## 3 Security Analysis  
The transmittance \(\mu\) of the photon subtraction beamsplitter may have an influence on the success probability of subtracting \(m\) photons which plays a significant role in the security analysis. As shown in Figure 3, the success probability is reduced as the increasing photon-subtracted number \(m\). Note that, although \(P_{(m)}^{\mathbb{f}_{1}}\) is highest when \(\mu=0\), all the signals received by PNRD are reflected from quantum state \(A_{0}\) through a beamsplitter and state \(A_{0}\) cannot be sent to [PERSON], which means that the scheme cannot work. Figure 4 shows the secret key rate as a function of channel losses. We find that the PS-based PP scheme demonstrates better performance in the case of high channel losses but worse in low channel losses range because of the low success rate of photon subtraction operation. The 1-photon subtraction (1-PS) scenario is best-performing; in other words, more channel losses can be tolerated for \(m=1\) compared with that of number \(m>1\). Moreover, we can also perceive that the source noise evaluated by \(g\) (dash line in Figure 4 where \(g=1.005\)) will reduce the secret key rate as well as have an influence on the tolerance of channel losses. Figure 3: The success probability of photon subtraction as a function of transmittance \(\mu\) for the modulation variance \(V_{M}=0.5\). Figure 5 shows the secret key rate of the plug-and-play DM-CVQKD as a function of channel losses for the tunable \(g\). Figure 5a,b are the four-state and eight-state PP DM-CVQKD protocols, respectively. Figure 5c,d are the protocols with 1-PS and 2-PS operations, respectively. The insecure area shown in the chart signifies that the secret key rate is zero or negative, which means that [PERSON] and [PERSON] cannot acquire the secret key sequence. Compared with the four-state PP DM-CVQKD, the eight-state PP DM-CVQKD could tolerate more untrusted source noise for the same channel losses. Furthermore, after applying 1-PS operation, the four-state PP DM-CVQKD could demonstrate the longer transmission distance for the same value of \(g\), whereas it tolerates more untrusted source noise at the same channel losses owing to the enhancement of entanglement degree. In the asymptotic case, the number of communication signals is deemed to be infinite [55]; in other words, the channel is totally known. In practice, it is impossible for the number of exchanged signals to be infinite so we have to take the finite-size effect into account. Figure 6 shows the secret key rate as a function of channel losses in the finite-size scenario. Figure 6a,b are the four-state and eight-state DM-CVQKD, respectively, while Figure 6c,d correspond to the schemes involved the 1-PS and 2-PS operations, respectively. We find that the secret key rate of DM-CVQKD in a finite-size scenario is lower than that of the asymptotic case whether it performs the PS operation or not. The finite-size secret key rate is closer to the asymptotic case with the increasing block size \(N\) of transmitted photons due to the fact that more signals could be utilized for parameter estimation and the quantum channel would be closer to being entirely known. Generally, the channel characters will not be estimated perfectly because of the finitude of signals so we need to consider the worst case. The analysis of finite-size effect and the calculation of the secret key rate of the PS-based PP DM-CVQKD system for the finite-size scenario is shown in Appendix B.  
Figure 4: The secret key rate as a function of channel losses. The solid line corresponds to the case that \(g=1\) and the dash line corresponds to \(g=1.005\). The modulation variance \(V_{M}=0.5\), the channel excess noise \(\varepsilon=0.01\), and the reconciliation efficiency \(\beta=0.95\). Figure 5: The secret key rate of plug-and-play DM-CVQKD of **(a)** PP 4-state DM-CVQKD protocol, **(b)** PP 8-state DM-CVQKD protocol, **(c)** 1-PS PP 4-state DM-CVQKD protocol and **(d)** 2-PS PP 4-state DM-CVQKD protocol.