## 3 Bell State Exchange Parity Protocol and Intrinsic Autocompensation
### BSEP Protocol with Polarization Modes  
To describe how the BSEP protocol works, without any loss of generality, and to avoid unnecessary repetition, we show the calculations only for polarization encoding. Let us then consider the following input state to the BMD:  
\[|L_{i}\rangle=\frac{1}{\sqrt{2}}(|1_{aH}1_{bV}\rangle+e^{i\theta}|1_{aV}1_{bH} \rangle), \tag{11}\]  
where the crucial point here is that the phase \(\theta=\theta_{A}-\theta_{B}\) can be set by [PERSON] and [PERSON]. [PERSON] chooses randomly the value of \(\theta_{A}\) from the set \(\{0,\pi\}\) and so does [PERSON] for \(\theta_{B}\). In this way, they change the exchange parity of the Bell state. After going through the device (see Figure 3a), that is, a beam splitter with matrix \(H_{\mathrm{c}}=\sqrt{iX}\), with \(X\) as the first Pauli matrix, the following state emerges at the output:  
\[ \begin{split}|L_{\mathrm{o}}\rangle=\frac{1}{2\sqrt{2}}[(1-e^{i \theta})|1_{aV}1_{bH}\rangle-i(1-e^{i\theta})|1_{aH}1_{bV}\rangle+\\ i(1+e^{i\theta})|1_{aH}1_{aV}\rangle+(1+e^{i\theta})|1_{bH}1_{bV }\rangle].\end{split}  \tag{12}\]  
Now, [PERSON] and [PERSON] have to assign bits to phase choices. A phase choice of 0 is bit 0, and a phase choice of \(\pi\) is bit 1. If they choose the same value, then the state (12) becomes  
\[|L_{\theta=0}\rangle=\frac{i}{\sqrt{2}}(|1_{aH}1_{aV}\rangle+|1_{bH}1_{bV} \rangle), \tag{13}\]  
and thus we have coincidences in either \(\mathrm{D}_{aH}\) and \(\mathrm{D}_{bV}\) or \(\mathrm{D}_{bH}\) and \(\mathrm{D}_{bV}\) detectors. If they choose a different value,  
\[|L_{\theta=\pm\pi}\rangle=\!\frac{1}{\sqrt{2}}(|1_{aH}1_{bV}\rangle-|1_{aV}1_{ bH}\rangle), \tag{14}\]  
and thus we have coincidences in either \(\mathrm{D}_{aH}\) and \(\mathrm{D}_{bV}\) or \(\mathrm{D}_{aV}\) and \(\mathrm{D}_{bH}\) detectors. We call the first case the no-bit-flip case and the second case the bit-flip case. The measurement is broadcast by [PERSON]. This endows the protocol with MDI robustness. When they announce a no-bit-flip coincidence, [PERSON] and [PERSON] write down the same bit, which can be 0 or 1. [PERSON] does not know what case it is, but [PERSON] and [PERSON] do, as they know their own choices. For the bit-flip case, one of them, say [PERSON], needs to flip their bit. In that case, from the outcome, [PERSON] cannot guess if the phase choice was \(\theta_{A}=0,\theta_{B}=\pi\) (bit 0 on the key) or \(\theta_{A}=\pi\) or \(\theta_{B}=0\) (bit 1 on the key). With these two pieces of information, the choice of phase and the measurement result, [PERSON] and [PERSON]  
Figure 3: Bell measurement devices. (**a**) Polarization (Innsbruck scheme), (**b**) codirectional modes, which are highly compatible with integrated optic devices, (**c**) collinear modes. In this case, the PBS role is performed by mode-sorting MZIs, consisting of regular MZIs with a Dove prism rotated 0 degrees in one of its arms. can write down a shared string of 0 and 1, while [PERSON], not privy to the phase choice, would have no information this way. Thus, it is essential that the phase modulators do not leak information outside [PERSON] and [PERSON]'s stations. Note that we assume [PERSON] and [PERSON] to be fully trustworthy; thus, we only have to worry about outside and not inside attacks, as happens in quantum protocols for comparison problems [34; 35], where [PERSON] and [PERSON] compete against each other in a sense. Here, in a QKD context, [PERSON] and [PERSON] are assumed to be fully harmless; they are legitimate parties and communicate over a public but authenticated quantum channel (and a companion unjammable classical channel), as is common in a QKD setting. For the case of [PERSON], it is untrusted for the measurement; that is, there is no need to make sure that the measurement devices are trusted at all. That is the main contribution of measurement device independence to the QKD field. Regarding other security aspects, as [PERSON] is untrusted only for the measurement, there is a possibility of the following individual attack on the input states.