## 1 Introduction  
Quantum key distribution (QKD) [1, 2, 3, 4, 5, 6] is a technique that allows two remote parties ([PERSON] and [PERSON]), to share unconditional secure keys. The unconditional security of the keys are guaranteed by the laws of quantum mechanics [7, 8, 9, 10]. The first ideal QKD protocol is BB84-QKD created by [PERSON] and [PERSON] [1], which needs a perfect single-photon source and detectors. However, there is always a large gap between ideal and reality. Due to the imperfection of equipment, the implementation of the QKD suffers double attacks from the source side and detection side. On the one hand, at present, perfect single-photon sources are not available, and weak coherent photon sources (WCPs) after phase randomization are often utilized to replace the single-photon sources. While the photon number of the pulses emitted by WCPs may be more than one, an eavesdropper [PERSON] can launch a photon-number splitting (PNS) attack [11, 12, 13, 14, 15]. Specially, a weaker version of a PNS attack is one in which [PERSON]'s or [PERSON]'s pulse count rate changes significantly after the attack [11, 12, 13, 14], and the stronger PNS attack means that both [PERSON]'s and [PERSON]'s pulse count rates remain unchanged after the attack [15]. The difference between these two attacks is the effect on [PERSON]'s and [PERSON]'s pulse count rates. Fortunately, the decoy-state method [16; 17; 18] proposed later can resist PNS attacks very well. On the other hand, due to the low detection efficiency of the detectors, [PERSON] can launch attacks against the detectors. Compared with source attacks, there are more attacks from the detection side, such as the detector blinding attack [19; 20], dead time attack [21], faked state attack [22; 23], and time shift attack [24].People have proposed device-independent quantum key distribution (DI-QKD) [25; 26], which can resist all attacks from devices. However, this protocol is highly impractical because it needs close to unity detection efficiency. In 2012, [PERSON] et al. [27] proposed measurement-device-independent quantum key distribution (MDI-QKD), which is also known as the time-inversion version of EPR protocol [28]. In MDI-QKD, [PERSON] and [PERSON] do not need to perform measurement operations, so it can be innately immune to all detection attacks. MDI-QKD combined with the decoy-state method can resist both source attacks and detection attacks; thus, decoy-state MDI-QKD [29; 30; 31] is one of the most promising QKD protocols, which can provide unconditional secure keys in practical applications. However, the secure key rate of the existing decoy-state MDI-QKD is not high [32; 33]. The decoy-state method defeats the PNS attack through providing a more accurate method to determine the secure key rate. More specifically, the existing decoy-state method can more closely estimate the lower bound of gain and the upper bound of quantum bit error rate (QBER) of single-photon signals, and then the secure key rate can be calculated by the GLLP formula [34]. In essence, the existing decoy-state method does not care about the existence of a PNS attack, and the secure keys are only generated by single-photon components [35]. However, if we can determine that there is no PNS attack on the channel, multiphoton pulses can also generate secure keys. For simplicity, we only analyze the weaker version of PNS attack in which the legitimate user's pulse count rate changes significantly after the attack. In this case, there is no doubt that using the existing methods to estimate the secure key rate will waste the underlying keys generated from multiphoton pulses and reduce the efficiency. In this work, under the null hypothesis of no PNS attack \(H_{0}\), we first retrieve the lost information in the existing decoy-state MDI-QKD, extract a normal distribution statistic, and provide a new method to determine whether there is a PNS attack or not through statistical hypothesis testing.