## 3 Passive Frequency-Shift Attack on Imperfect Implementation of SNS
Once [PERSON] detects photons successfully on one side, [PERSON]'s bit is either the same or a bit-flip error with the other side, which will be revealed in the error-correction step (and the pre-error correction step when the AOPP method is performed). However, the bits are balanced (i.e., random for [PERSON]) in one-detector heralded events with SPD1 \(\vee\) SPD2 \(\vee\) SPD3 \(=0\), which means the raw bits are unknown to [PERSON] in these windows. Although [PERSON] cannot distinguish the decoy and signal states without errors, the decoy-state method may not estimate the lower bound of the secret key rate correctly when the transmittances of the signal and decoy states differ. When the actual secret key rate is lower than the estimated one, the final secret string is partially insecure. We emphasize that this side-channel attack will not introduce unnecessary errors, as the beam splitting and measurement by [PERSON] can be viewed as a loss without phase noise. What is more, [PERSON] could control errors completely except the inherent errors of the protocol through channels, superconducting-nanowire single-photon detectors (SNSPDs), and classic information he announces. In the following, we will analyze the effect of this passive frequency-shift attack. Consider the most general case, assume the envelope of the wavelength spectrum can be written as \(f_{i}(\lambda)\), where \(i\in\{z,a,b,v\}\) and \(f_{v}(\lambda)\equiv 0\) for vacuum states. When the wavelength spectrum of the signal and decoy states do not overlap completely, [PERSON] can distinguish these states with errors by setting the internals \(T_{\alpha}\). The proportion of state \(\mu_{i}\) in internals \(T_{\alpha}\) can be shown as  
\[r_{i|\alpha}=\frac{\int_{T_{\alpha}}f_{i}(\lambda)d\lambda}{\int_{-\infty}^{ \infty}f_{i}(\lambda)d\lambda}. \tag{5}\]  
The states of intensity \(\mu_{i}\) would be transformed with one of four different transmittances \(\eta_{i,k}\) (\(k\in\{1,2,3,v\}\)) when SPD\({}_{k}\) clicks (SPD\({}_{v}\) corresponds to no SPD click), where  
\[\eta_{i,1} = \eta_{z}(1-r_{i|z}), \tag{6}\] \[\eta_{i,2} = \eta_{a}(1-r_{i|z}-r_{i|a}),\] \[\eta_{i,3} = \eta_{b}(1-r_{i|z}-r_{i|a}-r_{i|b}),\] \[\eta_{i,v} = \eta_{k}(1-r_{i|z}-r_{i|a}-r_{i|b}).\]  
The total transmittance \(\eta_{i,k}\) can be controlled by [PERSON] completely, which means that [PERSON] is allowed to use a lower-loss or even lossless channel and perfect detectors with 100% detection efficiency and no dark count. In addition, [PERSON] could select the internals \(T_{\alpha}\) freely to obtain satisfactory results. For the states with intensity \(\mu_{i}\), the probability of being transmitted with \(\eta_{i,k}\) can be shown as  
\[p_{i,z} = (1-e^{-\mu_{i|z}}), \tag{7}\] \[p_{i,a} = e^{-\mu_{i|z}}(1-e^{-\mu_{i|a}}),\] \[p_{i,b} = e^{-\mu_{i|z}}e^{-\mu_{i|a}}(1-e^{-\mu_{i|b}}),\] \[p_{i,v} = e^{-\mu_{i|z}}e^{-\mu_{i|a}}e^{-\mu_{i|b}},\]  
where \(\mu_{i|a}=\mu_{i}r_{i|a}\). Here \(e^{-\mu_{i|a}}\) is the probability of zero photons in internal \(T_{\alpha}\) with intensity \(\mu_{i}\). Since the TF-QKD protocols are proposed for the implementation of long optical-fiber communications, [PERSON]'s best target is to acquire a higher percentage of the key bits as far as possible while maintaining the key rate and communication distance under [PERSON] and [PERSON]'s estimation. When the communication distance is long enough, [PERSON] may steal secret key bits. There are two key rates that matter: the lower bound of the secret key rate under [PERSON] and [PERSON]'s estimation \(R_{e}\) and the upper bound of the actual secret key rate \(R_{u}\). In the QKD protocols, it is challenging to obtain the actual secret key rate with one communication step by sending \(N\) pulses. Fortunately, [PERSON] and [PERSON] can estimate the lower bound of the secret key rate. It is risky to exceed the lower bound because the security of those bits is uncertain, although the final key bits may still be secure.