## 3 Passive Frequency-Shift Attack on Imperfect Implementation of SNS
Note that [PERSON] and [PERSON] could not estimate \(R_{e}\) correctly under this attack because it is impossible to pick out the decoy states that have undergone the same operation as the signal states, i.e., the decoy-state method does not work properly. The key rate \(R_{u}\), which is an upper bound of the actual secret key rate, is introduced to evaluate the effect of this attack. In the following, we analyze how to obtain the formula of \(R_{u}\). When the attack is applied, the phase-randomized coherent states with \(\mu_{z}\) sent by [PERSON] ([PERSON]) will be transformed with one of four transmitances \(\eta_{z,k}\) with probability \(p_{z,k}\). As [PERSON] and [PERSON] will announce their signal and decoy windows, the \(Z\) windows are known to [PERSON]. Hence, [PERSON] can obtain [PERSON]'s ([PERSON]'s) raw bits as 1 (0) when obtaining a detection event with three SPDs in \(Z\) windows. In other words, only the raw bits of [PERSON] ([PERSON]) that are caused by the pulses transmitted with \(\eta_{z,v}\) are unknown to [PERSON]. Considering the raw-bit strings of both parties at the same time, there will be four kinds of twin bits, given as \(\{10,1x,x0,xx\}\) according to [PERSON]'s information on raw bits, where the first (second) bit indicates that [PERSON]'s ([PERSON]'s) bits are known to [PERSON] as 1 (0) or unknown as \(x\). In the SNS protocol, [PERSON] and [PERSON] will perform the AOPP method on raw bits before error correction. When the AOPP method is performed with partial bits leaked to [PERSON], from [PERSON]'s perspective, [PERSON] will only choose pairs \(0x\), \(x0\) and, \(xx\), and [PERSON]'s pairs can only be \(11,1x,x1,xx\) accordingly (12 scenarios in total). Note that these bit pairs are between [PERSON] and [PERSON]'s own bit strings. Since [PERSON] only chooses odd-parity bit pairs and will keep the second bits if [PERSON]'s bit pairs are odd too, [PERSON] can infer that [PERSON]'s ([PERSON]'s) result bit (i.e., the second bit) is \(1,0,x\) (\(1,0,1,x\)), correspondingly. At this time, there will be nine kinds of twin bits \(\{11_{P},10_{P},01_{P},00_{P},1x_{P},x1_{P},0x_{P},x0_{P},xx_{P}\}\) according to [PERSON]'s information on raw bits, where the subscript \(P\) represents that the AOPP method is applied. Only the last twin bit \(xx_{P}\) can be used to distill the secret-key bits because, for all other twin bits, at least one's bit is leaked and all will be revealed or discarded in the error-correction step. Finally, we note that the twin bits \(xx_{P}\) can only be generated with two twin bits \(xx\) which correspond to states transmitted with \(\eta_{z,v}\). In the decoy-state method [5; 6; 7], the secret key is only derived from the single-photon component, i.e., the untagged bits [55; 56]. In the decoy-state SNS protocol [11; 30], the untagged bits are defined during effective events, which are caused by the two-mode single-photon states \(|01\rangle\) or \(|10\rangle\) in \(Z\) windows (see Appendix A for details). The secret twin bits \(xx_{P}\) can only be generated with two untagged-twin bits when the AOPP method is applied. Therefore, the upper bound of the actual secret key rate can be shown as  
\[r_{i|\alpha}=\frac{\int_{T_{\alpha}}f_{i}(\lambda)d\lambda}{\int_{-\infty}^{ \infty}f_{i}(\lambda)d\lambda}. \tag{5}\]0  
where \(n_{1s}^{0}\) and \(n_{1s}^{1}\) are the upper bound of the untagged bits when they make the opposite decision and obtain twin bits 0 and 1, respectively. Note that for the above simplified attack scheme,  
\[r_{i|\alpha}=\frac{\int_{T_{\alpha}}f_{i}(\lambda)d\lambda}{\int_{-\infty}^{ \infty}f_{i}(\lambda)d\lambda}. \tag{5}\]1  
where \(G(x)=e^{-x}x\) is obtained without considering dark counts. In addition, note that the above attack scheme is clumsy since [PERSON] does not consider the relevance of the response of the SPDs at [PERSON] and [PERSON]'s side. We modify the attack in the following.