Finite-key security analysis against the Trojan-horse attack on practical reference-frame-independent measurement-device-independent quantum key distribution

Reference-frame-independent measurement-device-independent quantum key distribution (RFI MDI QKD) can resist side-channel attacks against detectors and slow variations of reference frames, thus presenting an advantageous approach for long-distance secure quantum communication. Nevertheless, if an eavesdropper implements a Trojan-horse attack (THA) by injecting bright light into sources, the back-reflected light may carry encoding information into the channel, thereby causing serious information leakage. In this paper, we theoretically evaluate the finite-key security of decoy-state RFI MDI QKD against a THA by employing the reference-state technique and a particular concentration inequality. Additionally, dual-parameter optimization and multibasis-estimation strategies are introduced to reduce statistical fluctuations effectively. Our work demonstrates that RFI MDI QKD can maintain a better performance even in the presence of large reference-frame drifts and a THA, representing a key advancement in strengthening the security of quantum communication in real-world implementations.