# Your Code is 0000: An Analysis of the Disposable Phone Numbers Ecosystem

José Miguel Moreno  Universidad Carlos III de Madrid
Madrid, Spain
<EMAIL_ADDRESS>Srdjan Matic  IMDEA Software Institute
Madrid, Spain
<EMAIL_ADDRESS>Narseo Vallina-Rodriguez  IMDEA Networks Institute
Leganés, Spain
<EMAIL_ADDRESS>Juan Tapiador  Universidad Carlos III de Madrid
Madrid, Spain
<EMAIL_ADDRESS>
###### Abstract

Short Message Service (SMS) is a popular channel for online service providers
to verify accounts and authenticate users registered to a particular service.
Specialized applications, called Public SMS Gateways (PSGs), offer free
Disposable Phone Numbers (DPNs) that can be used to receive SMS messages. DPNs
allow users to protect their privacy when creating online accounts. However,
they can also be abused for fraudulent activities and to bypass security
mechanisms like Two-Factor Authentication (2FA). In this paper, we perform a
large-scale and longitudinal study of the DPN ecosystem by monitoring 17,141
unique DPNs in 29 PSGs over the course of 12 months. Using a dataset of over
70M messages, we provide an overview of the ecosystem and study the different
services that offer DPNs and their relationships. Next, we build a framework
that (i) identifies and classifies the purpose of an SMS; and (ii) accurately
attributes every message to more than 200 popular Internet services that
require SMS for creating registered accounts. Our results suggest that the DPN
ecosystem is globally abused for fraudulent account creation and access,
affecting all major Internet platforms and online services.

##  I Introduction

Originating in the late 1990s, Short Message Service (SMS) have experienced a
resurgence among online service providers (_e.g._ , Alphabet, Meta) to deliver
notifications, enable Two-Factor Authentication (2FA) and enhancing the
security of online accounts [33, 23, 15]. Online services using SMS-based 2FA
technologies assume that phone numbers are uniquely linked to an individual.
However, this assumption does not hold with Disposable Phone Numbers (DPNs).
DPNs are shared phone numbers that any individual can use to receive SMS
messages on a public website, so their metadata and content is published for
anyone to see. Users can take advantage of DPNs to register at online services
without giving their true personal phone number, either for privacy reasons or
to conduct fraudulent actions.

Despite its potential for abuse, the DPN ecosystem remains relatively
unexplored. The most recent prior systematic study of DPNs and their usage
dates back to 2018 [37], a time before the expansion in popularity of SMS-
based 2FA for web and mobile services. According to Duo Labs, 2FA usage has
increased from 28% in 2017 to 78% in 2021, becoming the preferred user
authentication method [8]. As a result, the key findings of [37] have become
obsolete.

These reasons, and their potential impact on web services, motivate us to
systematically measure and investigate the current DPN ecosystem and the
evolution of the purposes it supports in the context of 2FA. Specifically, we
seek answers to the following research questions: $(i)$ How widely used are
DPNs? $(ii)$ What services are sending messages to DPNs? And $(iii)$ What is
their potential for abuse? To answer these questions, we develop a methodology
to automatically gather and process a large-scale and longitudinal dataset
containing 70.95M messages received by 17,141 unique DPNs, collected over a
time span close to 12 months. Using this dataset, we make the following
contributions:

  1. $(i)$

Study on the usage of DPNs. We measure the volume of messages received by DPNs
over time. We find that these numbers receive collectively more than 1.4M
messages per week. A language analysis of message contents suggest a wide
international user base.

  2. $(ii)$

Service attribution. We develop a framework to accurately attribute an SMS
message to more than 200 popular global Internet services that require a
registered account. We observe in our dataset messages sent by online service
providers of all sectors, sizes, and geographical scope, including global
companies (_e.g._ , Uber, Facebook, Amazon, WhatsApp), security-sensitive
industries (_e.g._ , banking), and services developed by smaller and more
geographically localized organizations (_e.g._ , Paytm in India).

  3. $(iii)$

Measuring the potential for abuse. We develop a framework to infer and
classify the purpose of an SMS as a proxy to measure their potential for
abuse. We observe that nearly 80% of messages contain a One-Time Password
(OTP), a single-use link, or both. This figure presents a significant increase
with respect to the trend reported in the 2018 measurement [37], where this
metric was at 67.6%. As these messages are closely related to 2FA processes,
we hypothesize that DPN usage is closely related to anonymity or account
fraud.

Our findings suggest that the DPN ecosystem is an expanding and thriving
field, and that the global SMS-based 2FA industry is oblivious to—or chooses
to ignore—potential account abuses arising from it.

Ethics issues and dataset release. The dataset gathered and analyzed in this
study might contain sensitive data since it involves phone numbers that, due
to number rotation, might have belonged in the past or might belong in the
future to a real user, and also SMS messages that can potentially contain
personal data or access credentials. We obtained approval from our IRB to
conduct this study provided that $(i)$ we make no efforts to deanonymize the
data in a way that could facilitate linking messages to actual users; $(ii)$
we inform affected parties in case that any security or privacy concerns are
identified during the study; $(iii)$ we do not use the collected data for any
secondary purposes other than the scope of this study; and $(iv)$ we share the
dataset on demand with other researchers provided that they agree on using it
for research purposes and under conditions similar to those described above.
CSV files with the list of analyzed gateways and the services found in the
messages are available at https://github.com/josemmo/your-code-is-0000.

##  II Background

Disposable Phone Numbers (DPNs) are publicly available phone numbers offered
by Public SMS Gateways (PSGs), or simply gateways. DPNs allow receiving
messages from a wide catalog of international phone numbers without the need
for a SIM card. PSGs are usually free services that do not require registering
an account, so multiple users can simultaneously use the same DPN at any time.
However, there are gateways offering “premium” DPN services that require a
single-use payment to read the most recent messages.

The SMS messages received by a DPN are compiled in an inbox. Depending on the
gateway offering the service, some inboxes have a smaller capacity than
others. For example, some only list the latest 30 messages while others index
all messages received over the last months. SMS messages published in an inbox
typically have four attributes:

  * •

Receiver. The international number of the message recipient.

  * •

Sender. The party that, allegedly, sent the message. Typically, the sender is
an online service (_e.g._ , Amazon or WhatsApp) that sends automatically-
generated messages. This data can be displayed as an international phone
number, a short code [47] or a sender ID [9]. We note that PSGs providing the
sender data in the form of short code or string sender ID may be incorrect due
to their dependency on poorly implemented or maintained Caller ID Lookups [2].

  * •

Reception timestamp. The date and time when the message was received. It is
displayed as a date string using the timezone of the gateway’s server (_e.g._
, “1st Jan 2022, 12:34 pm”) or as a relative timestamp (_e.g._ , “12 hours
ago”). The latter format allows accurately determining the date when an SMS
message was received but not its time.

  * •

Content. The actual payload of the SMS, often containing OTP codes and Single-
use Links. OTPs are short numeric codes that are sent to the user of an online
service to verify its identity or confirm an action by inputting the code in
an application. Typically, these codes are 4 to 6 digits long with dashes or
spaces to make them more readable. Single-use links are the equivalent to OTPs
in the form of URLs, but instead of inputting a code, the user is expected to
click and visit the link. Some gateways redact their text content to remove
numeric codes.

##  III Related work

Reaves _et al._ conducted in 2016 the first large-scale study of the DPN
ecosystem [36]. Their work analyzed 400 DPNs in 28 countries and showed how
PSGs contribute to online account fraud. The authors conducted a follow up
study in 2018 that doubled the size of its dataset but they did not observe
any discernible change in the ecosystem [37]. Thomas _et al._ conducted a
longitudinal analysis of Phone-Verified Accounts (PVAs) underground sellers
and their infrastructure, proposing multiple strategies that service operator
can leverage to combat fake accounts [40]. In 2019, Hu _et al._ measured
Disposable Email Services (DEA) [21], which share commonalities with DPN as
both services can be abused for verifying and managing online accounts.
Dmitrienko _et al._ carried a study on multiple Two-Factor Authentication
(2FA) schemes and weaknesses in their implementation, showing how malware can
intercept messages with single-use codes [11]. Following the same research
line, Lei _et al._ investigated how to exploit Android APIs to steal OTP codes
sent through SMS [27].

##  IV Methodology

This section describes our methodology to identify and crawl the PSGs, and the
post-processing techniques used to parse and analyze the messages. Figure 1
provides an overview of our pipeline.

Figure 1: Our pipeline for identifying PSGs, crawling messages and post-
processing of data. For language detection, arrows with full lines (green)
indicate passed check, while dashed lines in (red) denote a check that failed.

###  IV-A PSGs Identification

To compile a recent and global list of widely used PSGs, we leverage two
complementary methods:

  1. $(i)$

PSGs extraction from the Tranco list. Using the Tranco top-3M list111
Generated on the 14th of June, 2021. Available at https://tranco-
list.eu/list/NK2W.  [26], we perform an initial automated token-based search
to find possible PSGs using the Python library WordSegment [24] and keeping
the entries matching a set of predetermined keywords.222 sms, msg, number,
numbers, phone, free, get, receive, online, temp, otp, inbox, virtual, verify,
verification and code.  This method identifies 17 sites offering DPN services,
15 of which are still indexed by Tranco as of Dec. 2022.

  2. $(ii)$

PSGs extraction from search engines. Some gateways are accessed exclusively
through mobile apps instead of websites, so they are likely missed by Tranco.
We leverage Google’s search engine to increase our coverage using the same set
of keywords. This step reveals 12 more gateways, 3 of which are offered by
apps published on Google Play.

We manually review each candidate to discard unrelated, parked or expired
domains. Additionally, we also remove PSGs which $(i)$ are stale and had not
received a single message in months; $(ii)$ are copies of another gateway
belonging to the same provider; or $(iii)$ are aggregators that harvest and
publish messages from other gateways. We note that aggregators are easy to
identify because they contain duplicate DPNs that appear in other PSGs, and
they publish messages at a slower rate compared to the original source.

###  IV-B Messages Collection

We use a purpose-built Chromium-based crawler instrumented with Playwright
[13] to fetch the DPNs and their messages for each gateway identified in the
previous step. We use an actual web browser instead of a simpler and easier-
to-maintain script because some PSGs need to run JavaScript code on the
client-side to properly render webpages. For those cases, sending crafted HTTP
requests and parsing their responses is not enough. The PSGs accessible
exclusively through Android mobile apps are implemented as WebViews, and we
observe their traffic to find the HTTP requests that fetch the DPNs from the
remote server. Then, we crawl these gateways with our purpose-built crawler,
sending HTTP requests using the fetch Web API [30]. This approach allows us
not having to maintain two separate codebases.

As mentioned in Section II, some PSGs keep a copy of all received message for
a long time, while others only show the latest $n$ messages. To minimize the
number of messages that might get lost, we crawl PSGs at different sampling
periods. We fine-tune the crawler using the reception timestamp of the oldest
message in an inbox and the popularity of the gateway. We periodically adapt
the crawling rate to guarantee that we do not miss too many messages in case a
PSG starts receiving more traffic. Due to the lack of unique message IDs, we
assign our own identifier to messages. The identifier we use is a composite
key formed by the receiver (_i.e._ , DPN), the sender, the reception timestamp
and the text content. Thanks to this identifier, we can track DPNs and
messages across different PSGs to detect and remove duplicates.

###  IV-C Language and Service Identification

A DPN can receive messages from online services with a global user base, and
also from other regional ones. For this reason, we first need to detect the
message language.

Language Detection. Guessing the language of short messages is an open
research problem [5]. We first normalize the message to remove punctuation,
duplicate spaces and other defects (_e.g._ , corrupted Unicode characters),
and then automatically assign the language to those messages that contain
highly distinctive substrings (_e.g._ , “verification code”) or use Unicode
characters [44] unique to world languages (_e.g._ , the Modi script in Hindi).
If this process fails, we use the JavaScript franc library [48] to determine
the language.

Sending Service. Gateways often include the service name as the “sender” from
a given message, but this information might be inaccurate due the presence of
services with outdated Caller ID Lookups. We choose to use our own list of
keywords to map a message to the associated service. To extract the keywords,
we $(i)$ normalize the message text and remove diacritics using the Normal
Form Decomposition (NFD) [45], $(ii)$ tokenize the content separating by
whitespace and add the unigrams as keywords, and $(iii)$ use the unigrams to
generate bigrams and add them as keywords as well. Then, two of the authors
manually analyzed the list of the top-10k most frequent keywords and flagged
those that were service names or strictly related (_e.g._ , branded domain
names, mottos). After this process, we end up with a list of 1.7k meaningful
keywords and 212 unique services. We note our keyword-based approach might
incorrectly attribute a message to a service if its text contains the service
name but it was not sent from the particular service. To limit the number of
wrongly attributed services, we iterate over the keyword-flagging process to
create more specific keyword-matching rules for the services with most
mislabels. We measure the accuracy of our service classifier by manually
labeling a sample of 4k randomly selected messages, offering an accuracy of
99.10%. Most mislabels are attributed to false negatives (_i.e._ , messages
from a known service but tagged as “unknown”) in 0.78% of cases.

###  IV-D Purpose Identification

We use a hierarchical divisive clustering to group message into patterns that
correspond to activities on an account for a given service. In the first
phase, we group messages depending on the associated service and we normalize
the message content. To generate the normalized version of the message, we
remove multiple whitespaces and punctuation characters, perform stemming, and
filter any stopword or token with less than two characters. Next, we replace
all IBANs, URLs, email addresses, IP addresses, numeric codes and timestamps
found in a message with a fixed pattern. These patterns or identifiers often
appear in notification messages informing of user activity, and can be easily
detected using regular expressions due to their structured format.

We replace each identifier with a pattern that captures the identifier type
and length. For example, an URL with 36 characters is replaced with “URL{36}”,
and a sequence of 4 digits becomes “NUMERIC{4}”. Once this process is
completed, we use the identifiers to group messages into clusters. Since a
message might contain multiple identifiers, our clustering algorithm
prioritizes longer identifiers (_e.g._ , a message with “URL{36}” and
“URL{20}”, will be assigned to the cluster “URL{36}”) and those that better
capture the purpose of the message (_e.g._ , an IP address is usually more
representative than a generic numeric code). For the priorities, we follow the
same order we use to introduce the identifiers.

We tokenize the normalized messages on the whitespaces and then calculate a
fingerprint of the message using SimHash [29]. We leverage the Hamming
distance to compare hashes given a similarity threshold [28], which determines
the number of bits that can differ among two near-duplicates to be considered
similar. We empirically chose a threshold of 10 with 64-bit hashes after
experimenting with different values and validating the results against a
ground truth of 10k randomly-selected normalized messages.

Lifecycle of an Account. Once a user has provided a phone number to a service,
the provider can send messages to notify the user about events associated to
their personal account during their lifecycle. We label messages with a tag
that captures the type of account activity or purpose following the NIST SP
800-63B standard. This specification provides technical guidelines to agencies
for the implementation of digital authentication [19]. Each one of the
resulting purposes are tied to a particular stage in the lifecycle of an
account: $(i)$ creation (a new account is created on the service), $(ii)$
verification (the service requests the user to verify his identity), $(iii)$
activity (the service notifies of user-performed actions or important events),
$(iv)$ update (the user’s personal data on the service is modified), and $(v)$
recovery (the service detected an attempt to recover access to an existing
account).

Automated Message Labeling. After defining the categories of purposes to
monitor, we randomly select 6,429 message clusters and manually assign one
category to each. To identify the best label for the cluster, we leverage the
normalized version of the messages with the highest number of occurrences. By
manually inspecting each message, we label the cluster using one of the five
purposes defined above. We also use the message content to generate patterns
that can identify other messages serving a similar purpose. In the final step,
we apply the obtained patterns to automatically infer the purpose of all
messages (and clusters) in our dataset. To evaluate the accuracy of our
automated labeling technique, we randomly select 1k clusters and pick the
content of the normalized message with the highest number of occurrences to
confirm whether the assigned label is correct. We observe that our approach
selects the right label in 91.3% of the cases being the most common sources
for mislabeling tokens such as “activity” (7.8% of the cases) or
“verification” (0.32%).

##  V Ecosystem Characterization

Figure 2: Daily volume of messages, active DPNs and online PSGs.

We collect 70,951,728 messages from 17,141 unique DPNs offered by 29 different
PSGs over a period close to 12 months. We note that the number of gateways
decreased over time as some went offline or stopped publishing new messages.
For reference, the previous measurement from 2018 collected a dataset of 900k
messages across 28 months [37]. Figure 2 shows the number of SMS messages,
active DPNs, and online PSGs observed daily. While the weekly count of
received messages is roughly stable, there are two major events on August and
October 2021 where the daily count is considerably lower than on any other
date, and a minor event on December. These events are unrelated to the DPN
ecosystem and were caused by network downtimes and infrastructure upgrades on
our side.

###  V-A Gateways

TABLE I: List of crawled PSGs.

Gateway | Crawl start | Days | DPNs | Prefixes
---|---|---|---|---
99dark.com | 2021-05-07 | 336 | 1,151 | 9
bfkdim.com | 2021-04-29 | 7 | 64 | 8
bulk-pva.com | 2021-04-30 | 240 | 3 | 2
cloakmobile.com | 2021-04-29 | 13 | 19 | 3
freebulksmsonline.com | 2021-04-28 | 345 | 501 | 4
freephonenum.com | 2021-04-22 | 351 | 10 | 2
getfreesmsnumber.com | 2021-04-27 | 337 | 907 | 20
onlinesim.io | 2021-04-22 | 351 | 769 | 28
receive-sms-online.com | 2021-04-29 | 66 | 7 | 3
receive-sms-online.info | 2021-04-21 | 352 | 369 | 20
receive-sms.com | 2021-04-28 | 345 | 58 | 2
receive-smss.com | 2021-04-20 | 353 | 420 | 37
receivefreesms.net | 2021-04-22 | 351 | 28 | 3
receivesms.cc | 2021-04-20 | 353 | 56 | 12
receivesms.co | 2021-04-23 | 350 | 41 | 11
receivesms.org | 2021-04-22 | 351 | 16 | 5
sms-online.co | 2021-04-21 | 295 | 5 | 5
sms-receive.com | 2021-07-02 | 95 | 5 | 1
sms-receive.net | 2021-04-23 | 350 | 247 | 17
sms-verification.online | 2021-05-06 | 337 | 22 | 4
sms.sellaite.com | 2021-04-26 | 347 | 12 | 1
sms.visatk.com | 2021-05-05 | 335 | 294 | 5
smsfinders.com | 2021-04-29 | 344 | 6 | 5
smsfree.cc | 2021-04-28 | 345 | 4,733 | 47
temp-sms.org | 2021-05-06 | 247 | 25 | 2
temp99.com | 2021-05-07 | 336 | 8,852 | 13
tempsms.net | 2021-05-10 | 326 | 12 | 2
virtnumber.com | 2021-04-30 | 343 | 66 | 13
www.spoofbox.com | 2021-05-10 | 333 | 8 | 8

Table I lists the PSGs that we crawled during our research, along with their
crawling period (in days), number of DPNs (_i.e._ , inboxes) and number of
different calling prefixes. The number of DPNs offered by PSGs offer on
average 645 DPNs that span across 5 different calling prefixes. However, we
find a high dispersion within these numbers, with “bulk-pva.com” having merely
3 DPNs as opposed to the more than 8k numbers offered by “temp99.com”. Both
gateways remained active for hundreds of days. Over the course of our work,
the number of PSGs slowly decreased as some stopped working properly (_i.e._ ,
receiving new messages), went offline or added protective measures like
CAPTCHAs or JS Challenges to prevent their sites from being crawled. In this
last case, we did not attempt to circumvent such measures for ethical reasons.

Although we did not perform a longitudinal analysis of the ecosystem, we
repeated the PSG identification process described in Section IV-A 18 months
after the initial run to find changes in the list of active PSGs.333 Using the
Tranco list generated on the 11th of December, 2022. Available at
https://tranco-list.eu/list/JX5LY.  As a result, we find 18 new gateways that
did not appear before either because they did not exist at the time or were
not popular enough. In addition, 14 gateways (half of the entries from Table
I) are no longer included in this last outcome. These changes suggest that
many PSGs in the DPN ecosystem are relatively volatile, with an approximate
1-year lifespan.

###  V-B DPN Dynamics

In Section II, we hypothesize that a DPN can appear in different gateways. We
confirm it by noticing that 9.1% of the DPNs in our dataset appear in more
than one PSGs. We attribute this behavior to DPN rotation and infrastructure
sharing (_i.e._ , DPN reuse).

DPN rotation. A typical PSG builds its DPN pool by $(i)$ acquiring and adding
to GSM boxes SIM cards from multiple mobile network operators; or $(ii)$
renting VoIP lines from third-party External Short Messaging Entity (ESME)
like Bandwidth.com [3] or Twilio [42] to handle the reception of messages.
PSGs often distinguishing between so called “real” (mobile lines) and
“virtual” numbers (VoIP lines) in their offerings.444 The receive-sms-
online.info gateway is an example of a website advertising numbers “based on
real SIM”. On the other hand, receive-sms.cc announces their DPNs as “virtual
phone numbers”.  VoIP lines can be rented and canceled at any time, either
manually or programmatically. The number can eventually be rented by another
provider.

DPN reuse. Some PSGs may share a considerable amount of DPNs that cannot be
explained by DPN rotation. We hypothesize that a given operator might reuse
the same infrastructure across different gateways under their management or
ownership. A clear case of this is the pair formed by 99dark.com and
temp99.com, where the former is the API endpoint for an Android app [41] and
the latter is a public website. Besides sharing 483 DPNs, other reasons
suggest that these two gateways are operated by the same group, such as
similar naming and contact information, and same DNS nameservers from
Cloudflare. Another not-so-straightforward case is the smsfree.cc gateway,
which has hundreds of DPNs in common with other seemingly unrelated PSGs, and
is used by (at least) a website [1] and an Android app [14]. The simplest
explanation is that smsfree.cc is a white-label API endpoint reused by many
platforms (both web and mobile ones) that lends its DPNs to other parties as
if it were a mobile carrier. However, given that this PSG also rotates DPNs
very frequently (sometimes even daily), it can also be the case that it
aggregates phone numbers from other gateways on purpose as soon as they become
available to rent.

DPN lifetime. Table II reports the lifetime (in hours or days) during which a
DPN is active. To determine the activity window, we calculate the amount of
time that passed between the first and the last time when a SMS is sent to a
particular DPN. We identify three main patterns: short lived DPNs (12%), phone
numbers that are active up to four weeks (58%), and DPNs that receive messages
for several months (29%). When inspecting the volume of messages that a phone
number receives, we find that it is usually proportional to the DPN lifetime.
We observe a similar trend both in the subset of messages sent by a service
known by our classifier (“Msgs. w/ service” row in Table II) and in the entire
dataset. Long-lasting DPNs tend to receive more messages, being responsible
for over 81% of the total messages that we collected. The scenario changes
when we check the total number of services for which we observe at least one
message. In this case, the breakdown depending on the DPN activity is
smoother, and phone numbers that were active for over one month receive
messages from only 11% additional services when compared to DPNs which are
active for less than one day.

TABLE II:  DPNs lifetime. Values for the mean and the quartiles (Q) are expressed in days except for entries marked with an asterisk (*), where the unit is the hour.  | <1d* | 1d - 1w | 1w - 1m | >1m | Any
---|---|---|---|---|---
Mean | 8.04 | 3.61 | 18.30 | 149.77 | 51.71
Q1 | 2.89 | 1.86 | 11.27 | 42.36 | 5.05
Q2 | 6.17 | 3.35 | 18.03 | 70.37 | 17.59
Q3 | 11.56 | 5.32 | 26.42 | 134.16 | 35.53
DPNs | 2,097 | 2,943 | 6,943 | 4,908 | 16,891
Messages | 279k | 2.1M | 10.7M | 57.8M | 70.9M
Msgs. w/ service | 96k | 798k | 4.3M | 32.1M | 37.3M
Services | 188 | 199 | 211 | 212 | 212

The lifetime distributions that we observe have some implications. First, we
notice services being associated with DPNs as soon as the phone number becomes
available in a gateway. This might be a possible indicator of abuse and we
explore it further in Section VI-B. Second, DPNs with a long lifetime
unnecessarily expose users to higher privacy and security risks. This is the
case for services that leak Personally Identifiable Information (PII) such as
email addresses or usernames in the SMS they send. While some gateways only
display the messages received in the last 24 hours (see Section II), others
provide access to historical information. The lifetime of a DPN does not only
increase the time window in which scammers can collect sensitive information,
but it exposes users to other risks. An attacker that harvests login
information by scraping DPN messages can attempt to perform an account
takeover if the DPN is still active and is used as a recovery mechanism for
accessing an account. Alternatively, the DPN can be abused to discover
previously unknown user credentials, in case a service uses SMS messages
during the procedure of recovering forgotten usernames and email addresses.
Lastly, we notice that if we merge into a single class the two sets of short-
lived DPNs (_i.e._ , those that live up to one week), the resulting set of
5,040 numbers received at least one message from all the services that we
monitor. This suggests that the 212 services that we monitor are extremely
popular and widely used across different countries.

Figure 3: Time-to-First-Message per service grouped by service category.

###  V-C Country and Language Diversity

The international scope of our analysis requires us dealing with DPNs
receiving messages in any language. We use the international phone number
prefix of a DPN to associate it to a country (_e.g._ , “+44” is the
international code for the United Kingdom). This allows us to locate DPNs in
57 different countries. Using the language detection method described in
Section IV-C, we identify up to 31 languages in our dataset. The diversity of
languages we find suggests an international demand for DPN services. With our
approach, we could not conclude the language in merely 4.9% of the messages
either due to their short length and the presence of ambiguous words (_e.g._ ,
“Code: 0000”). Unsurprisingly, English is the most prevalent language in our
dataset, accounting for over 75% of the messages, followed by a long tail of
other languages such as Indonesian (3.0%), French (2.9%), Portuguese (2.8%),
Spanish (2.1%), Arabic (1.7%), Chinese (1.6%), and Russian (1.0%). We do not
find a 1-to-1 mapping of languages and countries where this language is
spoken. For example, only 30% of German-written messages are sent to DPNs with
the German international call prefix. Instead, we see messages being sent
globally regardless of their language. This global scope is clearly
appreciable for English messages, half of which are sent to non-English
speaking countries.

###  V-D OTPs and Single-use Links

In their 2018 study, Reaves et al. [37] found that 67.6% of the messages sent
to DPNs contained a code or OTP, thus concluding that receivers were being
used for account verification and user authentication [36]. In this paper, we
extend this methodology and distinguish between Single-use Codes (_i.e._ ,
OTPs) and Single-use Links. We find OTPs are still on the rise, with 77.02% of
messages containing them. Single-use Links are less popular, being present in
just 2.18% of messages, followed by 0.80% offering both an OTP and a link.
Given that only 14M messages in our dataset (20%) have neither of these
single-use means, and that sending services use them to verify authenticated
actions (_i.e._ , that require user intervention), we conclude that DPNs are
predominantly being used to create accounts on online platforms.

###  V-E Malicious URLs

After discarding the aforementioned Single-use Links, we end up with 451,165
messages that contain a URL. These amount to 178k unique URLs after removing
duplicates. In an attempt to find malicious or harmful URLs in messages sent
to DPNs, we use the Google Safe Browsing API [17] to identify web resources
flagged as phishing, malware or spam. To account for shortened links, we
expand their URLs before checking them against Safe Browsing’s database. This
expansion is performed by sending an HTTP request to the shortened URL and
retrieving the final “location” header without effectively loading the
contents of the destination website. We use a list of publicly-known shortener
services to determine which items need to be expanded.555 See
https://github.com/boutetnico/url-shorteners.

With this pipeline, we find merely 41 URLs spread across 125 messages that are
considered harmful by Google. All of them fail in the “social engineering”
category. Most malicious URLs appear to be either Apple-related scams or
phishing campaigns targeting banks.

##  VI Analysis of Services

This section presents the analysis of the services found sending SMS to DPNs.
Our analysis focuses on answering two questions: $(i)$ whether DPNs are
actually being used for creating accounts on online services, and $(ii)$
measuring their potential for abuse. Given the technical limitations of
qualitatively analyzing all 70M messages in our dataset (which includes a long
tail of small and lesser known services), we focus on the subset of 46,041,215
entries only containing SMS from the top 212 services. We still consider it a
representative subset of the ecosystem as it is an order of magnitude larger
than the whole dataset from the previous study [37]. As mentioned in Section
IV-C, this list of services is based on the most occurring keywords found in
our dataset.

Table III lists the top-10 online sending services with more messages to DPNs.
We find lesser-known —yet demanded— services like DENT [10] (which offers free
mobile phone lines), regional operators like Disney+ Hotstar [34] (an Indian
streaming platform recently acquired by The Walt Disney Company), and well-
known companies with a global userbase (_e.g._ , Uber, WhatsApp). Services
like Google, Netflix, Telegram and Tinder are not included in Table III
because, individually, they account for less than 1.5% of the total number of
messages. In fact, there is a long tail of sending services in the DPN
ecosystem. We find examples of companies operating in a particular country or
world region (_e.g._ , Smood [38] and Careem [7], a mobility app from Uber
used in the Middle East) and recognized names in the Finance (_e.g._ , HSBC,
Chase, Citibank), Telecommunications (_e.g._ , AT&T, Deutsche Telekom,
Overbit) and even Public Administration (_e.g._ , NHS, government agencies
from Spain and India) sectors.

TABLE III: Top services by volume of messages. Service | Category | Messages | DPNs
---|---|---|---
Uber | Transportation | 10.2% | 58.2%
DENT | Communications | 8.4% | 4.1%
Facebook | Social | 3.7% | 77.2%
WhatsApp | Communications | 2.8% | 69.3%
Instagram | Social | 2.8% | 68.2%
PayPal | Finance | 2.6% | 45.0%
Amazon | Shopping | 2.6% | 69.3%
Shopee | Shopping | 2.5% | 12.1%
Disney+ Hotstar | Entertainment | 2.5% | 0.292%
TikTok | Social | 1.5% | 72.5%
Other | N/A | 35.1% | 99.8%

Overall, we find the top services by volume account for 65% of all messages
received by DPNs and offer an ample range of services, including Social Media,
Entertainment, Education, and even sensitive ones such as Telecommunications
and Finance. Globally-known services like TitTok, Facebook, WhatsApp and
Amazon have their messages spread across more than half of all DPNs.
Conversely, highly localized services like the aforementioned Disney+ Hotstar
have a higher density of messages that concentrate in just 50 DPNs, 41 of
which have an Indian country prefix. DENT is an interesting case, as it is the
second service with most messages sent to DPNs yet it only appears in 694
receivers from 45 different countries. If we sort by DPN coverage, we find two
online services with more than 10k receivers that do not appear in Table III
as they each account for less than 0.50% of messages. These services are Bigo
Live [4] and Kwai [25], two social media platforms similar to TitTok
functionality-wise. The median number of services that appear in a DPN is 40,
with a maximum of 167 services (covering 78.7% of the known services lists).
All the DPNs we found in our dataset contain at least one service from the top
212.

###  VI-A Evidence of Usage

Given all the online services we labelled require users to create an account,
we can safely assume these messages are sent by the service as a consequence
of an action performed by the user (_e.g._ , registration, login, transaction
confirmation). Therefore, users must be registering accounts on online
services using DPNs in order for these messages to appear in our dataset.
Besides some exceptions like Google, most services make a 1-to-1 relation
between user accounts and phone numbers. In practice, this means that a given
phone number can only be tied to a single service account. For this reason,
and considering that DPNs are by definition shared between multiple users,
there is an incentive to register an account on a popular service as soon as a
DPN becomes available on a gateway.

To verify this dynamic, we measure how long it takes for an online service to
appear in a DPN, presumably as a direct result of an account registration or
recovery (_i.e._ , re-verification) event. Figure 3 provides boxplots for each
service grouped by category. These boxplots represent the Time-to-First-
Message (TTFM) since the DPN was first seen in a gateway until a message from
a given service was received. We find a considerable amount of services,
especially in the telecommunications category, have a median TTFM shorter than
24 hours (colored area in the chart).

###  VI-B Potential for Abuse

Figure 4:  DPNs with the longest bursts of account-related messages grouped by
service. X axis shows days, while every row in the Y axis plots the messages
for a given DPN. Gray pixels show the lifespan of a DPN.

We also analyze the rate at which messages from a specific service are being
sent to a given DPN. As discussed in Section VI-A, for a service message to
appear in a DPN, a user must have previously performed an action that
triggered the message. Because service messages involve manual interaction,
too many messages in a short period of time might be indicative of some sort
of automation. While we cannot conclude that the presence of automation is
always related to service abuse (_e.g._ , creation of bot accounts, fake
engagement [32]), it is definitely abnormal for a legitimate user to request
an OTP verification code or similar multiple times per hour on the same
account and for an extended time.

Figure 4 shows the services for which we detect long bursts of account-related
messages (_i.e._ , those having any of the purposes mentioned in Section IV-D
except “activity”). For each subplot, we pick the top 50 DPNs with the most
received messages and only color the days when a phone number received at
least 72 messages (roughly equivalent to 3 messages per hour). We also
represent as continuous gray lines the DPN lifespan. These services contain
DPNs with bursts that extend several days, meaning that some phone numbers
kept receiving more than 72 messages per day for more than 100 days straight.
In the case of Disney+ Hotstar and Sony LIV, we can attribute this behavior to
the two services being only available in India and to the scarcity of DPNs
with an Indian calling prefix. For DENT and Uber, we observe this dynamic
across a much larger pool of phones.

While there are legitimate uses for DPNs (_e.g._ , registering anonymously on
dating sites for privacy reasons), DPNs can also be abused to create fake
accounts either manually or using some automation tool as Figure 4 suggests.
In fact, many PSGs have banners promoting or advertising services offering
PVAs (_i.e._ , phone-verified online accounts available for sale on
underground sites, mostly for nefarious purposes like fake social engagement
[40]). We posit that a reasonable explanation for that is that the PVA
provider and the PSG is the same organization or they are affiliated in some
way.

##  VII Case Studies

We next present several cases of interest found in our dataset that illustrate
the potential for abuse of DPNs.

Free Trials. Oftentimes, popular services offer promotions or trials to new
users. DPNs allow users to register multiple accounts and obtain access to
features that would not be available beyond the trial period. For example, the
Indian online e-learning platform BYJU offered a free 1-to-1 class to newly
registered users [6]. Our dataset contains around 15k messages from this
platform, 7% of which are associated with activities, when the service
notifies of user-performed actions or important events. The remaining 92.5%
are either associated with “account creation” or “account verification”,
suggesting that users leverage DPNs to test the service or access features
that would not be available without paying a subscription.

Phone Chaining. One of the most interesting uses we see for DPNs is the
registration of private secondary phone numbers. This is a common practice in
the PVA ecosystem and it is usually known as phone chaining [40]. Some big
actors enabling this are DENT [10] (8% of the dataset are messages from this
service), Google Voice [18] and TextNow [39]. In fact, phone chaining is so
common in this ecosystem that more than 6K DPNs (36% of the dataset) have
been, at some point, registered in one or more of just the previous three
services. We also looked for popular mobile phone carriers outside the list of
top services and found evidence of new lines being registered online and then
their SIM cards being sent by mail. We have obtained evidence of such
practices even for carriers located in countries with registration laws
mandating Proof of Identity, such as Australia, India and France [20].

Finance. In this category we find cryptocurrency exchanges, FinTech (Financial
Technology) apps, and traditional banks. In all cases, we see messages
denoting successfully completed account creation and transactions. One of such
examples is Empower, a FinTech app that offers microloans. This service has
sent messages to at least 131 different DPNs in multiple occasions confirming
the deposit of funds, meaning that it can potentially be abused for loan
fraud. Outside the top 212 services list, we find users linking DPNs to bank
accounts to receive verification codes (_e.g._ , Citibank, HSBC, Barclays) and
even opening entirely new accounts, raising concerns for whether this complies
with Europe’s PSD2 Strong Customer Authentication (SCA) requirement [12]. We
found more than 100 DPNs registered against banks, although this figure is
probably a lower bound estimate as we have not thoroughly looked at this
matter nor is the focus of this study.

Healthcare. We find evidence of DPNs being used for registering to medical
services such as the British National Health Service (NHS) [31] or CoWIN
(India’s COVID-19 Vaccination Program) [22]. In both cases we find sensitive
information being sent over SMS after the user has registered to the service.
This includes secret single-use codes, COVID-19 test results and appointments
including their precise date and location. We also identify cases where the
names and surnames of the user are sent alongside the previous information.

Public Administrations. We find various types of SMS messages sent by
government agencies. While in most cases these are just innocuous
notifications, there are two cases that raise our attention. “Cl@ve” [16] is
an Identity Provider used to authenticate against the Spanish Public
Administration by sending an OTP code to a registered phone number with every
login attempt. The presence of this service in the dataset is concerning since
it is tied to a citizen or a registered company, and can be used to perform
sensitive procedures. We also encounter messages related to “Aadhaar,” India’s
ID system and the largest in the world [35], which also sends OTP codes when
logging in to banks and other online services [46].

##  VIII Conclusions

Online services have recently doubled down on their efforts to implement
account verification and 2FA flows, using SMS as one of the channels to
deliver these messages. In this paper, we show that the DPN ecosystem is
mostly being (ab)used for circumventing these security mechanisms without
needing a personal phone number. We also observe a significant increase in the
usage of DPNs for creating fake accounts since the last available measurement
from 2018, jumping from thousands of messages received per year to millions.
We find that operators of the PSGs offering DPNs seem to be, in some cases,
strongly tied to underground markets offering Phone Verified Accounts (PVAs).
We also find that online services do not have effective protections against
the abuses of this ecosystem: Both global well-recognized services (such as
Google and Facebook), banks, governments, and small brands send verification
messages to DPNs.

Future Work. Our keyword-based message classification shows a huge long tail
of services and purposes yet to be analyzed. Given the scale of the dataset, a
more in-depth automated analysis is needed to understand what trends lie in
this long tail. One interesting research challenge is the definition of
methodologies to identify DPNs and create effective blocklists to mitigate
their potential for abuse when accounts are created. A second aspect we plan
to explore in our future work is a detailed analysis of the messages with OTP
tokens, investigating both message senders and recipients. Across our dataset,
we observe nearly 80% of the messages with an OTP code. Fraudsters often abuse
these messages to artificially inflate traffic to a range of numbers
controlled by a single mobile network operator; in return, the mobile operator
shares with the fraudster a portion of the generated revenue [43].

## Acknowledgements

This research was supported by the AEI grant ODIO (PID2019-111429RB-C21 and
PID2019-111429RB-C22) and the Region of Madrid grant CYNAMON-CM
(P2018/TCS-4566), co-financed by European Structural Funds ESF and FEDER. José
Miguel Moreno was supported by the Spanish Ministry of Science and Innovation
with a FPI Predoctoral Grant (PRE2020-094224). Srdjan Matic was partially
supported by the Atracción de Talento grant (Ref. 2020-T2/TIC-20184), funded
by Madrid regional government, and the PRODIGY Project (TED2021-132464B-I00),
funded by MCIN/AEI/10.13039/501100011033/ and the European Union
NextGenerationEU. Narseo Vallina-Rodriguez was supported by a Ramon y Cajal
Fellowship (RYC2020-030316-I).

The opinions, findings, and conclusions, or recommendations expressed are
those of the authors and do not necessarily reflect the views of any of the
funding bodies.

## References

  * [1] Receive SMS Online.  https://receive-sms.cc/, 2022.
  * [2] Bandwidth Inc.  Caller ID Lookup/Caller Name Lookup.  https://www.bandwidth.com/glossary/caller-id-lookup/, 2022.
  * [3] Bandwidth.com.  Bandwidth - The universal platform for global enterprise communications.  https://www.bandwidth.com/, 2022.
  * [4] Bigo Technology Pte. Ltd.  Bigo Live – Live Stream, Go Live.  https://play.google.com/store/apps/details?id=sg.bigo.live, 2022\.
  * [5] Bishal Bishal and Jerome R. Bellegarda.  Language Identification from Very Short Strings.  https://machinelearning.apple.com/research/language-identification-from-very-short-strings, 2019\.
  * [6] BYJU’S.  BYJU’S – The Learning App.  https://play.google.com/store/apps/details?id=com.byjus.thelearningapp, 2022\.
  * [7] Careem Networks FZ-LLC.  Careem.  https://www.careem.com/, 2022.
  * [8] Chrysta Cherrie.  The 2021 State of the Auth Report: 2FA Climbs, While Password Managers and Biometrics Trend.  https://duo.com/blog/the-2021-state-of-the-auth-report-2fa-climbs-password-managers-biometrics-trend, 2021\.
  * [9] Billy Chia.  What is an Alphanumeric Sender ID?  https://www.twilio.com/docs/glossary/what-alphanumeric-sender-id, 2022.
  * [10] DENT Wireless Limited.  DENT – The world’s first digital & global operator.  https://www.dentwireless.com/, 2022.
  * [11] Alexandra Dmitrienko, Christopher Liebchen, Christian Rossow, and Ahmad-Reza Sadeghi.  On the (In)Security of Mobile Two-Factor Authentication.  In International Conference on Financial Cryptography and Data Security, 2014.
  * [12] European Commission.  Strong customer authentication requirement of PSD2 comes into force.  https://ec.europa.eu/info/publications/190913-safer-payment-services_en, 2019\.
  * [13] Pavel Feldman and open-source contributors.  Playwright.  https://playwright.dev/, 2022.
  * [14] Free Phone Number.  Receive SMS.  https://play.google.com/store/apps/details?id=com.receivesms.online, 2021\.
  * [15] Sergiu Gatlan.  Twitter employees required to use security keys after 2020 hack.  https://www.bleepingcomputer.com/news/security/twitter-employees-required-to-use-security-keys-after-2020-hack/, 2021\.
  * [16] Gobierno de España.  Cl@ve – Electronic Identity for the Administration.  https://clave.gob.es/, 2022.
  * [17] Google Developers.  Google Safe Browsing.  2022\.
  * [18] Google LLC.  Google Voice.  https://voice.google.com/, 2022.
  * [19] Paul Grassi, James Fenton, Elaine Newton, Ray Perlner, Andrew Regenscheid, William Burr, Justin Richer, Naomi Lefkovitz, Jamie Danker, Yee-Yin Choong, Kristen Greene, and Mary Theofanos.  Digital Identity Guidelines: Authentication and Lifecycle Management, 2020.
  * [20] GSM Association.  Access to Mobile Services and Proof of Identity 2020: The Undisputed Linkages.  https://www.gsma.com/mobilefordevelopment/wp-content/uploads/2020/03/Access_to_mobile_services_2020_Singles.pdf, 2020\.
  * [21] Hang Hu, Peng Peng, and Gang Wang.  Characterizing Pixel Tracking through the Lens of Disposable Email Services.  In 2019 IEEE Symposium on Security and Privacy (SP), pages 365–379, 2019.
  * [22] India’s Ministry of Health and Family Welfare.  CoWIN.  https://www.cowin.gov.in/, 2022.
  * [23] Vasu Jakkal.  The passwordless future is here for your Microsoft account.  https://www.microsoft.com/security/blog/2021/09/15/the-passwordless-future-is-here-for-your-microsoft-account/, 2021\.
  * [24] Grant Jenks.  WordSegment - Python Word Segmentation.  https://grantjenks.com/docs/wordsegment/, 2018.
  * [25] Joyo Technology Pte Ltd.  Kwai – Watch cool & funny videos.  https://play.google.com/store/apps/details?id=com.kwai.video, 2022\.
  * [26] Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczyński, and Wouter Joosen.  Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation.  In Network and Distributed System Security (NDSS) Symposium, 2019\.
  * [27] Zeyu Lei, Yuhong Nan, Yanick Fratantonio, and Antonio Bianchi.  On the insecurity of SMS one-time password messages against local attackers in modern mobile devices.  In Network and Distributed System Security (NDSS) Symposium, 2021\.
  * [28] Leon.  Simhash.  https://github.com/1e0ng/simhash, 2020.
  * [29] Gurmeet Singh Manku, Arvind Jain, and Anish Das Sarma.  Detecting Near-Duplicates for Web Crawling.  In Proceedings of the 16th International Conference on World Wide Web, WWW ’07, page 141–150, New York, NY, USA, 2007. Association for Computing Machinery.
  * [30] MDN contributors.  Using the Fetch API.  https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch, 2022\.
  * [31] National Health Service.  NHS App.  https://play.google.com/store/apps/details?id=com.nhs.online.nhsonline, 2022\.
  * [32] David Nevado-Catalán, Sergio Pastrana, Narseo Vallina-Rodriguez, and Juan Tapiador.  An analysis of fake social media engagement services.  Computers & Security, 124:103013, 2023.
  * [33] Lily Hay Newman.  Google Gets Serious About Two-Factor Authentication. Good!  https://www.wired.com/story/google-two-factor-authentication-default/, 2021\.
  * [34] Novi Digital Entmt.  Disney+ Hotstar.  www.hotstar.com/, 2022.
  * [35] Privacy Intl.  ID systems analysed: Aadhaar.  privacyinternational.org/case-study/4698/id-systems-analysed-aadhaar, 2021\.
  * [36] Bradley Reaves, Nolen Scaife, Dave Tian, Logan Blue, Patrick Traynor, and Kevin RB Butler.  Sending out an SMS: Characterizing the Security of the SMS Ecosystem with Public Gateways.  In IEEE Symposium on Security and Privacy (S&P), 2016.
  * [37] Bradley Reaves, Luis Vargas, Nolen Scaife, Dave Tian, Logan Blue, Patrick Traynor, and Kevin RB Butler.  Characterizing the security of the SMS ecosystem with public gateways.  ACM Transactions on Privacy and Security (TOPS), 22(1), 2018.
  * [38] Smood.ch.  Smood – Suisse Food Delivery.  https://play.google.com/store/apps/details?id=com.jamtech.marabel.smood, 2022\.
  * [39] TextNow, Inc.  Textnow.  https://www.textnow.com/, 2022.
  * [40] Kurt Thomas, Dmytro Iatskiv, Elie Bursztein, Tadek Pietraszek, Chris Grier, and Damon McCoy.  Dialing Back Abuse on Phone Verified Accounts.  In Conf. on Comp. and Comms. Security (CCS), 2014.
  * [41] TSOFT.  SMS Receive Phone Numbers.  https://play.google.com/store/apps/details?id=com.tsoft.moshnumbers, 2020\.
  * [42] Twilio.  Communication APIs for SMS, Voice, Video & Authentication | Twilio.  https://www.twilio.com/, 2022.
  * [43] Twilio.  SMS Traffic Pumping Fraud.  https://support.twilio.com/hc/en-us/articles/8360406023067-SMS-Traffic-Pumping-Fraud, 2022\.
  * [44] Unicode, Inc.  Glossary of Unicode Terms.  unicode.org/glossary/, 2021.
  * [45] Unicode, Inc.  Unicode Normalization Forms.  https://unicode.org/reports/tr15/, 2021.
  * [46] Unique Identification Authority of India.  Aadhaar Myth Busters.  https://uidai.gov.in/my-aadhaar/about-your-aadhaar/aadhaar-myth-busters.html, 2022\.
  * [47] Donnie Wang.  What is a Short Code?  https://www.twilio.com/docs/glossary/what-is-a-short-code, 2022\.
  * [48] Titus Wormer.  wooorm/franc: Natural language detection.  https://github.com/wooorm/franc, 2021.


# Proposal for Sequential Stern-Gerlach Experiment with Programmable Quantum
Processors

Meng-Jun Hu (gbsn胡孟军<EMAIL_ADDRESS>Beijing Academy of Quantum Information
Sciences, Beijing 100193, China  Haixing Miao (gbsn缪海兴)  State Key Laboratory
of Low Dimensional Quantum Physics, Department of Physics, Tsinghua
University, Beijing, China  Yong-Sheng Zhang (gbsn张永生)  Laboratory of Quantum
Information, University of Science and Technology of China, Hefei 230026,
China  Synergetic Innovation Center of Quantum Information and Quantum
Physics, University of Science and Technology of China, Hefei 230026, China
Hefei National Laboratory, University of Science and Technology of China,
Hefei, 230088, China

###### Abstract

The historical significance of the Stern-Gerlach experiment lies in its
provision of the initial evidence for space quantization. Over time, its
sequential form has evolved into an elegant paradigm that effectively
illustrates the fundamental principles of quantum theory. To date, the
practical implementation of the sequential Stern-Gerlach experiment has not
been fully achieved. In this study, we demonstrate the capability of
programmable quantum processors to simulate the sequential Stern-Gerlach
experiment. The specific parametric shallow quantum circuits, which are
suitable for the limitations of current noisy quantum hardware, are given to
replicate the functionality of Stern-Gerlach devices with the ability to
perform measurements in different directions. Surprisingly, it has been
demonstrated that Wigner’s Stern-Gerlach interferometer can be readily
implemented in our sequential quantum circuit. With the utilization of the
identical circuits, it is also feasible to implement Wheeler’s delayed-choice
experiment. We propose the utilization of cross-shaped programmable quantum
processors to showcase sequential experiments, and the simulation results
demonstrate a strong alignment with theoretical predictions. With the rapid
advancement of cloud-based quantum computing, such as BAQIS Quafu, it is our
belief that the proposed solution is well-suited for deployment on the cloud,
allowing for public accessibility. Our findings not only expand the potential
applications of quantum computers, but also contribute to a deeper
comprehension of the fundamental principles underlying quantum theory.

Keywords: Sequential Stern-Gerlach, Quantum circuit, Quantum processor

PACS: 03.65.Ta, 03.67.Ac, 42.50.Dv

##  I 1\. Introduction

The Stern-Gerlach (S-G) experiment, which was conducted in 1922, served as the
initial demonstration of the quantization of the magnetic moment SG1 ; SG2 ;
SG3 . Furthermore, this experiment played a pivotal role in paving the way for
modern atomic physics SG4 . Interestingly, it was only after the discovery of
spin spin0  that it became apparent the S-G setup was actually measuring the
electron spin spin1 . Since spin represents the most basic form of a two-level
quantum system, the S-G experiment and its sequential variant have been
extensively employed to elucidate the fundamental principles of quantum
mechanics, e.g., statevector, quantum superposition, and quantum entanglement
book1 ; book2 ; book3 . A spin that traverses two S-G devices consecutively,
each with different measurement directions as depicted in Fig. 1a, would yield
distinct outcomes depending on the alteration of the measurement order. This
significant deviation from classical theory serves as a clear demonstration of
the fundamental feature of quantum theory, namely, the non-commutation of
certain observables Dirac . The well-known Heisenberg uncertainty relation
arises from the non-commutativity of particle position and momentum Heisenberg
. In addition to the conventional S-G setup, Wigner has proposed an
alternative configuration in which two spin paths are combined to restore
coherence, as illustrated in Fig. 1b. This arrangement aims to elucidate the
difference of entanglement state and mixed state in the context of measurement
Wigner . The variant configuration referred to as the S-G interferometer
Schwinger1 ; Schwinger2 ; Schwinger3  has garnered significant interest in
recent times due to its potential in quantum gravity testing Gravity .
Therefore, the implementation of sequential S-G experiments holds immense
importance in enhancing our comprehension of quantum theory.

Figure 1:  A schematic diagram illustrating sequential Stern-Gerlach
experiments. a: Sequential spin measurements are conducted using two S-G
setups, each with different measurement directions; d: Wigner’s S-G
interferometer that recombine two spin paths after the initial S-G device.
Figure 2: Quantum circuit realization of Stern-Gerlach devices. a: The S-G
quantum circuit in the $\hat{\sigma}_{Z}$ basis; b: The S-G quantum circuit in
the $\hat{\sigma}_{X}$ basis. The optimal parameters
$(\vec{\gamma}^{*},\vec{\beta}^{*})$ in quantum circuits can be obtained by
variational optimization with $q_{s}$ being the definite state, e.g.,
$|0\rangle$. The second row dosplays the simulation results of two S-G quantum
circuits with the same optimal parameters. Note that the two quantum circuits
are measured in different basis, and the result $\\{0,1\\}$ on each qubit
corresponds to eigenstates in the measurement basis.

Although the S-G setup has already been extensively utilized in previous
studies use1 ; use2 ; use3 , the implementation of the sequential S-G setup is
not as straightforward as it may appear. Extremely precise calibration and
control are necessary, posing a challenge to achieve even in contemporary
times. Fortunately, the recent advancements in programmable quantum processors
QPU1 ; QPU2 ; QPU3 ; QPU4 ; QPU5 ; QPU6 ; QPU7 ; QPU8 ; QPU9 ; QPU10  have
facilitated the possibility of employing an alternative approach to showcase
sequential S-G experiments. While currently only noisy intermediate-scale
quantum (NISQ) processors NISQ  are accessible, they are deemed adequate for
our intended objectives. In this study, we demonstrate the implementation of
S-G devices with varying measurement orientations through the utilization of
parametric quantum circuits. Similar to the existing variational quantum
algorithms vqe1 ; vqe2 ; vqe3 , the classical optimizer is employed to
determine the optimal parameters of quantum circuits Qcover . The quantum
circuits, when configured with optimal parameters, will function as S-G
devices for the purposes of spin measurement, specifically in the context of
qubits. The variational shallow quantum circuit consists solely of nearest-
neighbor two-qubit gates, which makes our S-G quantum circuits renders them
highly compatible with NISQ hardware implementation. In order to enhance the
performance of sequential S-G experiment, we suggest utilizing cross-shaped
quantum processors for executing S-G quantum circuits.

Figure 3: a: Quantum circuit realization of sequential Stern-Gerlach
experiment based on cross-shaped quantum processors. The Wigner’s S-G
interferometer can be demonstrated by just removing all the rotation gates
$R_{y}(-\frac{\pi}{2})$. b: Simulation results with the qubit
$q_{S}=|0\rangle_{S}$ in sequential S-G quantum circuit. The first is the
measurement result of $\hat{\sigma}_{Z}$ first and then $\hat{\sigma}_{X}$,
while the second is the measurement result of $\hat{\sigma}_{X}$ first and
then $\hat{\sigma}_{Z}$. c: Result of the Wigner’s S-G interferometer with
$q_{S}=|0\rangle_{S}$. The blue one implies that the resulting states of probe
qubits in the first S-G device of $\hat{\sigma}_{X}$ measurement are even
states, while the red one implies that the resulting states are odd states.
Even/Odd state refers to there are even/odd probe qubits in the state
$|1\rangle$. The collective states, e.g., $|\bm{0}\rangle_{Z}$ means that
majority of probe qubits of $\hat{\sigma}_{Z}$ measurement are in the state
$|0\rangle$.

##  II 2\. Quantum Circuit Realization of Stern-Gerlach Device

According to the quantum measurement theory, the spin of a particle is
entangled with its path in the S-G device before ultimately collapsing into
one of its eigenstates upon interaction with the screen theory . Since the
spin state is destroyed upon measurement, it becomes unfeasible to conduct
subsequent measurements. Therefore, it is preferable to employ non-destructive
measurement techniques, wherein the state of spin can be inferred from the
measurement of probe without causing any damage to the system. In the context
of a quantum circuit analogy, the concept of spin is substituted with a qubit,
while additional qubits within the circuit serve as probes to deduce which-way
information pertaining to the spin. The gate operations within the quantum
circuit establish entanglement between the qubit and the probe. At the end of
the quantum circuit, measurements are conducted on the probe in order to
deduce the state of the qubit, thereby achieving a non-destructive
measurement. The crucial aspect is to devise a quantum circuit that
effectively entangles the qubit and the probe, resulting in the creation of a
cat-like state. For instance, when the measurement is conducted on the
$\hat{\sigma}_{Z}$ basis, we expected that the final state of the circuit, for
any arbitrary qubit state expressed in the $\hat{\sigma}_{Z}$ basis
$a|0\rangle_{S}+b|1\rangle_{S}$ with $|a|^{2}+|b|^{2}=1$, be

$|\Psi\rangle_{f}=a|0\rangle_{S}|\bm{0}\rangle_{P}+b|1\rangle_{S}|\bm{1}\rangle_{P}$
(1)

with collective states $|\bm{0}\rangle_{P}$ and $|\bm{1}\rangle_{P}$ represent
that the majority of probe qubits are in states $|0\rangle$ and $|1\rangle$,
respectively. Similarly, the measurement is conducted on the
$\hat{\sigma}_{X}$ basis, the resultant final state of the measurement circuit
should be represented as
$|\Psi\rangle_{f}=a|+\rangle_{S}|\bm{+}\rangle_{P}+b|-\rangle_{S}|\bm{-}\rangle_{P}$,
where $|\pm\rangle=(|0\rangle\pm|1\rangle)/\sqrt{2}$ denotes the eigenstates
of $\hat{\sigma}_{X}$.

The aforementioned S-G quantum circuits can be implemented using parametric
quantum circuits, as depicted in Fig. 2. In our previous study Hu , the
quantum circuit of Fig. 2a has been constructed to generate a cat-like state
in the $\hat{\sigma}_{Z}$ basis, as described by Eq. (1). Similar to the
Stern-Gerlach setup that is utilized for spin measurement, our parametric
quantum circuits, with their specially designed circuit structure, serve as a
means of qubit measurement. The process of optimizing circuit parameters can
be likened to the calibration process of the Stern-Gerlach setup prior to
conducting official measurements. Once the optimal parameters has been
established in the circuit, any qubit in the state $a|0\rangle+b|1\rangle$
that is input into the circuit will produce the cat-like state, as exemplified
by Eq. (1). This cat-like state allows for the extraction of qubit information
through the measurement of probe qubits. This process bears resemblance to the
Stern-Gerlach setup, which involves the entanglement of spin with its
corresponding which-way path, described as
$a|\uparrow\rangle|up\rangle+b|\downarrow\rangle|down\rangle$. The circuit is
initially prepared in the state
$|\psi_{0}\rangle=(a|0\rangle_{S}+b|1\rangle_{S})\otimes|+\rangle^{\otimes
2N}$ by applying Hadamard gates on probe qubits, where $N=3$ in this
particular case. The selection of $2N$ probe qubits in this study is primarily
motivated by two key factors. The first issue to consider is the presence of
measurement errors, which can be mitigated by employing multiple probe qubits
to minimize the occurrence of misreading to a negligible level. The second
issue pertains to the current NISQ devices, which are plagued by noisy
operations. Consequently, it is imperative to limit the number of qubits in
order to ensure accurate and effective calculations. The evolutionary
component of the circuit comprises $m$ layers of similar gate operations
including a total of $2m$ parameters. Each layer is composed of parametric
two-qubit gates $ZZ(\gamma)=e^{i\gamma\hat{\sigma}_{Z}\hat{\sigma}_{Z}}$
applied to the nearest qubits, as well as single-qubit rotation gate
$X(\beta)=e^{i\beta\hat{\sigma}_{X}}$ applied to the probe qubits. The
ultimate state of the parametric circuit will be

$|\vec{\gamma},\vec{\beta}\rangle=\prod X(\beta_{m})\prod
ZZ(\gamma_{m})\cdots\prod X(\beta_{1})\prod ZZ(\gamma_{1})|\psi_{0}\rangle$
(2)

with $\vec{\gamma}=\\{\gamma_{1},\cdots,\gamma_{m}\\}$ and
$\vec{\beta}=\\{\beta_{1},\cdots,\beta_{m}\\}$. In principle, increasing the
number of $m$ leads to improved output results of the optimized circuit.
However, current NISQ processors only support low depth circuit for effective
calculations. We observe that the value of $m=3$ is sufficient in the case
where $N=3$, as demonstrated in Fig. 2 through simulation results. The circuit
depth is limited to the application of only nearest-neighbor two-qubit gates,
which enhances the feasibility of implementing our circuit on existing NISQ
hardware. To implement the S-G quantum circuit in the $\hat{\sigma}_{Z}$
basis, it is necessary to determine the optimal parameters
$(\vec{\gamma}^{*},\vec{\beta}^{*})$ such that
$|\vec{\gamma}^{*},\vec{\beta}^{*}\rangle=|\Psi\rangle_{f}$. The determination
of the optimal parameters $(\vec{\gamma}^{*},\vec{\beta}^{*})$ can be achieved
through the application of the variational method, utilizing the cost function
$\langle\vec{\gamma},\vec{\beta}|\hat{H}|\vec{\gamma},\vec{\beta}\rangle$, in
which $\hat{H}=-\sum_{k=1}^{2N}\hat{\sigma}_{Z}^{k}\hat{\sigma}_{Z}^{k+1}$ is
the Ising Hamiltonian with nearest-neighbor interactions. The minimization of
cost function output the desired optimal parameters
$(\vec{\gamma}^{*},\vec{\beta}^{*})$. Since the lowest energy value of
$\hat{H}$ is known, the closeness of optimized cost function to this value
reflects the quality of cat-like state preparation. This procedure bears
resemblance to the calibration of the device before official measurements.
Specifically, the initial state of the measurement qubit $q_{s}$ is set to
$|0\rangle$, followed by the execution of the circuit to calculate the
$\langle\vec{\gamma},\vec{\beta}|\hat{H}|\vec{\gamma},\vec{\beta}\rangle$
using randomly assigned initial parameters. The classical optimizer, such as
COBYLA, is utilized to minimize the cost function, and the optimal parameters
is obtained once the convergence condition has been met. The optimal
parameters $(\vec{\gamma}^{*},\vec{\beta}^{*})$ are adjusted in the circuit,
thereby completing the S-G quantum circuit.

The S-G quantum circuit of the $\hat{\sigma}_{X}$ basis, as depicted in Fig.
2b, is formed by substituting $ZZ(\gamma)$ with
$XX(\gamma)=e^{i\gamma\hat{\sigma}_{X}\hat{\sigma}_{X}}$, and $X(\beta)$ with
$Z(\beta)=e^{i\beta\hat{\sigma}_{Z}}$. We have excluded the Hadamard gates
from the circuit as $|0\rangle$ is already in a superposition state on the
$\hat{\sigma}_{X}$ basis. Since the measurement of qubits in a quantum circuit
only yields results in the form of $\\{|0\rangle,|1\rangle\\}$, rotation gates
$R_{y}(-\frac{\pi}{2})$ are applied to the probe qubits prior to measurement
in order to convert the state $|+\rangle$ to $|0\rangle$ and the state
$|-\rangle$ to $|1\rangle$, respectively. We aim to simulate the two S-G
quantum circuits with different basis using the same optimal parameters
$(\vec{\gamma}^{*},\vec{\beta}^{*})$. The results depicted in Fig. 2 align
closely with the theoretical predictions. Interestingly, the resulting states
of the two circuits have the same probability distribution on their own basis.
This assertion appears to be reasonable due to the S-G setup along the $X$
direction can be achieved by simply rotating the identical setup along the $Z$
direction. In practical application, however, the optimization is contingent
upon the performance of the NISQ hardware and the characteristic of the
specific quantum circuit.

In summary, we have put forth a novel variational quantum circuit specifically
designed for the current NISQ processors to replicate the functionality of S-G
setup. In the S-G setup, the spin that to be measured becomes entangled with
its which-way path described as
$a|\uparrow\rangle|up\rangle+b|\downarrow\rangle|down\rangle$, where the
extraction of which-way information provides us the information of spin state.
In the context of the quantum circuit analog, the qubit is utilized to
simulate the spin, while the role of the which-way path is replaced by probe
qubits that are entangled with the qubit to be measured. The final state of
the variational quantum circuit with optimized parameters exhibit a cat-like
state represented as $a|0\rangle|\bm{0}\rangle+b|1\rangle|\bm{1}\rangle$, as
described in Eq. (1), in order to successfully simulate the desired outcome of
the measurement process in the Stern-Gerlach setup. In order to ensure the
desired cat-like state in the final circuit, We select the cost Hamiltonian
for the variational quantum circuit as the Ising Hamiltonian with nearest-
neighbor interactions. This is due to the fact that one of ground states of
the cost Hamiltonian is the GHZ state, represented as $a|0\cdots
0\rangle+b|1\cdots 1\rangle$. The circuit structure depicted in Fig. 2 ensures
the optimal arrangement of layer, thereby minimizing the cost Hamiltonian. The
optimized circuit would result in a cat-like state at the end. The number of
parameters in the circuit is determined by how close we want the value of cost
function
$\langle\vec{\gamma},\vec{\beta}|\hat{H}|\vec{\gamma},\vec{\beta}\rangle$
approach the ground state eigenvalue of $\hat{H}$.

##  III 3\. Sequential Stern-Gerlach Experiment Realization

With the availability of S-G quantum circuits employing different measurement
basis, we are now prepared to delve into the implementation of sequential S-G
experiments. The quantum circuit depicted in Fig. 3a illustrates the
implementation of the sequential S-G experiment. In this experiment, a qubit
$q_{S}$ initially traverses the S-G quantum circuit in the $\hat{\sigma}_{X}$
basis, and subsequently enters the S-G quantum circuit in the
$\hat{\sigma}_{Z}$ basis. This sequential S-G quantum circuit, which performs
a $\hat{\sigma}_{X}$ measurement followed by a $\hat{\sigma}_{Z}$ measurement
on the qubit $q_{S}$, can be considered as a quantum analog of the sequential
spin measurement depicted in Fig. 1a. The sequential measurement of the first
$\hat{\sigma}_{Z}$ measurement and then the $\hat{\sigma}_{X}$ measurement of
$q_{S}$ can be easily achieved by modifying the S-G quantum circuits
component. The sequential S-G quantum circuit is best executed on a cross-
shaped quantum processor, as depicted in the right portion of Fig. 3a, with
the qubit $q_{S}$ positioned at the center. The qubits located in the
horizontal and vertical lines are utilized for the implementation of S-G
quantum circuits in the $\hat{\sigma}_{X}$ basis and the $\hat{\sigma}_{Z}$
basis, respectively. In practical applications, it is necessary to conduct on-
chip optimization in order to determine the optimal parameters for two S-G
quantum circuits prior to conducting the experiment. With the utilization of
cross-shaped processors, the alteration in the measurement sequence of non-
commuting observables of $q_{S}$ can be achieved by simply modifying the
execution order of the horizontal and vertical qubits.

We are now able to engage in a comprehensive discussion on the implementation
of Wigner’s S-G interferometer, which effectively restores spin coherence
subsequent to the initial S-G device. It is, nonetheless, not immediately
apparent upon initial observation. We will demonstrate that this can be
accomplished effortlessly by simply altering the measurement basis of the
initial S-G quantum circuit. To be concrete, we consider the qubit $q_{S}$
initially prepared in state $|0\rangle_{S}$ passing through a sequential S-G
quantum circuit, as depicted in Fig. 3. Denoting the initial states of the two
S-G quantum setup as $|\bm{0}\rangle_{X}$ and $|\bm{0}\rangle_{Z}$
respectively, we obtain the final state of the whole system at the end of the
circuit as

$|\Phi\rangle_{F}=\frac{1}{2}[|0\rangle_{S}(|\bm{+}\rangle_{X}+|\bm{-}\rangle_{X})|\bm{0}\rangle_{Z}+|1\rangle_{S}(|\bm{+}\rangle_{X}-|\bm{-}\rangle_{X})|\bm{1}\rangle_{Z}].$
(3)

If the probe qubits($q_{1}-q_{6}$) in the initial S-G quantum circuit can be
projected into the states $|\bm{+}\rangle_{X}\pm|\bm{-}\rangle_{X}$, then the
qubit $q_{S}$ will undergo a collapse and be in either the state
$|0\rangle_{S}$ or $|1\rangle_{S}$. In this particular instance, the Wigner’s
interferometer analogy has been implemented. The measurement of the second S-G
quantum device in the $\hat{\sigma}_{Z}$ basis will not cause any changes to
the state of $q_{S}$. It is, however, challenging to accurately project the
$|\bm{+}\rangle_{X}\pm|\bm{-}\rangle_{X}$ states onto the probe qubits. To
address this challenge, it is important to acknowledge that the
state$|\bm{+}\rangle_{X}+|\bm{-}\rangle_{X}$ exclusively consists of even
states $\\{|0\rangle,|2\rangle,|4\rangle,|6\rangle\\}$, while the state
$|\bm{+}\rangle_{X}-|\bm{-}\rangle_{X}$ comprises odd states
$\\{|1\rangle,|3\rangle,|5\rangle\\}$. Here the notation $|n\rangle$
represents the number of probe qubits in the state $|1\rangle_{X}$. This state
is referred to as the even/odd state, depending on whether $n$ is even/odd. It
is now evident that the measurement of probe qubits on the $\hat{\sigma}_{Z}$
basis is sufficient, which involves the removal of all rotation gates
$R_{y}(-\frac{\pi}{2})$. If the results is either even or odd state, then the
qubit $q_{s}$ will collapsed into the $|0\rangle_{S}$ or $|1\rangle_{S}$
state. The realization of of Wigner’s S-G interferometer using the original
S-G device is surprisingly achievable with the quantum circuit version.

The sequential S-G quantum circuit, consisting of a total of $13$ qubits, as
depicted in Fig. 3a, is simulated in this study by utilizing the IBM Qiskit
package qiskit . The optimal parameters $(\vec{\gamma}^{*},\vec{\beta}^{*})$
are predetermined in the circuit are obtained in advance using the BAQIS
Qcover package Baqis . Our simulations are based on the assumption that all
qubits and gate operations are ideal, meaning that no circuit noise models are
incorporated. The qubit $q_{S}$, which emulates the spin to be measured as
depicted in Fig. 1, is initially prepared in the state $|0\rangle_{S}$. Fig.
2b displays the simulation results of sequentially measuring the qubit
observables $\hat{\sigma}_{Z}$ and $\hat{\sigma}_{X}$. The left panel of Fig.
3b displays the outcome of measuring $\hat{\sigma}_{Z}$ prior to
$\hat{\sigma}_{X}$, whereas the right panel shows the outcome of measuring
$\hat{\sigma}_{X}$ prior to $\hat{\sigma}_{Z}$. The significant disparity
observed when altering the sequence of measurement serves as a clear
demonstration of the non-commutative nature of the observables
$\hat{\sigma}_{Z}$ and $\hat{\sigma}_{X}$. In the outcome presented in the
left panel, it is evident that there exists a possibility for the state of
$q_{S}$ to be completely distinct from its original state after the
measurement process concludes. The explanation of this phenomenon does not
conform to classical principles, but rather arises as a natural outcome of the
superposition of quantum states. Fig. 3c illustrates the simulation outcome of
Wigner’s S-G interferometer, achieved by eliminating all rotation gates
$R_{y}(-\frac{\pi}{2})$ in the sequential quantum circuit. The sampling
results of the circuit can be categorized into two groups. The blue category
indicates that the resulting states of probe qubits are even states, while the
red category indicates that the resulting states are odd states. It is
evidence from the results that $q_{S}$ is restored to the state
$|0\rangle_{S}$, which represents a coherent state in the basis of
$\hat{\sigma}_{X}$ for even states. Conversely, for odd state, $q_{S}$ is
restored to the state $|1\rangle_{S}$.

##  IV 4\. Discussion and Conclusion

The previous proposed sequential S-G quantum circuit for Wigner’s S-G
interferometer can also serve as a demonstration of wave-particle duality.
This concept is best exemplified by Wheeler’s delayed-choice gedanken
experiment Wheeler . In the delayed-choice experiment, the option to open or
close the second beam splitter $\mathrm{BS_{out}}$ within the Mach-Zehnder
interferometer is available after a single photon has traversed the first
beamsplitter. When $\mathrm{BS_{out}}$ is open, the observer can observe the
interference pattern. Conversely, when $\mathrm{BS_{out}}$ is closed, the
observer can obtain the which-way information of each photon. The wave or
particle nature of a photon is solely determined by the type of measurement
that performed on it, despite the fact that the photon has already completed
its travel. In the Wigner’s S-G interferometer circuit, the determination or
elimination of the which-way information of the qubit $q_{S}$ can be achieved
by the application or removal of rotation gates $R_{y}(-\frac{\pi}{2})$,
respectively. If a quantum random number generator (QRNG), which can be an
ancilla qubit used to control the application or removal of gates
$R_{y}(-\frac{\pi}{2})$, is activated only after $q_{S}$ has entered into the
second S-G circuit, then we have successfully implemented the quantum circuit
version of the delay-choice experiment. Compared to the optical realization
delay1 ; delay2 ; delay3 , the implementation of the delayed choice operation
in a circuit may offer advantages in terms of ease of realization. This is due
to the ability to accurately determine the timing of gate operation in
advance. By applying $R_{y}(-\frac{\pi}{2})$, we obtain the which way
information and the corresponding counting results are displayed in Fig. 3b.
Conversely, removing $R_{y}(-\frac{\pi}{2})$ eliminates the which-way
information, resulting in the counting results displayed in Fig. 3c. Similar
to the optical experiment, the presence of odd state in Fig. 3c can be
attributed to the introduction of a $\pi$ phase in the interferometer.

In conclusion, we have presented the quantum circuits version of S-G devices,
incorporating different measurement directions. We have provided a
comprehensive analysis on the utilization of these devices for the
implementation of sequential S-G experiments, specifically focusing on
Wigner’s S-G interferometer. The present study also explores the feasibility
of executing Wheeler’s delay-choice gedanken experiment by utilizing a
sequential S-G quantum circuit. The S-G quantum circuit is a parametric
circuit with a shallow depth, consisting solely of nearest-neighbor two-qubits
gates and single-qubit gates. This characteristic renders it highly suitable
for practical implementation in the current NISQ hardwares. We propose that
the optimal execution of sequential S-G quantum circuits can be achieved
through the utilization of cross-shaped quantum processors. These processors
can be readily implemented using today’s superconducting qubit chips. We hold
the belief that the utilization of quantum circuit version of the S-G device
offers us a remarkable experimental platform for the purpose of showcasing and
investigating the captivating facets of foundational quantum theory. More
significantly, the launch of increasing advanced quantum computing cloud
platforms that support a range of quantum hardware, such as BAQIS Quafu Quafu
, enables us to utilize cloud resources for the purpose of investigating the
enigmatic aspects of quantum phenomena without the need for a specialized
laboratory.

###### Acknowledgements.

Acknowledgments: Meng-Jun Hu expresses gratitude to Dong E. Liu, Peng Zhao and
Heng Fan for their valuable discussions. Meng-Jun Hu is supported by Beijing
Academy of Quantum Information Sciences. Hai-Xing Miao is supported by the
State Key Laboratory of Low Dimensional Quantum Physics and the start-up fund
provided by Tsinghua University. Yong-Sheng Zhang acknowledges the financial
support provided is supported by the National Natural Science Foundation of
China (Grant No. 92065113) and the Anhui Initiative in Quantum Information
Technologies. This study aims to commemorate the centennial anniversary of the
Stern-Gerlach experiment. Code available: Relevant code pertaining to this
study is accessible upon direct request to the corresponding author.

## References

  * (1) Stern O 1921 Zeitschrift für Physik 7, 249-253.
  * (2) Gerlach W and Stern O 1922 Zeitschrift für Physik 9, 349.
  * (3) Castelvecchi D 2022 Nat. Rev. Phys. 4, 140-142.
  * (4) Friedrich B and Herschbach D 2023 Physics Today 56, 53-59.
  * (5) Gaudsmit S and Uhlenbeck G E 1925 Zeitschrift für Physik 35, 618-625.
  * (6) Fraser R J G 1927 Proc. R. Soc. A 114, 212.
  * (7) Schwinger J 2001 Quantum mechanics:symbolism of atomic measurements, Ed. by B. G. Englert (Springer-Verlag, Berlin, Heidelberg).
  * (8) Sakurai J J 1994 Modern Quantum Mechanics, revised edition, Ed. by S. F. Tuan (Addison-Wesley, New York).
  * (9) Zhu G and Singh C 2011 Am. J. Phys. 79, 499.
  * (10) Dirac P A M 1958 The Principles of Quantum Mechanics (Clarendon, Oxford).
  * (11) Heisenberg W 1949 The Physical Principles of the Quantum Theory, Trans. by C. Eckhart and F.C. Hoyt (Dover Publications, New York).
  * (12) Wigner E P 1963 Am. J. Phys. 31, 6.
  * (13) Englert B G, Schwinger J, and Scully M O 1988 Found. Phys. 18, 1045.
  * (14) Schwinger J, Scully M O, and Englert B G 1988 Z. Phys. D 10, 135.
  * (15) Scully M O, Englert B G, and Schwinger J 1989 Phys. Rev. A 40, 1775.
  * (16) Margalit Y et al 2021 Sci. Adv. 7, eabg2879.
  * (17) Klabunde W and Phipps T E 1934 Phys. Rev. 45, 59.
  * (18) Sherwood J E, Stephenson T E, and Bernstein S 1954 Phys. Rev. 96, 1546.
  * (19) Hasegawa Y, Loidl R, Badurek G, Baron M, and Rauch H 2003 Nature 425, 45-48.
  * (20) Bennett C H and DiVincenzo D P 2000 Nature 404, 247-255.
  * (21) Monroe C 2002 Nature 416, 238-246.
  * (22) Arute F et al 2019 Nature 574, 505-510.
  * (23) Wu Y et al 2021 Phys. Rev. Lett. 127, 180501.
  * (24) Brown K R, Kim J, and Monroe C 2016 npj Quantum Inf. 2, 16034.
  * (25) Zhang J, Pagano G, Hess P W, Kyprianidis A, Becker P, Kaplan H, Gorshkov A V, Gong Z X, and Monroe C 2017 Nature 551, 601-604.
  * (26) Bernien H, Schwartz S, Keesling A, Levine H, Omran A, Pichler H, Choi S, Zibrov A S, Endres M, Greiner M, Vuletić V, and Lukin M D 2017 Nature 551, 579-584.
  * (27) Scholl P, Schuler M, Williams H J, Eberharter A A, Barredo D, Schymik K, Lienhard V, Henry L, Lang T C, Lahaye T, Läuchli A M, and Browaeys A 2021 Nature 595, 233-238.
  * (28) Ebadi S, Wang T T, Levine H, Keesling A, Semeghini G, Omran A, Bluvstein D, Samajdar R, Pichler H, Ho W W, Choi S, Sachdev S, Greiner M, Vuletić V, and Lukin M D 2021 Nature 595, 227-232.
  * (29) Zhong H S et al 2021 Phys. Rev. Lett. 127, 180502.
  * (30) Preskill J 2018 Quantum 2, 79.
  * (31) Cerezo M et al 2021 Nat. Rev. Phys. 3, 625-644.
  * (32) Farhi E, Goldstone J, and Gutmann S 2014 arXiv:1411.4028[quant-ph].
  * (33) Harrigan M P et al 2021 Nat. Phys. 17, 332-336.
  * (34) Zhuang W F et al 2021 arXiv:2112.11151[quant-ph].
  * (35) von Neumann J 1955 English translation by R. T. Beyer: Mathematical Foundations of Quantum Mechanics (Princeton University Press, Princeton).
  * (36) Hu M J, Chen Y, Ma Y, Li X, Liu Y, Zhang Y S, and Miao H X 2022 arXiv:2206.14029[quant-ph].
  * (37) https://github.com/Qiskit/qiskit.
  * (38) https://github.com/BAQIS-Quantum/Qcover.
  * (39) Wheeler J A, and Zurek W H 1983 Eds., Quantum Theory and Measurement (Princeton University, Princeton, NJ) pp. 182-213.
  * (40) Jacques V et al 2007 Science 315, 966.
  * (41) Tang J S, Li Y L, Xu X Y, Xiang G Y, Li C F, and Guo G C 2021 Nat. Photon. 6, 600-604.
  * (42) Vedovato F et al 2017 Sci. Adv. 3:e1701180.
  * (43) http://quafu.baqis.ac.cn/