Reversible photorefractive attack in continuous-variable quantum key distribution

Quantum key distribution (QKD) offers information-theoretic security, but device imperfections introduce implementation vulnerabilities. Experimental evidence of the security consequences of transmitter vulnerabilities in continuous-variable QKD (CV-QKD) remains limited. Here, we experimentally investigate a reversible photorefractive attack in a local-local-oscillator CV-QKD system. Moderate blue-light illumination reduces the modulation variance of a lithium-niobate IQ modulator to a stable value without appreciably increasing estimated excess noise. The variance recovers after illumination is removed. We elucidate the underlying physical mechanisms and develop an attack that exploits recovery to compromise modulation calibration. Receiver measurements confirm that the resulting calibration mismatch leads to overestimated channel transmittance and underestimated excess noise. Key rate calculations based on measured parameters yield a positive estimated rate when the correctly calibrated rate is nonpositive. Recovery can also make the preceding manipulation harder to identify through later inspection. This work provides the first system-level experimental evidence that a reversible photorefractive response can be exploited to compromise modulation calibration in CV-QKD. These findings highlight reversible changes in quantum transmitters as a practical security concern, motivating security analyses and protection strategies that account for both optical perturbations and subsequent recovery.