## 1 Introduction  
Quantum key distribution (QKD) has been widely proved to have information-theoretical security, which is guaranteed by the laws of physics between two authorized users, [PERSON] and [PERSON] [1, 2]. However, it is well known that the imperfections of practical devices will compensate the security of the generated key. In fact, some quantum attacks have been discovered and demonstrated by exploiting these imperfections of practical devices. An eavesdropper ([PERSON]) could take advantage of any imperfections in practical system to collect secret information without being discovered, with methods such as wavelength attack [3], the detector control attack [4, 5], and the Trojan horse attack [6, 7]. Therefore, researchers have to propose corresponding countermeasures to deal with these security threats. In order to remove side-channel attacks at detection, [PERSON] et al. proposed [8] the measurement-device-independent QKD (MDI-QKD) protocol, while the key rate of the MDI-QKD cannot be better than the linear scale of the channel transmittance. Fortunately, the twin-field QKD (TF-QKD) [9] and the asynchronous MDI-QKD [10] were proposed and improved the key rate to the square root of the channel transmittance. The key rate of them performs \(R\sim O\sqrt{\eta}\) (where \(\eta\) is the channel transmittance) and it can exceed the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [11]. But the later announcement of the phase information in the original TF-QKD [9] may cause security loopholes [12], so many variants of TF-QKD have been proposed [12, 13, 14, 15] to deal with these loopholes. Particularly, the sending-or-not-sending (SNS) TF-QKD [12], as an efficient protocol, can tolerate large misalignment errors even up to 35% in the single-photon interference. In fact,the SNS TF-QKD protocol has made significant progress in theory [16; 17; 18; 19; 20; 21; 22; 23; 24; 25]. In addition, several experiments on the SNS protocol have also been performed so far [26; 27; 28; 29; 30; 31]. In a practical QKD system, [PERSON] may shift their target to quantum state preparation devices so that the bit encoding and measurement basis selection are non-randomly modulated by [PERSON] or [PERSON] [32]. For the quantum state preparation vulnerability of the weak randomness, [PERSON] et al. proposed [33] a weak randomness model in the BB84 protocol. Under the model, the quantum states that [PERSON] has prepared are divided into two parts: the random part and the non-random part, and the latter may lead to the leakage of information. Since then, the model has been further promoted and applied in other protocols [34; 35; 36]. In this paper, we generalize the weak randomness attack model to the SNS TF-QKD. In fact, the SNS TF-QKD possesses the property of measurement-device-independent and can be applied using the coherent source with the decoy-state method [37; 38; 39]. Moreover, the operation of sending or not sending states for [PERSON] and [PERSON] can be regarded as the bit encoding operation, and the operation of selecting time windows can be regarded as the basis selection operation [12]. We analyze the effect of weak randomness on the final security key in the asymptotic and the finite-key size cases. Firstly, we will analytically derive the secret key rate formula based on the weak randomness model in the asymptotic case, and we then calculate the lower bound of the counting rate of the single-photon states and the upper bound of the phase error rate in finite-key cases [16]. In the security analysis of SNS TF-QKD with the weak randomness, we assume that [PERSON] can interfere the quantum state preparation operation, and [PERSON] is responsible for all weak randomness mentioned above. We also assume that the hidden variables \(\xi\) and \(\zeta\) from [PERSON] may determine the quantum states prepared by [PERSON] and [PERSON], where \(\xi\) determines [PERSON]'s quantum states and \(\zeta\) determines [PERSON]'s quantum states.