase fluctuation 13,14 and amplified spontaneous emission noise 15,16 . There are already some commercial QRNG products implementing these protocols. In general, a QRNG system consists of two parts, a randomness source and a measurement unit. The randomness source emits the superposition state in the measurement basis whose measurement outcome is unpredictable to produce random numbers. For example, for the superposition state |+� = (|0� + |1�)/ √ 2 , the results of projection measurements onto the {|0�, |1�} basis of the state are purely random and ideally form the random numbers.
On the other hand, quantum computers based on different physical implementations have been rapidly developed 17 , including superconducting quantum circuits 18,19 , nuclear magnetic resonance 20,21 and optical systems 22 . Some companies have launched cloud quantum computers which enable users to send quantum programs to use quantum computer 23,24 . Furthermore, due to the presence of superposition state, a quantum computer can be considered as an unbiased QRNG to generate random numbers 25  www.nature.com/scientificreports/ the initial state |0� . Thus, repeating measurements on the qubit in the {|0�, |1�} basis, the numbers 0 and 1 can be obtained with equal probabilities. Compared with the PRNG based on conventional digital computers, the QRNG based on quantum computers does not require random seeds, in which the risk of the predictability of output sequence can be avoided. However, the imperfections of realistic devices and the presence of hardware noise may leave security loopholes that influence the randomness of generated random numbers in practice. To enhance the security of QRNG, self-testing or device-independent (DI) QRNGs are proposed which do not need to trust the generated quantum state and the measurement devices [26][27][28] . By observing the violation of the Bell inequality, the randomness of source can be guaranteed and true random numbers can be obtained. Unfortunately, realizing the practical implementation is difficult due to the requirement of a loophole-free Bell test, and the random number generation rate is very low, which cannot satisfy the demands of practical applications. To increase the generation rate and make the protocols more practical, a semi-self-testing or semi-device-independent (SDI) QRNG scheme with trusted part of the physical devices is proposed which presents a trade-off between the generation rate and the security of certified randomness [29][30][31] .
Among SDI-QRNG schemes, source-independent (SI) QRNG has gathered lots of attention [32][33][34] . With reasonable assumptions that measurement devices are well-calibrated and the source is untrusted, the SI-QRNG can generate secure random numbers and achieve considerable random number generation rates. Most of the SI-QRNG protocols are realized by the quantum optics devices. Utilizing a laser as a randomness source, Zhu et al. proposed a SI-QRNG scheme and realized a randomness generation rate of over 5000 bps 34 , and Marco et al. proposed a continuous-variable version of SI-QRNG protocol and realized a generation rate of 17 Gbps 35 .
In addition to the optics based SI-QRNG, the method of SI-QRNG protocol can also be performed on the quantum computer. The existing quantum computers are noisy and vulnerable to various types of errors, which causes errors in the preparation of superposition state |+� and affects the randomness of random numbers. For the conventional QRNG implementations, which output random numbers by directly measuring the quantum superposition state |+� , the randomness of the output data cannot be well estimated due to the difficulty to model devices precisely. Although the random numbers generated by quantum computers can pass statistical testing after the combination of the von Neumann 36 and Samuelson extractors 37 , the final random number extraction rate cannot be given and the randomness of the random numbers cannot be certified 38 .
SI-QRNG protocol does not require accurate characterization of the equipment to estimate the randomness of generated random numbers under the situation that the measurement error is known. Although the measurement error is timely varied, one's own quantum computer can monitor the measurement error on time. The final extraction rate of random numbers can be given by estimating the error in the preparation of superposition state |+� . Motivated by the original SI-QRNG protocol 34 , we propose a scheme that can guarantee the randomness of random numbers generated by noisy quantum computers. Rather than focusing on the influence of the source controlled by the adversary on the random numbers, we explore how many random bits can be extracted from raw data in the case of imperfect quantum gates. Using the cloud superconducting quantum computer of IBM, we experimentally examine the effectiveness of the proposed protocol based on the SI-QRNG protocol.
The rest of this article is organized as follows. In second section, the protocol based on SI-QRNG using cloud superconducting quantum computer is briefly introduced. In third section, we analyze the protocol, where the final extracted number of random bits is further given in the presence of readout errors, and the estimation method and optimization of the parameter are provided. In fourth section, an experimental demonstration of the scheme is performed with the cloud superconducting quantum computer of IBM. Finally, we conclude this paper in fifth section.

QRNG based on source-independent protocol
In the quantum computer, the initial state of a qubit is generally prepared in |0� and can be represented with state vector as 1 0 T (T = Transpose). By applying RY (π/2) gate, the superposition state |+� = (|0� + |1�)/ √ 2 can be acquired, in which RY (π/2) gate performs π/2 rotation around Y-axis in the Bloch sphere and can be expressed with 1 If the quantum computer is noiseless and the quantum operations are perfect, the measurement results in the computational basis |0� and |1� should be uniformly random based on the mathematical axiom of quantum mechanics. However, the initial state, quantum gate and readout of each qubit may be impacted by hardware noise, which causes the temporal correlation between the output bits 39 . Thus, in the QRNG based on quantum computer, it is important to calculate how many random bits can be extracted from the raw data. Motivated by the optics based SI-QRNG protocol proposed in Ref. 34 , we implement the protocol based on SI-QRNG using the quantum computer, as shown in Fig. 1. The detailed steps of the protocol are as follows: (1) Source: By applying RY (π/2) gate on the initial state |0� , a qubit is prepared in superposition state |+� = (|0� + |1�)/ √ 2.
(2) Random sampling: By utilizing a short random seed, we randomly choose the X basis quantum circuit or Z-basis quantum circuit to measure the quantum superposition state |+� . By adding a RY (π/2) gate to the circuits, the Z-basis measurement can be converted into X-basis measurement, where X = {|0� ± |1�/ √ 2} and Z = {|0�, |1�} . In this process, the quantum circuit is executed n times, including n x times in the X-basis quantum circuit and n z times in the Z-basis quantum circuit, where n = n x + n z .
(3) Parameter estimation: The quantum state emitted by the source should be |+� state when the quantum computer system is noiseless. The measurement result of |+� is |1� and the result of |−� is |0� in the X-basis, www.nature.com/scientificreports/ respectively. Therefore, a result of |0� means an error. We estimate the bit error rate e bx in the X-basis measurement and the statistical deviation is denoted by o, the preparation error of |+� state in the Z-basis e z can be estimated by o is the deviation due to statistical fluctuations which is bounded by 34 where represents the Shannon entropy function. If the value of e bx + o exceeds 0.5, we abort the protocol. (4) Randomness generation: The measurement results of the Z-basis are used to generate random numbers.
We perform Z-basis quantum circuit n z times to generate n z random bits. (5) Randomness extraction: To extract true random numbers, the Topelitz-matrix hashing method is used.
The number of final random bits is 34 where 2 −t e is the failure probability of the randomness extraction 40 . In practice, to construct a Toeplitz matrix of size n z × [n z − n z H(e z ) − t e ] for randomness extraction, the length of n z + n z − n z H(e z ) − t e random bits is required. According to the leftover hash lemma 41 , the final output random bits are not affected by the random bits used in the construction of the Topelitz matrix. Note that there is also another method to estimate the number of final random bits. Vallone et al. 42 performed a complete finite key analysis of the protocol where the conditional min-entropy of the measurement results of Z-basis can be bounded by using the Rényi entropy of order 1/2 of the measurement results of X-basis H 1/2 ({n x }) . Thus, by estimating the max-entropy H 1/2 ({n x }) , the number of final random bits can be determined. In principle, both the methods in Ref. 34 and 42 can be used to estimate the number of final random bits. We choose the method in Ref. 34 in our protocol.

Analysis
In this section, we analyze the randomness of QRNG based on the quantum computer. Due to the presence of noise in the quantum computer, the readout, initial state and quantum gate are imperfect and thus impact the number of extracted random bits. The number of final random bits K, which is given by Eq. (3), does not consider the effect of readout errors. We first calculate the number of final random bits with different readout errors in "The number of extracted random bits in the presence of readout error" section. Then, to calculate the number of final random bits, a method for estimating the upper bound of e z , i.e., the error in the preparation of quantum superposition state, is given out in "The estimation of upper bound of e z " section. Finally, considering the influence of the finite data size on the parameter estimation, the ratio of X-basis measurements is optimized in "Optimization of parameter q x " section.
The number of extracted random bits in the presence of readout error. In practice, the readout operation of a quantum state is imperfect. Generally, the readout errors of |0� and |1� are different, which leads to the asymmetry in the 1/0 ratio of measurement outcomes. Thus, the influence of readout error on the number of extracted random numbers cannot be ignored. In the SI-QRNG based on optics, the influence of detector imperfection on the generated random numbers is analyzed in detail 43 . Motivated by this method, we analyze the scenario that the readout errors of |0� and |1� are different in the quantum computer and recalculate the number of final extracted random bits.
The readout error of |0� , r 0 , means the probability to output |1� while the actual state should be |0� . Similarly, the readout error of |1� , r 1 , means the probability to output |0� while the actual state should be |1� . When r 0 and r 1 are equal, the numbers of 1 and 0 in the measurement outcomes of superposition state |+� are equal and the randomness of the output bits cannot be affected by the readout error. Thus, the readout process of a qubit can be www.nature.com/scientificreports/ equivalent to the superposition of two parts, as shown in Fig. 2. One is the case that the readout errors of |0� and |1� are equal, and the probability of occurrence of Part A is c a . The other one is the case that the readout errors of |0� and |1� are completely different and the probability of occurrence of Part B is c b , in which the readout error of one quantum state is 1 and the readout error of another quantum state is 0. Therefore, no genuine randomness can be extracted from Part B. The relationship between c a and c b is c a + c b = 1 . Moreover, the readout error should fulfill where r i,j denotes the readout error of quantum state |i� for Part j with i ∈ {0, 1} and j ∈ {A, B} . Without loss of generality, we assume that the readout error r 0 is no larger than r 1 . Due to the relationships r 0,A = r 1,A , r 0,B = 0 and r 1,B = 1 , Eq. (4) can be simplified as Furthermore, we can obtain that c b = r 1 − r 0 and c a = 1 − c b = 1 − (r 1 − r 0 ) . Because random numbers cannot be extracted from the output bits in Part B, the mutual information between legitimate user (Q) and any third party user (E) is Therefore, we can rewrite the number of extracted random bits as By observing Eqs. (3) and (7), we can find that the two formulas are the same when r 1 = r 0 (i.e., the readout error is the same for |0� and |1�).
The estimation of upper bound of e z . In practice, the preparation of superposition state |+� is affected by various noises, which results in errors and affects the random number generation rate. To determine how many random bits can be extracted from the raw data, we need to estimate the upper bound of parameter e z , i.e., the errors in the preparation of |+� state. As shown in Fig. 1, e z can be mainly divided into two parts, one is the errors in the preparation of initial state |0� , and the other is the errors in the operation of single-qubit RY (π/2) gate. Through experimental measurements, the errors in the preparation of the initial state can be determined. And one's own quantum computer can obtain the initialization error on time. According to Eq. (1), the upper bound of e z can be determined with the estimation of e bx . Thus, to estimate the upper bound of e z , the value of e bx should be firstly estimated. In this subsection, we consider two cases, one is to consider the errors in quantum gate and readout, and the other is to consider the errors in the initial state, quantum gate and readout. In our protocol, only the single-qubit gate RY (π/2) is used. Due to the presence of various noise and the imperfection of control mechanism, RY (π/2) gate exits deviations of the rotation angle around the Y-axis and the axis of rotation. In this case, the actual RY (π/2) gate can be equivalent to the superposition of RY (θ) gate and RZ(θ) gate. Denoting that the deviation of the rotation angle around the Y-axis is δ and the rotation angle around the Z-axis is φ . Therefore, the actual rotation angle around the Y-axis is π 2 + δ and the RY ( π 2 + δ) gate   www.nature.com/scientificreports/ can be represented by square matrices, i.e., RY ( π 2 + δ) = cos( π 4 + δ 2 ) − sin( π 4 + δ 2 ) sin( π 4 + δ 2 ) cos( π 4 + δ 2 ) . The RZ(φ) gate is expressed with Case 1: The errors in quantum gate and readout are considered. To prepare the superposition state |+� , the first RY (π/2) gate is performed on the initial state |0� , which is equivalent to the superposition of RY ( π 2 + δ) gate and RZ(φ) gate, resulting in the quantum state Therefore, the prepared quantum state is in the superposition of |+� state and |−� state, where the probability of |+� state is 1+cosδcosφ 2 and the probability of |−� state is 1−cosδcosφ 2 , respectively. Applying the same RY ( π 2 + δ) gate and RZ(φ) gate on the quantum state |ϕ 1 � , the resulting quantum state is Finally, we can obtain |0� or |1� to measure the quantum state |ϕ 2 � , where the probability of |0� is ( sin 2 δ+1−cosφ+sin 2 δcosφ 2 ) and the probability of |1� is cos 2 δ 2 (1 + cosφ) in theory. Furthermore, considering the readout error in the quantum computer, we can obtain where N 0 and N 1 are the numbers of 0 and 1 in the results of X-basis measurement with readout error which satisfies N 0 + N 1 = n x , n 0 and n 1 represent the numbers of 0 and 1 in the results of X-basis measurement without readout error, respectively. n 0 and n 1 can be expressed as In our protocol, the result of |−� state in the randomness source is defined as the preparation error of superposition state, so the error e bx is equal to the probability of |−� state, i.e., e bx = 1−cosδcosφ 2 . By solving Eq. (10), the value of n 0 and n 1 can be obtained. In a real quantum computer, the deviation of rotation angle around the Y-axis δ and around the Z-axis φ are both in (− π 2 , π 2 ) , so 0 < cosφ < 1 . According to Eq. (11), we can obtain cos 2 δ = 2n 1 n x (1+cosφ) . Based on the expression for cos 2 δ and the range value of cosφ , the range of δ can be determined which satisfies n 1 n x < cos 2 δ < 2n 1 n x . Given a value of δ , the value of φ can also be determined with Eq. (11). Therefore, the preparation error of |+� in the X-basis measurement can be calculated with e bx = 1−cosδcosφ 2 . Case 2: The errors in the initial state, quantum gate and readout are considered. Due to the presence of errors in preparation of initial state, the initial state can be represented with |ϕ 0 � = α|0� + β|1� , where |α| 2 + |β| 2 = 1 , and the value of α and β can be obtained by measuring the initial state directly. In the computational basis, the state can be written as vector α β T . The first RY (π/2) gate is applied on the initial state |ϕ 0 � to prepare the state |+� , resulting in quantum state Thus, the probability of |+� state and |−� state are cosφ(α 2 cosδ − β 2 cosδ − αβsinδ) and 1 − cosφ(α 2 cosδ − β 2 cosδ − αβsinδ) , respectively. To measure the quantum state on the X-basis, the same RY ( π 2 + δ) gate and RZ(φ) gate are performed on the quantum state |ϕ 1 � , and the quantum state |ϕ 2 � is obtained with www.nature.com/scientificreports/ By measuring the quantum state |ϕ 2 � , we can obtain that the probability of |0� state is α 2 + 1 2 (β 2 − α 2 )(cos 2 δ + cosφcos 2 δ) + 1 2 αβsin2δ(cosφ + 1) and t he prob abi lity of |1� s t at e i s β 2 + 1 2 (α 2 − β 2 )(cos 2 δ + cosφcos 2 δ) − 1 2 αβsin2δ(cosφ + 1) in theory. The error e bx is equal to the probability of |−� state, i.e., e bx = 1 − cosφ(α 2 cosδ − β 2 cosδ − αβsinδ).
Based on Eq. (10), the numbers of 0 and 1 in the results of X-basis measurement without readout errors, i.e., n 0 and n 1 , can be determined. According to the probabilities of 0 and 1 by measuring the quantum state |ϕ 2 � , n 0 and n 1 can be expressed as Similar with the analysis of Case 1, the deviations of rotation angle around the Y-axis δ and around the Z-axis φ are both in (− π 2 , π 2 ) and 0 < cosφ < 1 . With Eq. (14) and the range value of cosφ , the range of δ can be determined which satisfies Given a value of δ , the value of φ can also be determined with Eq. (14). Therefore, the preparation error of |+� in the X-basis measurement can be calculated with e bx = 1 − cosφ(α 2 cosδ − β 2 cosδ − αβsinδ). With (11) and Eq. (14), the deviation of rotation angle around the Z-axis φ is determined in the two Cases. Moreover, the relationship between δ and φ is shown in Fig. 4b and d. Utilizing the determined value of δ and φ , the error e bx can be calculated in Case 1 and Case 2, and the relationship between δ , φ and e bx is shown in Fig. 3. Figure 4a and c shows the relationship between δ and e bx in Case 1 and Case 2, respectively. In Case 1, we can discover that the parameter e bx has a maximum value when δ = 0 , i.e., e bx ≤ 0.05998 . In Case 2, the parameter e bx also has a maximum value, i.e., e bx ≤ 0.26016 . The value of e bx calculated in Case 2 is larger than that in Case 1, which means that the errors in preparation of initial state have effects on e bx . Then, according to Eq. (1), the bound of error e z can be determined.
Optimization of parameter q x . In the cloud superconducting quantum computer of IBM, the quantum circuit is repeatedly sent to the real devices. The running time directly affects the final data and parameter estimation. To increase the final generation rate of the QRNG and improve the security of the QRNG protocol, parameters should be optimized. Based on the parameter optimization method in Ref. 34 , we consider the influence of the finite data size on the parameter estimation and optimize the ratio of X-basis measurements q x .
In our protocol, the measurements results of superposition state |+� in the Z basis are used to generate random numbers, and the errors in the preparation of superposition state |+� can be estimated by the measurement results of X-basis. Based on the method introduced in "Optimization of parameter q x " section, e z can be well approximated by e bx with an infinite data size. However, due to the statistical fluctuations, the parameter e z cannot be estimated accurately and the method of approximating is crucial. The parameter e z is estimated by Eq. (1) and the statistical fluctuation o is bounded by Eq. (2). According to Eq. (2), there is a trade-off between q x and o for the ratio of the final random bit length over the raw data size given that ε e is fixed. Generally, the (13) (14) n 0 = (α 2 + 1 2 (β 2 − α 2 )(cos 2 δ + cosφcos 2 δ) + 1 2 αβsin2δ(cosφ + 1))n x n 1 = (β 2 + 1 2 (α 2 − β 2 )(cos 2 δ + cosφcos 2 δ) − 1 2 αβsin2δ(cosφ + 1))n x www.nature.com/scientificreports/ failure probability ε e is picked to be a small value. Hence, the value of q x should be optimized for the randomness extraction rate and follows the condition: With the method of the numerical solution, the optimized q x can be obtained. In the cloud superconducting quantum computer of IBM, the maximum executing number of a quantum circuit is 8192 times. Repeating the quantum circuit, the final number of executions n can be up to 8.192 × 10 6 times. The value of ε e is 2 −100 in our later data processing. Supposing that the preparation error of superposition sate in the X-basis e bx is 0.05, the readout error of |0� is r 0 = 0.05 and the readout error of |1� is r 0 = 0.1 , we can compute the optimal q x for the   www.nature.com/scientificreports/ final extracted random bits K final , as shown in Fig. 5. The value of K final has a maximum value which means that the generation rate of random numbers can achieve a maximum value for a given condition.

Experiment on the cloud superconducting quantum computer of IBM
In this section, we perform our proposed protocol on the cloud superconducting quantum computers of IBM to show its practicality. Since the error in the preparation of the initial sates is almost zero in the quantum computers of IBM, the error e bx can be estimated with the method in Case 1. In the quantum computer system, 8192 is the maximum number of uninterrupted shots available. For demonstration purposes, the basis choice is achieved by running the Z-basis measurement of the quantum circuit with 8192 times and the X-basis measurement of the quantum circuit with 251 times.
IBMQ_5_yorktown and IBMQ_lima are used in the experiment where the device topologies are shown in Fig. 6 44 . IBMQ_5_yorktown and IBMQ_lima both have five qubits and the readout error for each qubit is provided by Qiskit 45 . Without loss of generality, we select the qubit 0 ( Q 0 ) of the two devices to execute the quantum circuit and the readout errors of Q 0 for these two devices are shown in Table 1.
By running the quantum circuits of SI-QRNG repeatedly, we obtain two sequences under each quantum computer device which are the results of the Z-basis measurement and X-basis measurement. The sequence L z of Z-basis measurement is used to extract random bits and its length n z is 819200. The other sequence L x is used to estimate the preparation error of superposition state |+� in the Z-basis e bx and its length n x is 25100.
In the sequence L x of IBMQ_5_yorktown , the number of 0 is N 0 = 2669 and the number of 1 is N 1 = 22431 . According to Eq. (10) and the readout error of Q 0 , we can obtain n 0 = 299.8557 and n 1 = 24800.1443 . With Eq. (11), the value of δ is calculated which is between −0.1095186 and 0.1095186. Exploiting the expression for e bx , we can obtain the maximum value of e bx is 0.011943. Based on Eqs. (1) and (2), the bound of e z is determined and equals to 0.0122442. Thus, the number of random bits K yorktown that can be extracted from the Z-basis measurement is 741006 which is calculated by using Eq. (7), and the corresponding random bits' generation rate r yorktown is 0.9045. Utilizing the same method, the parameter e z and the final extracted random bits K lima in the IBMQ_lima device can be calculated. The numbers of 0 and 1 in the X-basis of IBMQ_lima are N 0 = 1186 and N 1 = 23914 . By calculating, we can obtain e bx = 0.039318 , e z = 0.0397301 , K lima = 621729 and the corresponding random bits' generation rate r lima is 0.7589.
After obtaining the raw data and the estimated e z , we apply the Toeplitz matrix hashing on the raw data to obtain the final random numbers 46 . To evaluate the randomness of the final data, we perform the NIST Statistical Test on the final random numbers 47 . Since the length of the final data cannot satisfy some test items of the NIST Statistical Test, the final data is only subjected to the nine test items from the NIST Statistical Test which are the frequency test, frequency within a block test, runs test, longest runs within a block test, FFT test, approximate entropy test, Matrix Rank Test and the cumulative sums test (forward, backward). Each test item produces a corresponding P-value and the significance level α is set as 0.01 in our test. If the P-value ≥ α , the final data is considered as true random numbers with 1 − α of confidence level. The results of the NIST Statistical Test on the two final sequences with a length of 600,000 bits are shown in Table 2. From Table 2, one can see that all the P-values are larger than 0.01, which indicates the final data of IBMQ_5_yorktown and IBMQ_lima pass all test items.
Furthermore, we calculate the autocorrelation coefficients of the final data to test the independence between neighboring bits of final data. The autocorrelation coefficient is defined as a(k) = , where stands for expectation, X i denotes the value of the i th bit in the sequence, µ and σ 2 are the average and the variance  www.nature.com/scientificreports/ of the sequence 16 . The final data with length of n l is considered as true random numbers when all autocorrelation coefficients are greater than the three-standard-deviation value a 3σ with a 3σ = 3/ √ n l . We choose a sequence with a length of 600,000 bits to perform the autocorrelation test and the corresponding a 3σ is approximately 0.003873. The results of the autocorrelation test of the two final sequences are shown in Fig. 7. The red dashed line stands for the corresponding three-standard-deviation value a 3σ . It can be seen that all the absolute values of autocorrelation coefficients are below a 3σ . From the results of the NIST Statistical Test and autocorrelation test, we can know the randomness of the final data generated by IBMQ_5_yorktown and IBMQ_lima can be guaranteed.

Conclusion
Due to the presence of noise and the imperfection of the control mechanism, there exit errors in the initialization, quantum gate and readout in the quantum computer, which leads to the bias of the output data. Motivated by the SI-QRNG based on optics 34 , we propose and implement a QRNG scheme using a cloud superconducting quantum computer. Our proposed protocol can estimate the preparation error of superposition state |+� and give the final number of extracted random bits, which guarantees the security of generated random numbers. The readout errors of |0� and |1� are generally different in the quantum computer, which impacts the randomness of generated random numbers. Utilizing the method for solving the imperfection of detector in origin SI-QRNG protocol, we firstly give the final extracted number of random bits K final with readout error. Then, by further considering the errors in the preparation of initial state and quantum gate, the estimation methods for parameter e z are given, where the quantum gate error includes the deviation of the rotation angle around the Y-axis δ and the rotation angle around the Z-axis φ . Moreover, we optimize the ratio of X-basis measurements q x to increase the final random number generation rate.
To prove the practicability of our protocol, we perform our proposed protocol on the cloud superconducting quantum computer of IBM. The random numbers generated by IBMQ_5_yorktown and IBMQ_lima are postprocessed by Toeplitz matrix hashing to obtain the final random numbers. The results of the NIST Statistical Test and autocorrelation test show that the final random numbers could be considered as true random numbers. Utilizing the SI-QRNG scheme, the error in the preparation of quantum superposition state |+� can be monitored, and we realize the generation of true random numbers in quantum computers with noise.