## 3 Passive Frequency-Shift Attack on Imperfect Implementation of SNS  
In this section, we propose a side-channel attack, named the passive frequency-shift attack, on the imperfect implementation of the SNS protocol with AOPP by exploiting the side channels in the frequency domain. The four-intensity decoy-state SNS protocol with AOPP is reviewed in the Appendix A. In those TF-QKD protocols that need the post-phase compensation method, such as the SNS TF-QKD [11] and phase-matching (PM) TF-QKD [12], the signal and reference pulses should be produced with a stable CW laser source and modulated with the external modulation method to estimate and compensate for the phase noise. In the four-intensity decoy-state SNS TF-QKD protocol, [PERSON] and [PERSON] need to modulate the continuous light to five kinds of pulses with different intensities. The maximum-intensity pulses are used as the phase reference pulses, the minimums as the vacuum states, and others as the signal states, weak- and strong-decoy states. In the practical SNS systems [35; 36], three IMs are used to modulate these five different pulses. The first IM modulates the continuous light to five pulses of different intensities and the second IM modulates the intensity to the designed ratio. The last IM only modulates the signal pulse width to a fixed width which can eliminate the side channels caused by the first two IMs. In this paper, we consider the simplified SNS systems where only one IM is applied to modulate the signal pulses. In this way, the side channels caused by the IM are exposed to [PERSON] totally. We use this to verify the side channels of the IMs, prove their harmfulness, and present a reference for the device selection in the practical implementation. Suppose [PERSON] intercepts all of the signal pulses at [PERSON] and [PERSON]'s output ports where the signal pulses have not been attenuated by the channels, and then distinguishes the signal and decoy states with a wavelength-division multiplexer (WDM) and three single-photon detectors (SPDs), which is illustrated in Figure 4. To distinguish the states with intensity \(\mu_{a}\), [PERSON] sets internals \(T_{a}\) with \(\alpha\in\{z,a,b\}\), according to the wavelength spectrum of different states. Suppose the four ports of WDM 1, 2, 3, and 4 can export photons with frequency located in \(T_{z}\), \(T_{a}\), \(T_{b}\), and others. The light-path selector S1 (S2) is controlled by SPD1 (SPD1 and SPD2). Denote it as 1 or 0 when the SPD (i.e., SPD1, SPD2, or SPD3) clicks or not, and 1 or 0 when the light-path selector (i.e., S1 or S2) selects the up or down path. We set  
\[ \begin{split}\text{S1}&=\ \overline{\text{SPD1}},\\ \text{S2}&=\ \text{SPD1}\lor\text{SPD2}.\end{split}  \tag{4}\]  
Note that only one SPD at most will click under this principle. According to the response of the SPDs, set the total transmittance as \(\eta_{1}\), \(\eta_{2}\), \(\eta_{3}\) or \(\eta_{v}\) when SPD1, SPD2, SPD3, or none click, respectively. Figure 4: Schematic of the passive frequency-shift attack harnessing the side channels caused by the IM. PM: phase modulator, IM: intensity modulator, ATT: attenuator, WDM: wavelength-division multiplexer, SPD: single-photon detector, S: light-path selector, BS: beam splitter, SNSPD: superconducting-nanowire single-photon detectors. The light-path selector S1 (S2) is controlled by SPD1 (SPD1 and SPD2), and [PERSON]’s device is the same as [PERSON]’s. In this process, [PERSON] can get partial raw-key bits after [PERSON] ([PERSON]) announces the signal and decoy windows. It can be understood in this way that [PERSON] can conclude the key bit as 1 (0) for [PERSON] ([PERSON]) when SPD1 \(\vee\) SPD2 \(\vee\) SPD3 \(=1\) in a \(Z\) window. There is no bit-flip error between [PERSON] ([PERSON]) and [PERSON] because [PERSON] can intercept photons at output ports without stray photons. Only the raw bits can be used to distill the secret bits in \(Z\) windows when SPD1 \(\vee\) SPD2 \(\vee\) SPD3 \(=0\) on both sides.