The distribution and verification of quantum nonlocality across a network of users is essential for future quantum information science and technology applications. However, beyond simple pointtopoint protocols, existing methods struggle with increasingly complex state preparation for a growing number of parties. Here, we experimentally demonstrate multiparty detectionloopholefree quantum steering, where one party simultaneously steers multiple spatially separate parties, using a multiqubit state produced from a set of qubits of which only one pair is entangled. We derive losstolerant steering inequalities, enabling our experiment to close the detection loophole, and enabling us to show the scalability of this approach to rigorously verify quantum nonlocality across arbitrarily many parties. This provides practical tools for developing the future quantum internet.
I. INTRODUCTION
Quantum nonlocality is a resource for secure communications and distributed information tasks.^{1–3} The latter include distributed quantum computing,^{4} quantum cryptography,^{5–7} randomness certification,^{8–10} quantum state teleportation,^{11,12} and longrange sensor nets such as extended baseline optical telescopes.^{13}
Nonlocal communication protocols prevent eavesdroppers or malicious parties from sabotaging or gaining information from sensitive communication and guarantee unconditional security.^{14–16} This is done by having networks of separate parties (usually two) measure correlations and violate a Bell inequality or steering inequality. Quantum (or Einstein–Podolsky–Rosen) steering^{17,18} is a form of nonlocality which distinguishes itself from Bell nonlocality in several ways.^{3,19} Notably, by only trusting a subset of parties, quantum steering is more robust to loss and noise on the untrusted channels.^{20–22}
Steering is often studied in pointtopoint scenarios, but more than two spatially separate parties are required for most networking applications. Establishing multiparty quantum networks requires understanding new and more complex nonlocal and causal relationships beyond the wellstudied twoparty scenario described by Bell inequalities.^{23} For quantum steering in a multiparty scenario, many network topologies can arise, as any observer in the network could play the role of a trusted or untrusted party within a given steering task. This leads to novel nonlocality phenomena such as network quantum steering^{24} or collective steering,^{25–28} where subsets of parties jointly attempt to steer other subsets.
Increasing the number of parties in multiparty steering by directly extending traditional approaches is daunting, as it entails scaling up the quantity or complexity of entangled resources. Even a simple scenario in which one (untrusted) Alice steers N (trusted) Bobs, where Alice and each of the Bobs share an entangled pair, requires 2N total qubits.^{29} Alternative approaches that reduce this number rely on complex quantum states with entanglement depth larger than 2,^{30} such as Nqubit W, GHZ, cluster or graph states,^{31–34} or multimode squeezing.^{26} A different approach involves using a single entangled pair and sequential weak measurements.^{35–37} These works require all trusted parties to share a common quantum channel and also rely on postselection, significantly increasing network complexity, and preclude nonlocal behavior from being observed simultaneously.
Moreover, realworld implementations require ruling out cheating strategies that untrusted parties may utilize, especially those that exploit known loopholes. The detection loophole is one such example, that is opened if the trusted party makes a fair sampling assumption on the statistics governing reported null results by the other party. Unlike with other loopholes, accounting for photonic loss requires a more sophisticated theoretical treatment. This is crucial, as failing to close the detection loophole entirely compromises the deviceindependent properties which are unique to the steering task.
In this work, we experimentally overcome the problems of growing entangled resource needs by utilizing a scalable and resourceefficient approach to multiparty steering. Following one proposal in Ref. 38, we build a multiphoton state from a single entangled photon pair plus other photons in a product state. We develop a theory for verifying multiparty steering with these resourceefficient states in the presence of loss, exploring a scenario where one party steers an arbitrary number N of spatially separated parties simultaneously. Our experiment demonstrates simultaneous quantum steering of N = 2 trusted parties with the detection loophole closed. Moreover, we predict steerability of up to N = 26 trusted parties with the noise of our currently produced states and prove losstolerant steerability for arbitrarily many parties with ideal detectors and only three measurement settings.
II. RESULTS
A. Scenario
Consider a network involving N + 1 spatially distant parties, composed of one untrusted Alice and N trusted Bobs, as in Fig. 1. The parties in this network share a quantum state such that each observer has one out of N + 1 qubits. Through a quantum steering test, Alice attempts to convince each of the Bobs simultaneously that she shares nonlocality with them. The test result is evaluated based on measurement outcomes reported by the parties over repeated protocol runs.
Since Alice is untrusted, we treat her measurement device as a black box, making no assumptions about how her outcomes are generated. Alice receives classical instructions labeled by x, specifying which out of a set of predetermined measurements to perform in each protocol run, and she broadcasts the corresponding outcomes $ a \u2208 { + , \u2212 , \u2205}$ to the other N parties. Here, $\u2205$ represents the null outcome, corresponding to an event where Alice has received a measurement instruction but reports no outcome. The probability of reporting a nonnull outcome per protocol run is called Alice's efficiency.
In every protocol run, each Bob (labeled B_{n}) can perform a projective measurement on his qubit (from a tomographically complete set). Here, no option of a null outcome is required because the trusted Bobs—who collectively decide what constitutes a run of the protocol—exclude instances where their measurement devices do not report an outcome. Over time, each Bob sorts his measurement statistics by Alice's announced results, thus creating ensembles of locally observed quantum states normalized by the probability of Alice observing a corresponding measurement outcome. These ensembles are commonly known as assemblages.^{19} Importantly, an assemblage contains all the information relevant to deciding the result of a quantum steering test.
For a given Alice–Bobs' bipartite state ρ, the $ n th$ Bob's assemblage is a collection of unnormalized quantum states $ \sigma a  x B n = Tr A [ ( E a  x \u2297 I ) \rho A , B n ]$. Here, $ \rho A , B n : = Tr \xac A , B n [ \rho ]$ is the reduced system shared by Alice and Bob n, while $ { E a  x} a$ is the positive operatorvalued measure (POVM)—over a—for each of Alice's settings x. Any bona fide assemblage must contain only positive semidefinite matrices that satisfy the nosignaling condition, $ \u2200 x , x \u2032 , \u2211 a \sigma a  x B n = \u2211 a \sigma a  x \u2032 B n = : \rho B n$. Here, we employ a convex optimization technique to reconstruct the assemblages ( Appendix C), which ensures these properties.
B. Steering in the presence of loss
If Alice's efficiency is below unity, a common approach is to postselect by ignoring the null outcomes and introducing the fair sampling assumption that Alice's reported measurement outcomes accurately represent the total statistical sample. However, as in any rigorous nonlocality test, such experimental assumptions open loopholes, allowing false nonlocality verification.
The loophole associated with the fair sampling assumption is the detection loophole; it allows Alice to cheat by not reporting some of her measurement outcomes to mimic a steerable assemblage. Alice's null outcome instances need to be taken into account to close this loophole and drop the need for the fair sampling assumption. This amounts to placing a lower bound on Alice's efficiency, which she must surpass to steer Bob via her nonnull outcomes.
C. Multiparty, loopholefree steering with a resourceefficient state
Preparing an appropriate multiparty entangled quantum state is crucial to realizing a losstolerant multiparty steering demonstration. Here, we construct a practical quantum state that can demonstrate loopholefree steering from Alice to each of the Bobs independently, based on a single entangled pair of qubits and N – 1 pure ancillas. The ideal (lossless) theory of the type of entanglement we will create was recently introduced in Ref. 38, where it was referred to as semirandom pair entanglement. Here, we introduce a new theory for verifying steering in the presence of loss, which facilitates a robust demonstration of steering in this scenario with no detection loophole, as well as to prove losstolerant steerability for arbitrarily many parties.
Intuitively, this behavior is a result of saturating the steered states of $  \psi \alpha \u27e9$ and the ancillas close to the boundary of space of quantum states. More specifically, when Alice measures the three Pauli observables, the steered states for each Bob [see Eqs. (E2)–(E4) of Appendix E] are contained within a ball of radius $ 1 / N$ in the Bloch ball, which touches its surface once, at $  0 \u27e9$. Varying α changes the probabilities (and positions) with which the steered states appear inside this ball. For such an arrangement of steered states, the most difficult assemblages (for a given efficiency) to construct an LHS model for are those where the purest states appear with the highest probability, since the LHS ensemble must comprise strictly physical quantum states.
When the family of states of Eq. (4) is modified slightly through the addition of noise, the singularity disappears, as shown by the purple dashed line in Fig. 3. Although counterintuitive, this finding that a small value of α is optimal aligns well with the fact that for the case of two parties, pure states with a small amount of entanglement exhibit detectionloopholefree nonlocality at a lower efficiency bound than a maximally entangled state in the cases of both Bell nonlocality^{39} and quantum steering^{40} tests.
D. Experiment implementation of threeparty, detectionloopholefree steering
We perform a photonic experiment, encoding qubits in the polarization degree of freedom of single photons. Our experimental setup is shown in Fig. 2. To prepare the state of Eq. (4), we first generate an entangled photon pair in the state $  \psi \alpha \u27e9$ and a heralded single photon using two highefficiency, telecomwavelength photon pair sources based on groupvelocitymatched spontaneous parametric downconversion with a pulsed pump.^{41} One half of the entangled pair is sent to Alice, and the other half is probabilistically distributed to one of the trusted parties, Bob 1 or Bob 2, with the other Bob receiving the heralded single photon. Alice is instructed to perform one out of a set of three projective measurements on her photon. The Bobs each perform a quantum state tomographic measurement on their respective photon.
Bob 1 and Bob 2 do not need to share a quantum channel but require the other party to indicate through a classical channel if they obtain an outcome. In the cases where both Bobs announce that they have obtained an outcome, the run goes ahead, regardless of whether Alice announces a measurement outcome or claims to have lost her photon.
To build up statistics, the protocol is repeated for each of Alice's measurement settings and various tomographic projections for the Bobs. Afterward, Bob 1 and Bob 2 reconstruct and analyze their assemblages, determine Alice's efficiency based on the proportion of runs she reported an outcome, and test the inequality of Eq. (2). Alice's efficiency includes all losses associated with her photon, from state preparation through to her detection efficiency. Further experimental details are provided in the Appendices.
The results of steering tests for different states are shown as the data points in Fig. 3. Multiparty steering is demonstrated when $ \epsilon exp > \epsilon Bob 1 \u22c6$ and $ \epsilon \u2009 exp \u2009 > \epsilon Bob 2 \u22c6$, which is clearly observed at α values between 0.065 and 0.3. The most statistically significant steering occurs at $ \alpha \u2248 0.1$, where we measured a minimum efficiency 5.34 (5.35) standard deviations above the cutoff for Bob 1 (Bob 2). This is thanks to our high experimental heralding efficiencies above 0.69. Since the cutoff efficiencies are numerically determined from the experimentally reconstructed assemblages, the steering demonstrations are conclusive independent of how well the experimental states approximate the target states of Eq. (4).
E. Extension to more parties
This state can be created in a resourceefficient way and with several appealing properties.

Number of qubits: Each party only requires one qubit, unlike the simple extension of twoparty steering where an entangled pair of qubits gets distributed between Alice and each of the Bobs, which would involve 2N qubits.

2Producibility: Multiparty quantum states can be characterized using the concept of kproducibility.^{30} A pure quantum state $  \psi \u27e9$ is kproducible if it can be written as a composition of quantum states involving at most k parties. That is, $  \Psi \u27e9 =  \psi 1 \u27e9 \u2297  \psi 2 \u27e9 \u2297  \psi 3 \u27e9 \u2297 \u2026$ where each $  \psi i \u27e9$ is a state shared between k parties. Similarly, a mixed state is kproducible if it can be decomposed as a mixture of kproducible pure states. If a state is not (k − 1)producible, but is kproducible, then its entanglement depth is k. The states from Eq. (3) are 2producible and have entanglement depth 2, independently of the number of parties involved—unlike N + 1party GHZ and W states which both have entanglement depth N + 1.

Number of entangled pairs: The state preparation only requires a single pair of entangled qubits, which is a stronger constraint on the required resources than 2producibility alone.

Deterministic implementation of gates: The creation of the states involves gates that can be implemented on photons deterministically, in the sense that the gates do not require postselection or heralding, unlike controlledNOT gates.
To understand how this class of states permits loopholefree multiparty steering, we can derive an exact expression for Alice's cutoff efficiency $ \epsilon \u22c6$, when she measures three dichotomic Pauli observables. Its closed form, presented in Eq. (A3) of Appendix A and derived in Appendix E, is directly a function of N, and the degree of entanglement, α, present in the initial entangled pair.
From a theoretical point of view, this efficiency cutoff has various interesting properties. Detectionloopholefree steering could be observed when this expression is strictly below unity, which occurs for $ \alpha \u2208 ( 0 , 2 / ( N + 1 ) )$. Moreover, we show in Sec. 3 of Appendix E that the minimal value of $ \epsilon \u22c6$ is achieved in the singular limit $ \alpha \u2192 0$, the same limit in which the concurrence of $  \psi \alpha \u27e9$ vanishes. This generalizes the earlier behavior evident from the N = 2 case (purple solid curve in Fig. 3). In this limit, the required detection efficiency is only $ \epsilon \u22c6 = ( 1 + 2 / N ) \u2212 1$, which is quite striking for a state produced from a single pair of entangled qubits and only three measurement settings.
Importantly, these bounds demonstrate that there always exists a value of Alice's efficiency, which permits arbitrarily many Bobs to be steered in a loopholefree way, using our construction. However, this is only true for an ideal scenario where noise is absent from the experiment. Therefore, we also investigate the scalability of steering for the states defined by Eq. (3), but with the addition of noise at the level we observed in our experiment. These states are wellmodeled by a white noise model acting on the entangled state prior to swapping, $ \Delta \eta (  \psi \alpha \u27e9 \u27e8 \psi \alpha  ) = \eta  \psi \alpha \u27e9 \u27e8 \psi \alpha  + ( 1 \u2212 \eta ) I / 4$ with $ \eta = 0.9931$. We implement the numerical program from Ref. 42 to certify steerability from Alice to each Bob under all qubit projective measurements. That is, in the limit of an infinite number of measurement settings. Denoting these noisy states by a tilde, for a fixed twoqubit state $ \Delta \eta ( \rho \u0303 \alpha , 2 )$, this algorithm computes a quantity called the critical radius $ R ( \Delta \eta ( \rho \u0303 \alpha , 2 ) )$. A state that achieves a value R < 1 implies it is steerable under all projective measurements made by Alice. Conversely, $ R \u2265 1$ implies it cannot be steered under that set of measurements. Treating α and N as fixed parameters for each computation, we compute an upper (lower) bound on the critical radius using an outer (inner) approximation of the Bloch sphere by a polytope with 1514 vertices. The results of these simulations are illustrated in Fig. 5. The green (purple) line denotes where the upper (lower) bound on R equals unity for given α and N. The region shaded in gray denotes where these upper and lower bounds on R lie either side of 1, so steerability cannot decided, owing to the precision used in the simulation. Remarkably, we find that a judicious choice of α exists such that up to 26 Bobs could be steered simultaneously.
III. DISCUSSION
In this work, we experimentally demonstrate a multiparty quantum nonlocality experiment with spatially separated parties in the discrete variable regime—the first such experiment to close the detection loophole. We achieve this by a novel, resourceefficient state preparation scheme that allows multiparty quantum steering. Remarkably, using just a single pair of entangled qubits, one party can, in theory, steer arbitrarily many other parties. Importantly, this approach is robust to the commonly overlooked effects of photon loss and noise: our steering inequality takes these effects into account and can be satisfied under demanding but nevertheless viable conditions. We apply our method to experimentally satisfy a detectionloopholefree quantum steering inequality in a network of three spatially separated parties by 5.35 standard deviations. We thereby demonstrate multiparty steering, where one untrusted party simultaneously steers two trusted parties. We show steering of up to N = 26 is possible with realistic experimental quantum state fidelities and ideal efficiencies. Unlike other methods, our approach is scalable as it does not require heralded or postselected gates to generate the steerable state, and neither does it require increasing entanglement for larger numbers of parties. Our protocol does not rely on sequential measurements, such as those used in continuous variable protocols. Thus, we do not require a quantum channel connecting our trusted parties. In the experiment, we focused on closing the detection loophole, which is crucial for realworld implementations.
Verification of quantum nonlocality is essential for the implementation of secure quantum networks. For the experimental design and data analysis, we used semidefinite programing to determine steering bounds and novel techniques to reconstruct quantum assemblages using maximumlikelihood estimation; these can also find wider applications in other quantum steering contexts.
Future directions include the implementation of a fully loopholefree protocol, implementing a larger network with more parties, and including a larger number of untrusted elements in various topologies. Our work demonstrates a realistic method for steering verification in a largescale quantum network. We show how steeringbased quantum networks of tens of users can be implemented. From a secure quantum communication application side, our protocol allows a trusted network to introduce an untrusted member, which may be useful in user authentication, such as banking, multifactor authentication, and implementations of a quantum internet.
ACKNOWLEDGMENTS
This work was supported by the Australian Research Council Centre of Excellence CE170100012 and the National Natural Science Foundation of China (No. 12288201). A.P., T.J.B., and Q.C.S. acknowledge support from the Australian Government Research Training Program (RTP). The authors acknowledge the support of the Griffith University eResearch Service and Specialized Platforms Team and the use of the HighPerformance Computing Cluster “Gowonda” to complete this research.
AUTHOR DECLARATIONS
Conflict of Interest
The authors have no conflicts to disclose.
Author Contributions
Alex Pepper: Data curation (lead); Formal analysis (equal); Investigation (lead); Methodology (lead); Software (equal); Visualization (lead); Writing – original draft (equal); Writing – review & editing (equal). Travis J. Baker: Conceptualization (supporting); Formal analysis (equal); Investigation (equal); Methodology (equal); Software (equal); Visualization (supporting); Writing – original draft (equal); Writing – review & editing (equal). Yuanlong Wang: Formal analysis (equal); Funding acquisition (supporting); Methodology (supporting); Software (equal); Writing – original draft (supporting); Writing – review & editing (supporting). QiuCheng Song: Formal analysis (supporting); Software (supporting); Writing – review & editing (supporting). Lynden K. Shalm: Resources (equal); Writing – review & editing (equal). Varun B. Verma: Resources (equal); Writing – review & editing (equal). Sae Woo Nam: Resources (equal); Writing – review & editing (equal). Nora Tischler: Investigation (supporting); Methodology (supporting); Project administration (supporting); Supervision (equal); Validation (equal); Writing – review & editing (equal). Sergei Slussarenko: Investigation (equal); Methodology (supporting); Project administration (supporting); Supervision (equal); Validation (equal); Writing – review & editing (equal). Howard M. Wiseman: Conceptualization (lead); Funding acquisition (supporting); Project administration (lead); Supervision (lead); Validation (equal); Writing – review & editing (equal). Geoff J. Pryde: Funding acquisition (lead); Project administration (equal); Resources (equal); Supervision (lead); Validation (supporting); Writing – review & editing (equal).
DATA AVAILABILITY
The data that support the findings of this study are available within the article and data are available from corresponding author upon reasonable request.
APPENDIX A: DETECTIONLOOPHOLEFREE STEERING AND MEASUREMENT DESIGN
α .  θ_{1} .  $ \varphi 1$ .  θ_{2} .  $ \varphi 2$ .  θ_{3} .  $ \varphi 3$ . 

0.015  0  57.2955  0.859 88  −3.3977  −88.0451  0.7153 
0.065  0  4.2398  84.1949  −48.6642  −88.781  48.0435 
0.100  0  39.2478  −60.7293  39.2834  57.8822  −41.0124 
0.185  0  −33.2033  −70.5399  −42.0172  64.8311  44.2747 
0.300  0  −1.1167  −89.9633  −2.5873  32.5804  57.2852 
0.400  0  −57.1865  −53.4757  −9.8684  36.7915  10.1887 
0.500  0  −13.0359  8.8413  57.2252  89.8365  0.50483 
α .  θ_{1} .  $ \varphi 1$ .  θ_{2} .  $ \varphi 2$ .  θ_{3} .  $ \varphi 3$ . 

0.015  0  57.2955  0.859 88  −3.3977  −88.0451  0.7153 
0.065  0  4.2398  84.1949  −48.6642  −88.781  48.0435 
0.100  0  39.2478  −60.7293  39.2834  57.8822  −41.0124 
0.185  0  −33.2033  −70.5399  −42.0172  64.8311  44.2747 
0.300  0  −1.1167  −89.9633  −2.5873  32.5804  57.2852 
0.400  0  −57.1865  −53.4757  −9.8684  36.7915  10.1887 
0.500  0  −13.0359  8.8413  57.2252  89.8365  0.50483 
APPENDIX B: DATA DEMONSTRATING DETECTIONLOOPHOLEFREE STEERING
In Table II, we summarize the data appearing in Fig. 3 of the main text. Rows shaded in green and yellow indicate datasets that demonstrate detectionloopholefree steering of both Bobs.
α .  $ \epsilon \u2009 exp$ .  $ \epsilon mean$ .  $ \epsilon Bob 1 \u22c6$ .  $ \epsilon Bob 2 \u22c6$ .  $ \epsilon ideal ( sim )$ .  $ \epsilon noisy ( sim )$ . 

0.015  0.7171(0.0100)  0.7276(0.0056)  0.7975(0.0993)  0.8023(0.0934)  0.5040  0.5978 
0.065  0.6899(0.0116)  0.7059(0.0062)  0.5858(0.0402)  0.5873(0.0513)  0.5171  0.5521 
0.100  0.7259(0.0108)  0.7390(0.0058)  0.5476(0.0333)  0.5394(0.0349)  0.5277  0.5561 
0.185  0.7282(0.0090)  0.7317(0.0049)  0.6021(0.0272)  0.6257(0.0258)  0.5553  0.5804 
0.300  0.7020(0.0086)  0.7160(0.0046)  0.6644(0.0182)  0.6591(0.0145)  0.6053  0.6303 
0.400  0.7206(0.0095)  0.7325(0.0051)  0.7393(0.0273)  0.7095(0.0186)  0.6646  0.6926 
0.500  0.6949(0.0099)  0.7079(0.0047)  0.7990(0.0227)  0.7780(0.0247)  0.7491  0.7807 
α .  $ \epsilon \u2009 exp$ .  $ \epsilon mean$ .  $ \epsilon Bob 1 \u22c6$ .  $ \epsilon Bob 2 \u22c6$ .  $ \epsilon ideal ( sim )$ .  $ \epsilon noisy ( sim )$ . 

0.015  0.7171(0.0100)  0.7276(0.0056)  0.7975(0.0993)  0.8023(0.0934)  0.5040  0.5978 
0.065  0.6899(0.0116)  0.7059(0.0062)  0.5858(0.0402)  0.5873(0.0513)  0.5171  0.5521 
0.100  0.7259(0.0108)  0.7390(0.0058)  0.5476(0.0333)  0.5394(0.0349)  0.5277  0.5561 
0.185  0.7282(0.0090)  0.7317(0.0049)  0.6021(0.0272)  0.6257(0.0258)  0.5553  0.5804 
0.300  0.7020(0.0086)  0.7160(0.0046)  0.6644(0.0182)  0.6591(0.0145)  0.6053  0.6303 
0.400  0.7206(0.0095)  0.7325(0.0051)  0.7393(0.0273)  0.7095(0.0186)  0.6646  0.6926 
0.500  0.6949(0.0099)  0.7079(0.0047)  0.7990(0.0227)  0.7780(0.0247)  0.7491  0.7807 
APPENDIX C: ASSEMBLAGE TOMOGRAPHY
We then perform hypothesis testing to check the degree to which our tomography results are consistent with the experimental data (see Appendix F). We obtain a test value of 572.0617 from our tomography results, smaller than the threshold of the critical region 595.1683 (corresponding to a significance level $ s \alpha = 5 %$), indicating an acceptance of the null hypothesis that the MLE result matches the true value of the assemblage.
The tomography for $ \alpha = 0.015$ was omitted from this testing as this data point has a large statistical uncertainty arising from diminishing photon counts as α decreases, which causes the hypothesis testing to fail.
APPENDIX D: RECONSTRUCTED ASSEMBLAGES
The expected ensembles (Tables III and V) vs the MLE reconstructed ensemble (Tables IV and VI) tomography results for Alice–Bob 1 conditioned on Alice's first measurement. Here, these are shown for the two datasets α = 0.015, 0.1. Imaginary components are not displayed as they are all <0.002.
Outcome .  $  H \u27e9 \u27e8 H $ .  $  H \u27e9 \u27e8 V $ .  $  V \u27e9 \u27e8 H $ .  $  V \u27e9 \u27e8 V $ . 

+  0.6017  0.0166  0.0166  0.0017 
−  0.1032  −0.0166  −0.0166  0.0183 
Null  0.2676  0  0  0.0076 
Outcome .  $  H \u27e9 \u27e8 H $ .  $  H \u27e9 \u27e8 V $ .  $  V \u27e9 \u27e8 H $ .  $  V \u27e9 \u27e8 V $ . 

+  0.6017  0.0166  0.0166  0.0017 
−  0.1032  −0.0166  −0.0166  0.0183 
Null  0.2676  0  0  0.0076 
Outcome .  $  H \u27e9 \u27e8 H $ .  $  H \u27e9 \u27e8 V $ .  $  V \u27e9 \u27e8 H $ .  $  V \u27e9 \u27e8 V $ . 

+  0.6073  0.0121  0.0121  0.0027 
−  0.0911  −0.0370  −0.0370  0.0388 
Null  0.2454  −0.0088  −0.0088  0.0146 
Outcome .  $  H \u27e9 \u27e8 H $ .  $  H \u27e9 \u27e8 V $ .  $  V \u27e9 \u27e8 H $ .  $  V \u27e9 \u27e8 V $ . 

+  0.6073  0.0121  0.0121  0.0027 
−  0.0911  −0.0370  −0.0370  0.0388 
Null  0.2454  −0.0088  −0.0088  0.0146 
Outcome .  $  H \u27e9 \u27e8 H $ .  $  H \u27e9 \u27e8 V $ .  $  V \u27e9 \u27e8 H $ .  $  V \u27e9 \u27e8 V $ . 

+  0.7104  −0.0313  −0.0313  0.0059 
−  0.0045  −0.0004  −0.0004  0.0078 
Null  0.2663  −0.0018  −0.0018  0.0051 
Outcome .  $  H \u27e9 \u27e8 H $ .  $  H \u27e9 \u27e8 V $ .  $  V \u27e9 \u27e8 H $ .  $  V \u27e9 \u27e8 V $ . 

+  0.7104  −0.0313  −0.0313  0.0059 
−  0.0045  −0.0004  −0.0004  0.0078 
Null  0.2663  −0.0018  −0.0018  0.0051 
Outcome .  $  H \u27e9 \u27e8 H $ .  $  H \u27e9 \u27e8 V $ .  $  V \u27e9 \u27e8 H $ .  $  V \u27e9 \u27e8 V $ . 

+  0.7139  0.0025  0.0025  0.0026 
−  0.0055  0.0001  0.0001  0.0066 
Null  0.2680  0.0009  0.0009  0.0034 
Outcome .  $  H \u27e9 \u27e8 H $ .  $  H \u27e9 \u27e8 V $ .  $  V \u27e9 \u27e8 H $ .  $  V \u27e9 \u27e8 V $ . 

+  0.7139  0.0025  0.0025  0.0026 
−  0.0055  0.0001  0.0001  0.0066 
Null  0.2680  0.0009  0.0009  0.0034 
APPENDIX E: DERIVATION OF EQ. (A3)
To do this, we will find an analytic solution to the SDP in Eq. (A1) of Appendix A. We proceed in Sec. 1 of Appendix E by first simplifying this SDP into an equivalent form, by exploiting the symmetry present in the assemblages held by each Bob. Using the same symmetries, its dual program is also given. Then, we begin Sec. 2 of Appendix E by conducting extensive numerical tests to guide an ansatz for the primal variables which achieve $ \epsilon \u22c6$, as a function of α and N in I. We further discuss the equation in Sec. 3 of Appendix E, providing tight lower bounds on it. In Sec. 4 of Appendix E, we formulate an ansatz for the dual program. This section of the Appendix concludes by showing that these ansatzes achieve the same value in Sec. 5 of Appendix E, and therefore are optimal.
1. Simplifications
Recall that the set of probability distributions $ { D ( a  x , \lambda )} \lambda $ which encode the LHS constraints map x to all outcomes, both null and nonnull. There are $ 3 3 = 27$ such distributions, and as many operators $ { \sigma \lambda } \lambda $ over which the objective function must be maximized. To reduce the dimension of this search space, we make some observations.
EC representative .  Cardinality .  x = 0 .  x = 1 .  x = 2 . 

σ_{0}  4  +1  +1  +1 
σ_{1}  4  +1  +1  $\u2205$ 
σ_{2}  1  +1  $\u2205$  $\u2205$ 
σ_{3}  4  −1  +1  +1 
σ_{4}  4  −1  +1  $\u2205$ 
σ_{5}  1  −1  $\u2205$  $\u2205$ 
σ_{6}  4  $\u2205$  +1  +1 
σ_{7}  4  $\u2205$  +1  $\u2205$ 
σ_{8}  1  $\u2205$  $\u2205$  $\u2205$ 
EC representative .  Cardinality .  x = 0 .  x = 1 .  x = 2 . 

σ_{0}  4  +1  +1  +1 
σ_{1}  4  +1  +1  $\u2205$ 
σ_{2}  1  +1  $\u2205$  $\u2205$ 
σ_{3}  4  −1  +1  +1 
σ_{4}  4  −1  +1  $\u2205$ 
σ_{5}  1  −1  $\u2205$  $\u2205$ 
σ_{6}  4  $\u2205$  +1  +1 
σ_{7}  4  $\u2205$  +1  $\u2205$ 
σ_{8}  1  $\u2205$  $\u2205$  $\u2205$ 
2. Constructing the ansatz: Primal
The SDPs above can be straightforwardly solved, given fixed numeric values of α and N, using standard solvers. We will go one step further and derive a closedform equation that explains the behavior of $ \epsilon \u22c6$ as a function of α and N, permitting us to take limits of the parameters analytically. To do this, we will be guided by numerical simulations to construct primal and dual sets of variables, which are both valid (feasible) and achieve the same values for the primal and dual objective functions, respectively. That is, they are solutions with zero duality gap and are thus optimal.
The main difficulty is that the primal problem takes into account all ECs of strategies for Alice, some of which are not used by her when the optimal value of $ \epsilon \u22c6$ is obtained. Here, and below, a $ \u22c6$ denotes a primal or dual variable that is optimal. To construct an ansatz for primal variables, we first find the classes c for which we can expect $ \sigma c \u22c6 = 0$. To this end, we examine all families of solutions to (E17) for which subsets of the operators σ_{c} are set to zero—or, equivalently, omitted from the problem formulation. To begin, we observe that σ_{8} represents the strategy for which null outcomes are always announced, so we set it to zero. For the remaining eight equivalence classes of strategies, there are $ 2 8 = 256$ such combinations to consider. For each of these, we fix N = 2 and perform a sweep over $ 0 < \alpha \u2264 2 / 3$, solving the SDP for each value of α. These results are shown by the gray points in the left subfigure in Fig. 7. The solution to the original problem (E17) is reproduced exactly by the simulations for which $ \sigma 0 = \sigma 4 = \sigma 7 = 0$, and $ Tr [ \sigma i ] > 0$ for all others.
3. Tight lower bounds on $ e \alpha , N$
Here, we provide tight lower bounds on $ e \alpha , N$, for two reasons. The first is to justify the statement regarding the minimum efficiency being obtained in the singular limit $ \alpha \u2192 0$. Second, will require $ e \alpha , N > 1 / 2$ for the ansatz of the dual variables to be welldefined below.
4. Constructing the ansatz: Dual
Note that have not yet shown that this choice of primal variables is optimal. The set of primal variables achieving the objective value in Eq. (E39) above are only one feasible set of variables, i.e., they satisfy the constraints of the primal problem. However, we can prove optimality by analyzing the dual program and constructing a set of dual variables for which the dual objective function is equal to the primal objective function above. In other words, they will form a primal/dual pair with zero duality gap and are thus optimal.
5. Certifying optimality
APPENDIX F: HYPOTHESIS TESTING
Denote $ \theta \u2192$ the vector of all the unknown parameters to be estimated, and D the experiment data obtained. Suppose there are altogether R different measurement settings, accounting for different POVM groups and different initial states. The rth POVM group has a total measurement shots S_{r} for O_{r} different outcomes, with the occurrence statistics $ D \u2192 r : = ( D r 1 , D r 2 , \u2026 , D r O r )$. Hence, $ S r = \u2211 i = 1 O r D r i$.
Given D, one can use certain algorithm to obtain an estimation $ \theta \u2192 \u0302$. Then, the natural question is, to what degree is $ \theta \u2192 \u0302$ consistent with D? This is usually answered by performing hypothesis testing in statistics. More specifically, in our measurementbased scenario, we need to do a multinomial test^{47} as follows.
Now a likelihood ratio test can be done as $ LRT r : = p ( D \u2192 r  H 0 ) / p ( D \u2192 r  H 1 )$. Assume H_{0} is true, then asymptotically ( $ S r \u2192 \u221e$) the distribution of $ \u2212 2 \u2009 ln ( LRT r ) = \u2212 2 \u2211 i = 1 O r D r i \u2009 ln ( f r i / p r i MLE )$ converges to the $ \chi 2$ distribution with $ O r \u2212 1$ degrees of freedom. Since measurements from different measurement settings are independent, we can employ the additivity of $ \chi 2$ distribution to assert that $ \u2211 r = 1 R \u2212 2 \u2009 ln ( LRT r ) = \u2212 2 \u2211 r = 1 R \u2211 i = 1 O r D r i \u2009 ln ( f r i / p r i MLE )$ should asymptotically follow the $ \chi 2$ distribution with $ \u2211 r = 1 R ( O r \u2212 1 )$ degrees of freedom, when H_{0} holds. One can thus select a significance level $ s \alpha $ to decide whether H_{0} will be rejected, based on the calculated value of $ \u2211 r = 1 R \u2212 2 \u2009 ln ( LRT r )$.
For our assemblage tomography part, $ \u2211 r = 1 R ( O r \u2212 1 ) = \u2211 r = 1 108 ( 6 \u2212 1 ) = 540$ and its significance level $ s \alpha = 5 %$ corresponds to the critical region $ \u2211 r = 1 R \u2212 2 \u2009 ln ( LRT r ) \u2265 595.1683$, while our tomography result gives $ \u2211 r = 1 R \u2212 2 \u2009 ln ( LRT r ) = 572.0617$. Hence, the null hypothesis is accepted, and our tomography result matches the data.
APPENDIX G: EXPERIMENTAL DETAILS
The experiment, Fig. 2, uses two sources of single photon pairs based on the design of Ref. 41. One source provides a tunable entangled twoqubit state $  \Psi \alpha \u27e9$ and the other the single qubit state $  0 \u27e9$ (with the fourth photon detected to herald the photon that encodes the single qubit). We use a 775 nm wavelength Ti:sapph pump laser with 1 ps pulse length and 80 MHz repetition rate. The pump is split on a 50:50 beam splitter. The resulting beams are used to pump two 15 mm long periodically poled potassium titanyl phosphate crystals with approximately 100 mW pump power per crystal, each resulting in degenerate typeII spontaneous parametric downconversion at telecom wavelength.
In each protocol run, the entangled state $  \Psi \alpha \u27e9$ is shared between Alice and one other trusted party, and the third party receives the $  0 \u27e9$ state. For each quantum state with a different value of α, approximately $ 7.5 \xd7 10 4$ runs are performed—a run being an event where both trusted parties and the heralding detector detect a photon. Our average data collection rate was 231 trials per second. Of those runs, in approximately half $ ( 0.53 \xb1 0.05 )$ of the cases, Bob 1 receives part of the entangled state, and in the other cases, Bob 2 does. The swap operation, which determines whether Bob 1 or Bob 2 receives half of the entangled state, is implemented by a linear translation stage that moves mirrors into the beam paths, redirecting their spatial modes.
Each of the three parties can perform projective measurements using automated quarterwave and halfwave plates, a polarizing beam splitter, and two superconducting nanowire singlephoton detectors (SNSPD). Alice's detectors, the only detectors whose efficiency directly impacts the protocol's success, have an efficiency of $ \u223c 90 %$.
The data for the experiment are recorded in 720s batches. A batch consists of the linear translation stage remaining in one position while Alice and the Bobs sequentially perform their measurements in a predetermined order. We then average the detection efficiency of our SNSPDs by repeating these measurements with the wave plates rotated to swap which detector receives which outcome of the POVMs. Alice's measurement settings come from an optimization routine (see Appendix A), and the Bobs perform tomographic measurements before moving on to the next combination of measurement settings. After each combination, the linear translation stage shifts (or does not shift) and measurement iterations begin again. The data files for each batch are summed to obtain the mixture, then organized into outcome groups between Alice and each of the Bobs, and we extract the heralding efficiencies ( $ \epsilon a , x$). We reconstruct the assemblages through conic optimization. From these assemblages, we use a SDP Eq. (A1) to calculate the cutoff efficiency for the trusted parties, $ \epsilon Bob 1 \u22c6$ and $ \epsilon Bob 2 \u22c6$.