## 1 Introduction  
Quantum key distribution (QKD) refers to a method in which the two parties of communication share the key by transmitting the information on the quantum channel with the quantum state as the information carrier [1; 2; 3]. Its security is guaranteed by a quantum physical mechanism [1; 4; 5]. The theoretical and actual security analysis for continuous-variable (CV)-QKD has also been continuously developed in recent years [6]. Some researchers proved the security of CV-QKD based on the transmission of squeezed quantum states from the aspect of error correction code [7; 8]. Subsequently, some researchers conducted general research on coherent attacks of arbitrary finite size against the system. They mainly analyzed the security of the coherent state protocol under the individual attack [9]. A Gaussian collective attack, as the optimal attack, was also confirmed in the subsequent research works [10; 11; 12; 13; 14; 15]. The practical security analysis of CV-QKD has also begun to gain attention in recent years. Intercept-resent attack [16; 17], calibration attack [18; 19], local oscillator intensity attack [20], saturation attack [21], and wavelength attack [22; 23] are more attractive. The quantum channel is a portal that eavesdroppers can use (see in Figure 1). The multiphoton mode potentially allows an attacker to organize unauthorized access to the quantum channel. The purpose of unauthorized access can be not only to intercept and read information, but also to synchronize the device of the attacker with the aim of interfering with the operation of the CV-QKD system [24]. [PERSON] can also be used with legitimate users [PERSON] and [PERSON]: bright pulses emitted by [PERSON] from the quantum channel to a QKD subsystem, such as [PERSON], will encounter multiple reflections and scattering sites. Therefore, the reflected pulse stream can be expected to propagate from the [PERSON] device on the quantum channel. If [PERSON] is not careful enough, [PERSON] could find out exactly which quantum state she prepared and thus access the entire key. In general, the goal of [PERSON] is to get as much information as possible about [PERSON]'s sending status [25; 26; 27; 28; 29; 30; 31]. By measuring characteristics of reflected photons, [PERSON] could make some conclusions on modulator's settings or transmitted bits, then at least know transmission or detection bases. In order to limit Trojan horse attacks, the design of the system should satisfy only light of appropriate wavelengths can enter the optical fiber; the encoding optical components are only active for a short time; the amount of reflected light that [PERSON] can use is limited by the known boundary. However, even these measures cannot completely prevent Trojan horse attacks. These attacks will inevitably increase the excess noise of the system, leading to system performance degradation, which will be discovered by users. In an actual CV-QKD system, [PERSON] can first intercept the signals and the local oscillator (LO) sent by [PERSON], and then use the heterodyne detector to measure. Assume that [PERSON] can control the beam splitter (BS) at [PERSON] to have wavelength-independent characteristics. [PERSON] uses the heterodyne detection protocol to attack the actual CV-QKD system by switching signals and different wavelengths LOs to estimate the deviation of shot noise and correct the excess noise [23; 32; 33; 34]. Not only in this case, even if [PERSON] monitors the total strength or LO strength, [PERSON] can implement Trojan horse attacks without being discovered. This article analyzed Trojan horse attacks on one-way CV-QKD systems. We deduced and calculated the numerical changes of excess noise under attacks with the same wavelength and different wavelength as the original pulse. Unfortunately, [PERSON]'s bright pulse have a side effect, resulting in a large quantum bit error rate that effectively protects the system from our attacks.