## 4 Numerical Simulations  
We numerically simulate the behavior of the SNS protocol with AOPP, which applies an imperfect IM, under the passive frequency-shift attack in this section. In the actual systems, the key rate under [PERSON] and [PERSON]'s estimation may be affected by the spectral distribution of signal pulses. Ideally, there will be an expected key rate without attack  denoted as \(R_{ideal}\) when eliminating the effects of the spectral distribution. Here, we ignore the effect of the spectral distribution for simplicity. We suppose that [PERSON]'s target is to acquire more key bits, i.e., lower the upper bound of the secret key rate while maintaining the key rate under [PERSON] and [PERSON]'s estimation constant with the expected key rate. Therefore, [PERSON] need to maximize \(R_{u}\) while keeping \(R_{e}\) equal to the expected key rate \(R_{ideal}\) by optimizing the transmittances \(\eta_{km}^{A}\) and \(\eta_{km}^{B}\), which can be expressed as  
\[\min_{\eta_{km}^{A}\eta_{km}^{B}}R_{u},\ \text{s.t.}\ R_{e}=R_{ideal}. \tag{13}\]  
When \(R_{u}\) is lower than \(R_{e}\), it means the final key bits are partially insecure. And the secret key rate is reduced to 0 when \(R_{u}=0\). For simulation purposes, the experimental parameters listed in Tables 1 and 2 are taken according to the SNS experiment [36]. The most important of the passive frequency-shift attack is the side channels in the frequency domain. To distinguish the states and obtain raw bits probabilistically, [PERSON] will intercept pulses in three internals \(T_{z}\), \(T_{a}\) and \(T_{b}\). According to our experimental results, the internals are marked in Figures 1b and 3a,b. And the parameters \(r_{i|a}\), the proportion if state with intensity \(\mu_{i}\) in internals \(T_{\alpha}\), are listed in Table 3. Note that the side channels in Table 3 are independent with the experiment [36] which we have discussed at the beginning of Section 3. Last, we simulate the expected secret key rate without attack \(R_{ideal}\), the key rate under [PERSON] and [PERSON]'s estimation \(R_{e}\), and the upper bound of the secret key rate under the frequency-shift attack \(R_{u}\). There are nine parameters should be obtained by statistics in the practical systems, including \(n_{a\beta}\) (\(\alpha\beta\in S=\{vv,va,av,vb,bv\}\)), \(n_{\Delta^{+}}^{R}\), \(n_{\Delta^{-}}^{L}\), \(n_{t}\), and \(E_{2}\). Here, \(n_{t}=n_{\text{sig}}+n_{\text{err}}\) is the length of the raw bits, and \(E_{z}=n_{\text{err}}/n_{t}\) is the bit-flip error rate of the raw bits, where \(n_{\text{sig}}\) and \(n_{\text{err}}\) are the number of right and wrong raw bits, respectively. Under the passive frequency-shift attack, these parameters could be simulated as discussed in the Appendix B. In Figure 5, the estimated key rate \(R_{e}\) under the passive frequency-shift attack represented by the blue solid line is the same as the expected key rate, which means that [PERSON]'s action would not be detected by [PERSON] and [PERSON]. In comparison, the dashed lines represent the upper bounds of the secret key rates \(R_{ul}\) (\(l\in\{1,2,3\}\)) under the frequency-shift attack with the parameters taken from Group \(l\) in Table 3. And the details of transmission \(\eta_{km}^{A}\) and \(\eta_{km}^{B}\) are shown in Appendix C. The effects of the side-channel attack can be analyzed by comparing \(R_{e}\) and \(R_{ul}\). Specifically, the upper bounds \(R_{ul1}\), \(R_{u2}\) and \(R_{u3}\) are lower than \(R_{e}\) at 230 km, 298 km, and 376 km, respectively. At this time, the final key bits are partially insecure which can be depicted with the upper bounds of the percentage of the secret key bits, defined as \(R_{rl}=R_{ul}/R_{e}\) and shown in Figure 6. And the farther the distance, the smaller the proportion of secret key bits. \(R_{ul1}\), \(R_{u2}\), and \(R_{u3}\) are reduced to zero at 412 km, 370 km, and 306 km, respectively, which means no secret-key bits can be distributed when exceeding this distance.