## 2 Photon-Subtracted Plug-and-Play DM-CVQKD  
### Plug-and-Play DM-CVQKD Protocol  
In the prepare-and-measure (PM) version of DM-CVQKD, [PERSON] randomly chooses one of the coherent states \(\{|\alpha_{k}\rangle_{4}=|\alpha e^{i(2k+1)\pi/4}\rangle,k\in\{0,1,2,3\}\}\)[24] for four-state modulation or \(\{|\alpha_{k}\rangle_{8}=|\alpha e^{ik\pi/4}\rangle,k\in\{0,1,\cdots,7\}\}\)[52] for eight-state modulation, as shown in Figure 1, with the modulation variance \(V_{M}=2\alpha^{2}\) and sends it to [PERSON] through an untrusted channel. To simplify the security proof, we choose the entanglement-based (EB) scheme which is equivalent to the PM scheme in security [53], and the detailed description of the PM version of PP CVQKD is shown in [39; 40]. In the EB scheme of original DM-CVQKD, [PERSON] prepares an entanglement state, namely Einstein-Podolsky-Rosen (EPR) state, \(\rho_{A_{0}B}\) and sends one mode \(A_{0}\) to [PERSON] where another mode \(B\) is kept by [PERSON] for measurement.  
The EB scheme of PP DM-CVQKD is shown in Figure 2a and its steps are as follows.  
1. [PERSON] prepares a EPR state \(\rho_{A_{0}BF}\). [PERSON] can be a neutral party; however, to derive the tight security bound, [PERSON] is assumed to be controlled by [PERSON], that is to say, [PERSON] would introduce the untrusted source noise. Notice that the state \(\rho_{A_{0}BF}\) is utilized to simulate the coherent state with extra untrusted noise \(\zeta\), which characterized by a phase insensitive amplifier (PIA) with a gain \(g\) in the PM scheme. Namely, the state \(\rho_{A_{0}BF}\) is virtually a two-mode state [43] and the calculation method  
Figure 1: Phase space representations of coherent states with (a) four-state modulation and (b) eight-state modulation.  
Figure 2: (a) the EB scheme of PP DM-CVQKD protocol. Here, [PERSON] is assumed to controlled by [PERSON], and he will introduce an untrusted source noise; (b) the corresponding PS-based PP DM-CVQKD scheme. PNRD, photon number resolving detector.  
of two-mode entanglement state is still suitable. The quadratures \((X_{B},P_{B})\) and \((X_{A_{0}},P_{A_{0}})\) of [PERSON] and [PERSON] respectively can be expressed as \[\begin{split}\langle X_{A_{0}}^{2}\rangle&=\langle P _{A_{0}}^{2}\rangle=V+\zeta\\ \langle X_{B}^{2}\rangle&=\langle P_{B}^{2}\rangle=V,\end{split}\] (1) where \(V=V_{M}+1\) ( with the shot noise variance 1) and \(\zeta=g-1+(g-1)V_{I}\). Here, \(V_{I}\) is the variance of vacuum noise.
2. [PERSON] sends the mode \(A_{0}\) to [PERSON] through an untrusted channel. We assume that [PERSON] performs the collective Gaussian attack strategy, which is proved to be an optimal attack on reverse reconciliation protocols. The transmittance of the channel represented by \(T\) and the channel-added noise is \(\chi_{line}\).
3. [PERSON] randomly measures one quadrature of the mode \(A_{1}\) using homodyne detection or two quadratures with heterodyne detection, while [PERSON] measures mode \(B\) with heterodyne detection. After that, [PERSON] and [PERSON] share two strings of correlated data as raw keys.
4. [PERSON] and [PERSON] apply post-processing procedure, e.g., reverse reconciliation and privacy amplification to acquire secure secret key sequences.