Effect of frequency side channels on the security of practical quantum key distribution

Quantum key distribution (QKD) provides an information-theoretic secure method for communication. Measurement-device-independent QKD (MDI-QKD) demonstrates immunity to all detection-side vulnerabilities while offering exceptional security and practicality. Nevertheless, imperfections in source-side devices may still introduce security risks that necessitate precise characterization and evaluation in practical security analyses. In this study, we demonstrate that the inherent frequency-shifting properties of the Mach-Zehnder intensity modulator can induce distinguishable features between signal and decoy states in the frequency domain, fundamentally undermining the core premise of the decoy-state protocol. Experimental characterization reveals that such spectral distinguishability exhibits strong dependence on three key parameters: modulation voltage, pulse width, and modulation scheme. Leveraging this vulnerability, we develop a frequency side channel attack framework applicable to both MDI-QKD and its variant mode-pairing QKD (MP-QKD), evaluate its impact on protocol security, and ultimately devise corresponding countermeasures.