document: continuous - variable quantum - key distribution ( cvqkd ) , as an unconditionally secure communication scheme between two legitimate parties alice and bob , has achieved advanced improvements in theoretical analysis and experimental implementation in recent years @xcite . 
   practical implementation systems , such as fiber - based gaussian - modulated @xcite and discrete - modulated @xcite coherent - state protocol qkd systems over tens of kilometers , have been demonstrated in a few groups . 
   the unconditional security of such systems with prepare - and - measure ( pm ) implementation has been confirmed by the security analysis of the equivalent entanglement - based ( eb ) scheme @xcite . 
   however , the traditional security analysis of the eb scheme of cvqkd just includes the signal beam and not the local oscillator ( lo ) , which is an auxiliary light beam used as a reference to define the phase of the signal state and is necessary for balanced homodyne detection . 
   this will leave some security loopholes for eve because lo is also unfortunately within eve s manipulating domain . 
   the necessity of monitoring lo intensity for the security proofs in discrete qkd protocols embedded in continuous variables has been discussed @xcite . 
   moreover , in @xcite , the excess noise caused by imperfect subtraction of balanced homodyne detector ( bhd ) in the presence of lo intensity fluctuations has been noted and quantified with a formulation . 
   however , in the practical implementation of cvqkd , shot noise scaling with lo power measured before keys distribution is still assumed to keep constant if the fluctuations of lo intensity are small . and in this circumstance , pulses with large fluctuation are just discarded as shown in @xcite . unfortunately , this will give eve some advantages in exploiting the fluctuation of lo intensity .    in this paper , we first describe bob s measurements under this fluctuation of lo intensity , and propose an attacking scheme exploiting this fluctuation . 
   we consider the security of practical cvqkd implementation under this attack and calculate the secret key rate with and without bob monitoring the lo for reverse and direct reconciliation protocol . 
   and then , we give a qualitative analysis about the effect of this lo intensity fluctuation on the secret key rate alice and bob hold . 
   we find that the fluctuation of lo could compromise the secret keys severely if bob does not scale his measurements with the instantaneous lo intensity values . 
   finally , we briefly discuss the accurate monitoring of lo intensity to confirm the security of the practical implementation of cvqkd . 
   generally , in practical systems of cvqkd , the local oscillator intensity is always monitored by splitting a small part with a beam splitter , and pulses with large lo intensity fluctuation are discarded too . however , even with such monitoring , we do not yet clearly understand how fluctuation , in particular small fluctuation , affects the secret key rate . to confirm that the secret key rate obtained by alice and bob is unconditionally secure , in what follows , we will analyze the effects of this fluctuation on the secret key rate only , and do not consider the imperfect measurement of bhd due to incomplete subtraction of it in the presence of lo intensity fluctuations , which has been discussed in @xcite .    ideally , with a strong lo , a perfect pulsed bhd measuring a weak signal 
   whose encodings are @xmath0 will output the results@xcite , @xmath1 where _ k _ is a proportional constant of bhd , @xmath2 is the amplitude of lo , @xmath3 is the relative phase between the signal and lo except for the signal s initial modulation phase . so scaling with lo power or shot noise , 
   the results can be recast as @xmath4 with @xmath3 in eq . 
   ( [ eq : x0 ] ) is 0 or @xmath5 . here 
   the quadratures @xmath6 and @xmath7 are defined as @xmath8 and @xmath9 , where @xmath10 is the quadrature of the vacuum state . 
   however , in a practical system , the lo intensity fluctuates in time during key distribution . with a proportional coefficient @xmath11 , 
   practical lo intensity can be described as @xmath12 , where @xmath2 is the initial amplitude of lo used by normalization and its value is calibrated before key distribution by alice and bob . if we do not monitor lo or quantify its fluctuation @xcite , 
   especially just let the outputs of bhd scale with the initial intensity or power of lo , the outputs then read @xmath13 unfortunately , this fluctuation will open a loophole for eve , as we will see in the following sections .    in conventional security analysis , like the eb scheme equivalent to the usual pm implementation depicted in fig . 
   [ fig:1](a ) , lo is not taken into consideration and its intensity is assumed to keep unchanged . 
   however , in practical implementation , eve could intercept not only the signal beam but also the lo , and she can replace the quantum channel between alice and bob with her own perfect quantum channel as shown in figs . 
   [ fig:1](b ) and [ fig:1](c ) . in so doing , 
   eve s attack can be partially hidden by reducing the intensity of lo with a variable attenuator simulating the fluctuation without changing lo s phase , and such an attack can be called a lo intensity attack ( loia ) . in the following analysis 
   , we will see that , in the parameter - estimation procedure between alice and bob , channel excess noise introduced by eve can be reduced arbitrarily , even to its being null , just by tuning the lo transmission . 
   consequently , alice and bob would underestimate eve s intercepted information and eve could get partial secret keys that alice and bob hold without being found under this attack . 
   figure [ fig:1](b ) describes the loia , which consists of attacking the signal beam with a general gaussian collective attack @xcite and attacking the lo beam with an intensity attenuation by a non - changing phase attenuator * a * , such as a beam splitter whose transmission is variable . 
   this signal - beam gaussian collective attack consists of three steps : eve interacts her ancilla modes with the signal mode by a unitary operation * u * for each pulse and stores them in her quantum memory , then she makes an optimal collective measurement after alice and bob s classical communication . figure [ fig:1](c ) 
   is one practical loia with * u * being a beam - splitter transformation . 
   its signal attack is also called an entangling cloner attack , which was presented first by grosshan @xcite and improved by weedbrook @xcite . in appendix 
   [ sec : security ] , we will demonstrate that with this entangling cloner , eve can get the same amount of information as that shown in fig . 
   [ fig:1](b ) . 
   we analyze a practical cvqkd system with homodyne protocol to demonstrate the effect of loia on the secret key rate , and for simplicity we do not give the results of the heterodyne protocol , which is analogous to the homodyne protocol . in the usual pm implementation , alice prepares a series of coherent states centered on @xmath0 with each pulse , and then she sends them to bob through a quantum channel which might be intercepted by eve . here , 
   @xmath14 and @xmath15 , respectively , satisfy a gaussian distribution independently with the same variance @xmath16 and zero mean . this initial mode prepared by alice 
   can be described as @xmath17 , and @xmath18 is the quadrature variable . here 
   @xmath9 describes the quadrature of the vacuum mode . 
   note that we denote an operator with a hat , while without a hat the same variable corresponds to the classical variable after measurement . 
   so the overall variance of the initial mode prepared by alice is @xmath19 . 
   when this mode comes to bob , bob will get a mode @xmath20 , @xmath21 where @xmath22 describes eve s mode introduced through the quantum channel whose quadrature variance is @xmath23 . 
   bob randomly selects a quadrature to measure , and if eve attenuates the lo intensity during the key distribution , but bob s outputs still scale with the initial lo intensity , just as in eq . 
   ( [ eq : x0 ] ) , he will get the measurement @xmath24 where @xmath25 is @xmath26 ( or equivalently @xmath27 ) . 
   however , if bob monitors lo and also scales with the instantaneous intensity value of lo with each pulse , he will get @xmath25 without any loss of course . 
   note that , for computation simplicity , hereafter we assume the variable transmission rate @xmath28 ( or attenuation rate @xmath29 ) of each pulse of lo is the same without loss of generality . 
   thus the variance of bob s measurements and conditional variance on alice s encodings with and without monitoring ( in what follows , without monitoring specially indicates that bob s measurement is obtained just by scaling with the initial lo intensity instead of monitoring instantaneous values , and vice versa ) can be given by @xmath30\;,\label{eq : vbm}\\ v_{b|a}&=t+(1-t)n\ ; , \\ 
   v_{b|a}^w&=\eta\left[t+(1-t)n\right]\;,\end{aligned}\ ] ] where the superscript @xmath31 indicates  without monitoring " and all variances are in shot - noise units ; the conditional variance is defined as @xcite @xmath32    hence , the covariance matrix of alice s and bob s modes can be obtained as @xmath33\mathbb{i }                     \end{pmatrix}\label{eq : rab},\end{split } \\ & \gamma_{ab}^w=\begin{pmatrix }                  v\mathbb{i } &           \sqrt{\eta t(v^2 - 1)}\sigma_z\\                  \sqrt{\eta t(v^2 - 1)}\sigma_z &   \eta[tv+(1-t)n]\mathbb{i }                  \end{pmatrix},\end{aligned}\ ] ] where @xmath34 is the pauli matrix and @xmath35 is a unit matrix .    from eqs . 
   ( [ eq : vb ] ) and ( [ eq : vbm ] ) we can derive that the channel transmission and excess noise are @xmath36 , @xmath37 with monitoring , and @xmath38 , @xmath39 without monitoring . 
   hence , by attenuating the lo intensity as fig .  [ fig:1 ] shows , to make @xmath40 , eve could arbitrarily reduce @xmath41 to zero , thus she will get the largest amount of information permitted by physics . in the following numerical simulation 
   we always make @xmath42 , namely , @xmath43 . 
   thus , the covariance matrix @xmath44 and eve s introducing noise @xmath23 [ in an entangling cloner it is eve s epr state s variance as fig . 
   [ fig:1](c ) shows ] should be selected to be @xmath45 to estimate the secret key rate , without loss of generality , we first analyze the reverse reconciliation then consider the direct reconciliation .      from alice and 
   bob s points of view , the secret key rate for reverse reconciliation with monitoring or not are given , respectively , by @xmath46 where the mutual information between alice and bob with and without monitoring are the same , and that is @xmath47 this is because bob s measurements in these two cases are just different with a coefficient @xmath28 , and they correspond with each other one by one , so they are equivalent according to the data - processing theorem @xcite . 
   however , the mutual information between eve and bob given by the holevo bound @xcite in these two cases is not identical . as the previous analysis showed , in bob s point of view , channel transmission and the excess noise estimation are different . 
   but from eve s point of view , they are identical according to the data - processing theorem because she estimates bob s measurements in these two cases just by multiplying a coefficient @xmath28 . 
   we ll calculate the real information intercepted by eve first . 
   it can be given by @xmath48 where @xmath49 is the von neumann entropy @xcite . 
   for a gaussian state @xmath50 , this entropy can be calculated by the symplectic eigenvalues of the covariance matrix @xmath51 characterizing @xmath50 @xcite . to calculate eve s information 
   , first eve s system @xmath52 can purify @xmath53 permitted by quantum physics , so that @xmath54 . 
   second , after bob s projective measurement , the system @xmath55 is pure , so that @xmath56 . 
   designating @xmath57 , @xmath58 , and @xmath59 , the symplectic eigenvalues of @xmath60 are given by @xmath61 where @xmath62 and @xmath63 . 
   similarly , the entropy @xmath64 is determined by the symplectic eigenvalue @xmath65 of the covariance matrix @xmath66 @xcite , namely , @xmath67 where @xmath68 and @xmath69 stands for the moore - penrose inverse of a matrix . 
   then @xmath70 , and the holevo bound reads @xmath71 where @xmath72 . however , eve s information estimated by bob without monitoring is given by @xmath73    by substituting eqs . 
   ( [ eq : xbe ] ) and ( [ eq : xbem ] ) into eqs . 
   ( [ eq : krr ] ) and ( [ eq : krrm ] ) , respectively , the secret key rate with and without bob s monitoring can be obtained . 
   however , the secret key rate in eq . 
   ( [ eq : krrm ] ) without monitoring is unsecured in evidence . 
   eve s interception of partial information from @xmath74 is not detected , in other words , alice and bob underestimate eve s information without realizing it . 
   actually , the real or unconditionally secure secret key rate @xmath74 , which we called a truly secret key rate , should be available by replacing @xmath75 in eq . 
   ( [ eq : krrm ] ) with eq . 
   ( [ eq : xbe ] ) . 
   note that it is identical with the monitoring secret key rate in eq . 
   ( [ eq : krr ] ) due to eq . 
   ( [ eq : iab ] ) . 
   we investigate the secret key rate @xmath74 bob measured without monitoring and the true one or equivalently monitoring one @xmath76 for reverse reconciliation under eve attacking the intensity of lo during key distribution . as fig . 
   [ fig:2 ] shows , with various values of transmission of lo that can be controlled by eve , the truly secret key rate alice and bob actually share decreases rapidly over long distances or small channel transmissions . 
   ( color online ) reverse reconciliation pseudosecret key rate and the truly secret one vs channel transmission @xmath36 under loia . 
   solid lines are secret key rate estimated by bob without monitoring lo intensity and dashed lines are the truly secret ones . 
   colored lines correspond to the lo transmissions @xmath28 as labeled . here 
   alice s modulation variance @xmath77 . 
   ]    additionally , because the mutual information between alice and bob with and without monitoring is identical as eq.([eq : iab ] ) shows , subtracting eq . 
   ( [ eq : krr ] ) from eq . 
   ( [ eq : krrm ] ) we can estimate eve s intercepted information @xmath78 which is plotted in fig . 
   [ fig:3 ] . 
   we find that eve could get partial or full secret keys which alice and bob hold by controlling the different transmissions of lo . taking a 20-km transmission distance as an example , surprisingly , just with lo intensity fluctuation or attenuating rate 0.08 , eve is able to obtain the full secret keys for reverse reconciliation without bob s monitoring the lo . 
   we now calculate the secret key rate for direct reconciliation , which is a little more complicated , and we investigate the effect of lo intensity attack by eve on cvqkd . 
   the secret key rate estimated by bob with and without lo monitoring is given , respectively , by @xmath79 note that we have already calculated @xmath80 and @xmath81 in eq.([eq : iab ] ) and they are identical for direct and reverse reconciliation . 
   for eve we have @xmath82 where @xmath54 has been already computed in the previous section , and @xmath83 using the fact that after alice s projective measurement on modes @xmath84 and @xmath85 obtaining @xmath86 in the eb scheme shown in fig . 
   [ fig:1](a ) , the system @xmath87 is pure . to calculate @xmath88 
   , we have to compute the symplectic eigenvalues of covariance matrix @xmath89 , which is obtained by @xmath90 where @xmath91 and @xmath92 can be read in the decomposition of the matrix @xmath93 which is available by elementary transformation of the matrix [ see fig .  [ fig:1](a ) ] @xcite @xmath94 where @xmath95 is a unit matrix . 
   it is obtained by applying a homodyne detection on mode a after mixing @xmath84 and @xmath85 with a balanced beam - splitter transformation @xmath96 . 
   the matrix @xmath97 and @xmath98 actually is @xmath60 in eq . 
   ( [ eq : rab ] ) , @xmath99 is a unit matrix . 
   so we can get @xmath100 and the symplectic eigenvalues of it @xmath101 where @xmath102 and @xmath103 . 
   the holevo bound then reads @xmath104 substituting eqs . 
   ( [ eq : xae ] ) and ( [ eq : xaem ] ) into eqs . 
   ( [ eq : kdr ] ) and ( [ eq : kdrm ] ) , respectively , the secret key rates in these two cases are obtained . in fig . 
   [ fig:4 ] , we plotted them for channel transmission @xmath36 with various values of @xmath28 and find that the difference between the pseudosecret key rate with bob not monitoring lo and the truly secret one is still increasing with the channel transmission @xmath36 becoming smaller .    for eve , when bob does not monitor lo , she will get the partial or total secret key rate @xmath105 without being found by subtracting eq . 
   ( [ eq : kdr ] ) from eq . 
   ( [ eq : kdrm ] ) when she reduces the intensity of lo . in fig 
   .  [ fig:5 ] , we plotted the pseudosecret key rate for direct reconciliation and the mutual information overestimated by alice and bob . 
   we find that for short distance communication ( less 15 km or 3 db limit ) , a small fluctuation of lo intensity could still hide eve s attack partially or totally . 
   note that in the above estimation we assume each pulse s transmission rate @xmath28 ( or attenuation rate @xmath29 ) is identical . 
   however , when @xmath28 is different for each pulse ( eve simulates the fluctuation of lo to hide her dramatic attack on lo ) , eve still could intercept as much as or even more secret key rates than above for reverse and direct reconciliation , as long as the largest value of @xmath28 among all pulses ( or approximately most pulse transmission rates ) is smaller than the above constant value . 
   our analysis shows that reverse reconciliation is more sensitive than direct reconciliation about the fluctuation of lo intensity , and , even with a small attenuation of lo intensity , eve can get full secret keys but not be found . 
   this is consistent with the fact that channel excess noise has a more severe impact on reverse reconciliation than on direct reconciliation . of course , when the intensity of lo fluctuates above the initial calibrated value ( i.e. , @xmath106 ) , eve could not get any secret keys , but alice and bob would overestimate eve s intercepted information due to the overestimation of channel excess noise . however , when lo fluctuates around the initial calibrated value , how to quantify eve s information is still an open question , because the distribution of the fluctuation of lo ( or @xmath28 ) is not a normal distribution and unclear for alice and bob due to eve s arbitrary manipulation . 
   but in this circumstance , eve still could intercept partial secret keys if she increases the channel excess noise of one part of the signal pulses when she controls @xmath107 and decreases it for the other part when controlling @xmath106 , i.e. , making the overall estimated excess noise by alice and bob lower than the real one . remarkably , lo intensity fluctuation opens a loophole for eve to attack the practical system , especially in the case of communication with low channel transmission or over long distance . 
   consequently , in the practical implementation of cvqkd , we must monitor the lo fluctuation carefully and in particular scale the measurements with instantaneous intensity values of lo . 
   alternatively , we can also scale with the lowest intensity value of lo if the fluctuations are very small , but it will estimate the secret key rate pessimistically thus leading to the reduction of the efficiency of the key distribution . 
   however , we can not use the average intensity value of lo to normalize the measurements as most current implementations do , because it still could overestimate the secret key rate for alice and bob . 
   additionally , for reverse reconciliation communication over long distance , very small fluctuation of lo might compromise the secret key rate completely , which presents a big challenge for accurately monitoring lo intensity . 
   finally , we point out that in this paper we do not consider the imperfections of bhd such as detection efficiency , electronic noise , and incomplete subtraction , which may make lo intensity fluctuation have a more severe impact on estimating the secret key rate for alice and bob .    in conclusion 
   , we have analyzed the effect of lo intensity fluctuation on the secret key rate estimation of alice and bob for reverse and direct reconciliation . 
   incredibly , bob s estimation of the secret key rate will be compromised severely without monitoring lo or if his measurements do not scale with lo instantaneous intensity values even with monitoring but just discard large fluctuation pulses like in @xcite . 
   furthermore , we have shown that eve could hide her attack partially by reducing the intensity of lo and even could steal the total secret keys alice and bob share without being found by a small attenuation of lo intensity , especially for reverse reconciliation . 
   finally , we have also briefly discussed the monitoring of lo and pointed out that it would be a challenge for highly accurate monitoring . 
   this work is supported by the national natural science foundation of china , grant no . 
   is supported by the program for new century excellent talents . 
   c.m . is supported by the hunan provincial innovation foundation for postgraduates . 
   acknowledge support from nudt under grant no . kxk130201 . 
   in this appendix , we calculate the holevo bound obtained by eve for direct and reverse reconciliation using weedbrook s entangling cloner model @xcite , and then give the secret key rate shared by alice and bob under loia . 
   we begin the analysis by calculating the von neumann entropy of eve s intercepting state first .    as fig . 
   [ fig:1](c ) shows , the entangling cloner consists of eve replacing the gaussian quantum channel between alice and bob with a beam splitter of transmission @xmath36 and an epr pair of variance @xmath23 . 
   half of the epr pair mode @xmath108 is mixed with alice s mode in the beam splitter and is sent to bob to match the noise of the real channel by tuning n. the other half mode @xmath109 is kept by eve to reduce the uncertainty on one output of the beam splitter , the mode @xmath110 , which can be read as @xmath111 where @xmath112 is the quadrature of mode @xmath108 . 
   thus , the variance of mode @xmath110 is given by @xmath113 and the conditional variance @xmath114 can be calculated as , using eq . 
   ( [ eq : cvar ] ) , @xmath115 hence , eve s covariance matrix can be obtained as @xmath116 where @xmath117 and the notation @xmath118 stands for a matrix with the arguments on the diagonal elements and zeros everywhere else . 
   the symplectic eigenvalues of this covariance matrix are given by @xmath119 where @xmath120 , and @xmath121 . 
   hence , the von neumann entropy of eve s state is given by @xmath122      for the direct reconciliation protocol of cvqkd , the holevo bound between eve and alice is given by eq . 
   ( [ eq : xae0 ] ) , where @xmath123 has been calculated by eq . 
   ( [ eq : se ] ) . 
   @xmath124 can be obtained by the conditional covariance matrix @xmath125 and its symplectic eigenvalues are given by @xmath126 where @xmath127 , and @xmath128 . 
   thus , the conditional entropy is @xmath129 substituting eqs . 
   ( [ eq : se ] ) and ( [ eq : sea ] ) into eq . 
   ( [ eq : xae0 ] ) , we can get the mutual information between alice and eve , @xmath130 under loia , bob s estimation of the holevo bound without monitoring lo intensity then reads , using eq . 
   ( [ eq : xae1 ] ) , @xmath131 with eqs . 
   ( [ eq : xae1 ] ) and ( [ eq : xaem1 ] ) , the secret key rates in eqs . 
   ( [ eq : kdr ] ) and ( [ eq : kdrm ] ) then can be calculated respectively , and the calculation numerically demonstrates that they are perfectly consistent with the fig .  [ fig:4 ] . 
   the calculation of the holevo bound between eve and bob for reverse reconciliation is a bit more complicated . using eq . 
   ( [ eq : xbe0 ] ) , we only need to calculate the conditional entropy @xmath132 , which is determined by the symplectic eigenvalues @xmath133 of the covariance matrix @xmath134 , @xmath135 where @xmath136 and @xmath137 , @xmath138 . 
   then , @xmath134 can be recast as @xmath139 where + @xmath140 , @xmath141 , + and + @xmath142 . 
   + hence , its symplectic eigenvalues are given by @xmath143 where @xmath144 , @xmath145 , and @xmath146 is the determinant of a matrix . 
   so , we get the conditional entropy @xmath147 and then the holevo bound @xmath148 consequently , without monitoring lo intensity , alice and bob will give eve the holevo bound @xmath149 substituting eqs . 
   ( [ eq : xbe1 ] ) and ( [ eq : xbem1 ] ) into eqs . 
   ( [ eq : krr ] ) and ( [ eq : krrm ] ) , respectively , the secret key rates with and without bob s monitoring can be obtained , and for channel transmission @xmath36 with various values of @xmath28 , they are numerically demonstrated to be perfectly consistent with fig . 
   [ fig:2 ] , too . 
   hence , it also indirectly confirms that either for direct or reverse reconciliation , the entangling cloner could reach the holevo bound against the optimal gaussian collective attack .                                        in this paper , 
   lo intensity fluctuation indicates the deviation of each pulse s intensity from the initial calibrated value during the key distribution . 
   it does not mean the quantum fluctuation of each pulse itself , because lo is a strong classical beam whose quantum fluctuation is very small relative to itself and can be neglected .
summary: we consider the security of practical continuous - variable quantum key distribution implementation with the local oscillator ( lo ) fluctuating in time , which opens a loophole for eve to intercept the secret key . 
   we show that eve can simulate this fluctuation to hide her gaussian collective attack by reducing the intensity of the lo . 
   numerical simulations demonstrate that , if bob does not monitor the lo intensity and does not scale his measurements with the instantaneous intensity values of lo , the secret key rate will be compromised severely .