Continuous-variable quantum key distribution system: past, present, and future

Quantum key distribution provides secure keys with information-theoretic security ensured by the principle of quantum mechanics. The continuous-variable version of quantum key distribution using coherent states offers the advantages of its compatibility with telecom industry, e.g., using commercial laser and homodyne detector, is now going through a booming period. In this review article, we describe the principle of continuous-variable quantum key distribution system, focus on protocols based on coherent states, whose systems are gradually moving from proof-of-principle lab demonstrations to in-field implementations and technological prototypes. We start by reviewing the theoretical protocols and the current security status of these protocols. Then, we discuss the system structure, the key module, and the mainstream system implementations. The advanced progress for future applications are discussed, including the digital techniques, system on chip and point-to-multipoint system. Finally, we discuss the practical security of the system and conclude with promising perspectives in this research field.

I. INTRODUCTION  progressed from the initial proof-of-principle demonstration to the second stage with swift advancements in high performance and system robustness. Currently, it has entered the third stage where a modern architecture is evolving with the benefit of being fully compatible with coherent communication.
During the initial phases of the CV-QKD system, the primary challenge was to overcome the 3 dB limit, which was solved by the reverse reconciliation 130 . Subsequently, the CV-QKD system progressed towards allowing long-distance transmission to facilitate two-user interconnection across a wide range without a trusted relay. Developments of the reconciliation resulted in enhanced error correction capability even with an extremely low signal-to-noise ratio (SNR) 131 , which played a significant role in the long-distance system covering a distance from 25 km 132 up to 80 km 133 . At this stage, both the quantum signal and local oscillator (LO) are generated by the same laser of transmitter and co-propagated in the quantum channel, known as the in-line LO system, which contributes to the suppression of phase noise when the quantum and LO interfere for homodyne detection. However, a significant challenge towards achieving long-distance and stable transmission is to reduce crosstalk between the strong LO and the weak quantum signal. The most effective current approach is using pulsed signals with high extinction ratio, then combining polarization multiplexing and time-division multiplexing [133][134][135][136][137][138][139] . This methodology has resulted in the longest lab experiment over 202 km 139 , the longest field test of 50 km 137 , the long-term test of a 3-node CV-QKD network in Qingdao, China 140 , and the first chip-based system 138 .
In 2015, an alternative scheme was proposed, which relaxed the requirement of the extremely high isolation by generating LO inside the receiver and using a pilot assisted phase recovery to suppress the phase noise introduced by the different laser source 141,142 . As the pilot signal has significantly lower power compared to the LO, the high-extinction pulse generation for time division multiplexing is no longer required. Instead, frequency division multiplexing is widely used, which simplifies the signal generation, and sometimes can be combined with polarization multiplexing for better isolation. For higher secret key rate and better phase recovery, the repetition rate of the system is gradually enhanced, where digital techniques in classical optical communication systems, such as pulse shaping and matched filter, are introduced to overcome the limited bandwidth of devices. Further, more and more digital algorithms for a CV-QKD system are developed, including the de-multiplexing, impairment compensation, synchronization etc., which then drive the innovation in system architecture. To date, the local LO scheme contributes to the high-speed system with the repetition rate of 5 GBaud, resulting in 190 Mbps secret key rate at 5 km 143 , as well as a flexible network deployment, which has been demonstrated by the software-defined CV-QKD network in Madrid, Spain 144 .
The use of digital techniques from classical communications has significantly advanced the development of CV-QKD systems, allowing for the completion of most operations in digital domain, and resulting in a system compatible with classical optical communication in the aspect of both architectures The overview of the CV-QKD system, including the typical systems, key techniques and the appliactions. Here we mainly show the long-distance, chip-based and high-speed system, as well as the key techniques including the reconciliation, chip-based devices and digital techniques. and algorithms 145 . Meanwhile, the advanced progresses of the homodyne detector integrated on chip have shown the potential of a compact system with high-performance, where the baud rate of the system using chip-based homodyne detector can reach 10 GBaud 146 . Additionally, the implementation of a high-rate downstream point-to-multipoint CV QKD network can facilitate large-scale deployments, enabling multiuser access with low-cost devices and simplified network structures 147 .
An overview of the typical CV-QKD systems, key techniques and application scenarios is presented in Fig. 2. These typical system achievements, supported by the advanced reconciliation, digital signal processing (DSP) and chip-based devices, have proved that the CV-QKD system is suitable for the metropolitan network and access network, as well as the free space communication and co-existing with the classical optical networks. With these advanced techniques, a largescale cost-effective QKD network supported by advanced CV-QKD systems is on the away.
In all this panorama, the present review aims at providing an overview of the most important results and the most recent advances in the field of CV-QKD system. After a brief introduction of the general notions, we review the main CV-QKD protocols and security analysis in Sec. II. The system structure and key modules are reviewed in Sec. III, and the typical currently-achievable implementations are detailed in Sec. IV, including the in-line LO systems, local LO systems, systems co-existing with classical networks, and so on. We then discuss the advanced progress for future applications, such as digital continuous-variable system and point-to-multipoint network, in Sec. V. Finally, we will discuss the practical security of the system in Sec. VI and conclude with promising perspectives in this research field in Sec. VII.

II. CV-QKD PROTOCOL AND SECURITY PROOF
The CV-QKD system relies on a protocol to establish the system's operating procedures, where the security of the protocol is determined by security proof. In this section, we introduce the basic notions, the CV-QKD protocols and security analysis.
A. Basic notions of continuous-variable systems A continuous variable system is a typical infinite dimensional quantum system. Suppose that a CV system consists of a sequence of n modes in the Hilbert space H = ⊗ n i=1 H i , there are n pairs of annihilation and creation operators â i ,â † i with i = 1, 2, ..., n, which satisfies For each mode, we can correspondingly define the operatorsx andp asx which are so-called quadratures of electromagnetic field, and the quadratures can be described by a n-mode vectorr = (x 1 ,p 1 ,x 2 ,p 2 , ...,x n ,p n ) T . Using the standard bosonic canonical commutation relations as well as Eq. (1) and (2) we can easily get which gives the well-known Heisenberg uncertainty relation Here, ∆Â = (⟨Â 2 ⟩ − ⟨Â⟩ 2 ) 1/2 . Now it is straightforward to derive the following relation where Ω = n i=1 0 1 −1 0 .
Gaussian states are the states that their characteristic function is a Gaussian function in phase space. Its displacement operator can be defined as d = ⟨r⟩ = Tr [ρr] , while the positive-semidefinite symmetric covariance matrix is defined as where {} denotes the anticommutator, and ρ is a general density operator. Since a state is Gaussian if its Wigner function is Gaussian, it is completely characterized by the first two statistical moments, the mean value d, and the covariance matrix γ.
Since all physical existed Gaussian states should obey the Heisenberg uncertainty relation, therefore the covariance matrix is generally 148 .
The most common single-mode Gaussian states include vacuum state, coherent states and squeezed states. The vacuum state is centered at the origin of the phase space and the FIG. 3. The preparation of a squeezed (a) or coherent state (b) using homodyne or heterodyne detection on one mode of the EPR state. HOM: homodyne detection, HET: heterodyne detection. covariance matrix is an identity matrix. The coherent states are the displaced vacuum state with non-zero displacement vectors d = (d x , d p ). Thus, the covariance matrices of the coherent states are also identity matrices. The squeezed states can be obtained by squeezing coherent states at one of the two quadratures. Suppose the states are squeezed on x quadrature, the conjugate p quadrature is anti-squeezed.
For two-mode Gaussian states, the commonly used states in CV system are two mode squeezed vacuum states, which can also be noted as the Einstein-Podolsky-Rosen (EPR) states in continuous-variable system 149 , of which the covariance matrix reads γ EPR = cosh 2r I 2 sinh 2r σ z sinh 2r σ z cosh 2r where r is the squeezed ratio, and V is called the variance of the EPR state. In particular, performing homodyne detection on one of the modes of an EPR state results in the other mode being projected on a squeezed state, while performing heterodyne detection on one of the modes of an EPR state results in the other mode being projected on a coherent state 150 , as shown in Fig. 3.

B. A historical outline of CV-QKD protocols and the current security status
The first CV-QKD protocol was proposed in 1999, using squeezed states to achieve secret key distribution 103 . However, due to the challenges in preparing squeezed states, a protocol of using coherent states and homodyne detection to distribute secret key was proposed in 2002 105 , namely the GG02 protocol. Because the coherent states can be easily generated by a laser, this protocol has received an increasing attention in recent years. Subsequently the protocol based on Gaussian modulated coherent states got further development. The no-switching protocol was reported in 2004 106 , in which heterodyne detection instead of homodyne detection is used.
In 2009, heterodyne detection was also utilized in the Gaussian modulated squeezed-state protocol and an improvement of performance is found 158 .
Although Gaussian-modulated CV-QKD protocols have undergone extensive study and development, there remain technical challenges to implementing ideal Gaussian modulation in experiments. Therefore, discrete modulated CV-QKD protocol 155 was proposed. The initial discrete modulated CV protocol is the four-state modulation protocol, where a modulation method similar to QPSK in classical communications was used. Soon afterwards, A. Leverrier 182 highlighted that CV protocols can be used for secret key distribution with multi-dimensional discrete modulation. In addition to discrete modulation, other modulation methods are also considered, including unidimensional modulation 156 . It simplifies the modulation process at the Alice side can be compared with the GG02 protocol when the excess noise is small.
Generally, the classification of standard one-way CV-QKD protocols, in which the quantum state passes through a single channel, can follow the type of the used quantum states (coherent or squeezed), the methods of modulation (Gaussian modulation, unidimensional modulation or discrete modulation) or the type of measurement (homodyne or heterodyne). In addition to the one-way protocols, various other protocols correspond to different application scenarios are proposed, such as two-way protocols, source-device-independent protocols, measurement-device-independent protocols, and so forth.
In 2008, the original two-way protocol was proposed 166 , in which an optical switch was used to randomly switch between two working statuses "ON" or "OFF". The tolerable noise on ON mode is higher than that of one-way protocol. How-ever, the use of optical switches cannot meet the demand for high-speed quantum key distribution. Subsequently in 2012, an improved two-way protocol is reported 168 , in which Alice uses a Gaussian modulated coherent state and a beam splitter to replace the ON-OFF switch and translation operation in the original two-way protocol. Very recently, the protocol is proved to be secure in the finite-size regime 167 . In addition, the unidimensional two-way CV-QKD protocol is proposed to simplify the system realization and is proved to be secure against collective attack 183 .
It should be noted, however, that the one-way and two-way protocols can be considered theoretically secure only with the trustworthy equipments. The issue of practical security remains a major concern due to the possible mismatch between practical devices and theoretical assumptions. An optimal solution would be a device-independent protocol, in which system security is not influenced by the trustworthiness of the devices. However, since achieving comprehensive device independence is challenging, semi-device-independence protocols have been developed and well studied, including the MDI protocols 172,173 and the source-device-independent (SDI) protocols 184 . These protocols eliminate certain assumptions regarding the reliability of the devices and, thus, close the corresponding security loopholes.
The CV-MDI QKD was independently proposed by Z. Li et al. 172 and S. Pirandola et al. 173 , in which Alice and Bob are both senders, preparing coherent states and send-the MDI protocol. The CV-SDI QKD protocol was initially proposed in 2013 and has been demonstrated to be resistant to collective attacks 184 . Furthermore, Y. Zhang et al. supplemented the security proof in 2020 185 . Similar to the CV-MDI QKD, the CV-SDI QKD protocol does not make any assumptions about the source's credibility. In this protocol, an entanglement source is positioned between Alice and Bob as both Alice and Bob are receivers. In addition, there are also some special CV-QKD protocols such as using a thermal state as the source, so called the passive protocol 186 .

C. Security analysis
Before starting the security analysis, it is essential to introduce two equivalent schemes, namely the prepare-andmeasurement (PM) scheme and the entanglement-based (EB) scheme, as shown in Fig. 4. These schemes differ mainly in the method of preparing quantum states. In the PM scheme, Alice generates the states with a light resource, usually a laser, whereas in the EB scheme, Alice generates EPR states. As homodyne (heterodyne) detection performed on one mode of the EPR state has the effect of projecting the other mode onto a squeezed (coherent) state, the transmitter's outputs of both methods are identical for a third party. Therefore, both schemes are equivalent to Bob and Eve, which is an important property. FIG. 4. The PM protocol and the equivalent EB protocol in CV-QKD. The most important steps in a CV-QKD protocol are the state preparation, the measurement and the error correction. The main difference between these two types of the protocols are the state preparation, where the coherent state preparation is equal to the heterodyne detection on one of the modes of the EPR state, and the squeezed state preparation is equal to the homodyne detection on one of the modes of the EPR state.
It is important to note that although both schemes are equivalent, they are used in different application scenarios. For instance, the PM scheme is used for experimental implementation, whereas the EB scheme is used for theoretical analysis due to its ease of calculation. Our analysis is based on the EB scheme in the following part.
Reconciliation is the key technique to make Alice and Bob share a same bit string, which can be categorized into two types, the direct reconciliation and the reverse reconciliation. In direct reconciliation, the detection data is corrected to the modulation data, however, the tolerable channel loss is limited under 3 dB. Reverse reconciliation is proposed to solve this issue, by correcting the modulation data to the detection data.
In the aspect of an eavesdropper, the attack strategy can be categorized into 3 types, individual attack, collective attack and coherent attack. In individual attack, Eve manipulates and measures the transmitted states independently and identically. In collective attack, Eve manipulates the transmitted states independently and identically, but measures them jointly. While for coherent attack, Eve manipulates and measures the transmitted states jointly. Usually, coherent attack is the strongest one, while in asymptotic case the collective attack is normally the most powerful coherent attack.

Gaussian-modulated protocol
The protocols based on Gaussian modulation are the most fundamental among all CV-QKD protocols, which are usually categorized into four types based on types of quantum states (coherent or squeezed) and detection methods (homodyne or heterodyne). So far, the protocols based on Gaussian modulated coherent states which can be generated by the off-theshelf laser have received much attention. Therefore, we detail the security analysis of the Gaussian modulated coherent state protocol, and briefly introduce the squeezed-state protocol.
The security indicator is the secret key rate. If the secret key rate is greater than zero while considering attacks, then Alice and Bob can distill a secret key under the attack. Otherwise, the protocol will not be effective. The asymptotic secret key rate with reverse reconciliation can be given by 187 where I AB is the classical mutual information between Alice and Bob, that can be easily estimated, normally written as for homodyne and heterodyne detection. Here V is the variance of EPR state owned by Alice, V B is the variance of the state Bob receives, V A|B is the conditional variance given Bob's measurement result. χ line = 1/T − 1 + ε is the total channel-added noise expressed in shot noise units, relevant to the channel parameters, including the transmittance (T ) and excess noise (ε). Since mainstream CV-QKD implementations use reverse reconciliation, where the modulation data is corrected to the detection data, the quantum mutual information between Bob and Eve, S BE , is the concern. It is pointed out that the maximum information available to Eve is bounded by Holevo quantity 188 : where S (E) is the von Neumann entropy of the eavesdropper's state ρ E , and S (E|m B ) is von Neumann entropy conditional on Bob's measurement result and is determined by the detection method. Based on the fact that the eavesdropper Eve is able to purify the binary quantum system ρ AB , Eq. (12) becomes As for χ BE , usually we use the Gaussian extremity theorem to find its upper bound 189 , corresponding to the lower bound of the secret key rate. This means there always exists a Gaussian state ρ G AB with the same covariance matrix as ρ AB who makes Specifically, calculations of S ρ G AB and S ρ G AB|m B can be simplified using the symplectic eigenvalues of the covariance matrix γ AB and γ AB|m B respectively, corresponding to the states ρ AB and ρ AB|m B . Covariance matrix γ AB can be estimated from the modulation and detection data (15) then γ AB|m B is given by Here, H is the symplectic matrix on behalf of the measurement operation on mode B, and can be written respectively: where X = 1 0 0 0 (for homodyne detection on p quadrature, we use P = 0 0 0 1 ), and MP represents for the Moore-Penrose pseudo-inverse of a matrix. Notice that γ A , γ B and σ AB are the subsmatrices of the covariance matrix γ AB as detailed in Eq. (15). Generally, the symplectic eigenvalues of a covariance matrix γ can be achieved by calculating the eigenvalues of iΩγ. For the two-mode system, one can easily achieve the analytical solution, as detailed in Table. III, where S (AB) can be calculated with λ 1,2 , and S (AB|m B ) can be calculated with λ 7 for homodyne detection and λ 12 for heterodyne detection. where Similarly, the case with direct reconciliation or the security analysis of squeezed states protocols can be analyzed, for simplicity, the analytical solutions are concluded in Table. III.

Discrete-modulated protocol
The earliest investigation on discrete-modulated CV-QKD is in 2009, when the transmission distance of a CV-QKD system is limited to less than 30 km due to the lack of the efficient error correction strategy, and the proposed discrete-modulated protocol reduces the requirement of error correction, which can be a promising way to enhance the system transmission distance 155 .
The early security proof requires the linear channel assumption, where the input-output relations of the quadrature operators in Heisenberg representation are given by X out = g X X in + B X , P out = g P P in + B P .
Here the added noises B X , B P are uncorrelated with the input quadratures X in , P in . Only based on this assumption, the covariance matrix describing the system after the quantum state transmission can be written as where V M , T , and ε correspond, respectively, to modulation variance (V M = V A − 1, V A is the variance of mode A), the channel transmittance, and the excess noise estimated experimentally in the prepare and measure scenario. Here, Z is a function of V M . Once the covariance matrix is achieved, the Gaussian extremity theorem can be used to calculate the upper bound of the eavesdropper's knowledge, which is similar to the security analysis method in Gaussian-modulated protocol. Then, the lower bound of secret key rate can be derived. The linear channel assumption is adopted since the quadrature measurement of one mode of an EPR state cannot directly map the other mode to a group of discrete-modulated coherent states. This results in the lack of covariance item Z in the covariance matrix, leading to the need for an additional assumption. If considering general case without linear channel assumption, the unknown of Z will lead to the worst-case estimation of the secret key rate, which is zero. Since the security proof of the discrete-modulated CV-QKD is not perfect, the discrete-modulated CV-QKD system is less concerned for a period of time. This situation did not change until 2018, as the security proof of discrete-modulated protocols gradually improved and no longer required linear channel assumptions 125 . The eavesdropping behavior can be bounded through methods such as the uncertainty principle 125 , the semidefine programming 126,127 , and the entropy uncertainty 129 , then the secret key rate of the protocol can be obtained by searching for the lower bound.
Introducing an auxiliary mode into the EB scheme is a feasible strategy to continuously use the security analysis method based on covariance matrix 125 . Before sending the mode into the unsecured quantum channel, the mode is divided by a beamsplitter, and one of the output mode is preserved by the sender. This preserved mode can be used to construct correlations between Alice and Bob. Therefore, the covariance matrix describing the system contains 3 modes, which weakens the negative influence of the undefined covariance on secret key rate. This works for arbitrary discrete modulation formats, specifically, 256 QAM with Gaussian probability shaping performs close to the Gaussian modulated protocol, and the 64 QAM system can still support the transmission of more than 100 km.
Specifically, after the transmission of the quantum state, the covariance matrix of the quantum state shared by Alice and Bob can be written as where γ A , γ C , and φ AC can be theoretically calculated, φ CB , γ B can be estimated through the measured data, and only the covariance term κ AB is unknown. Since the covariance matrix γ N for a N-mode state is constrained by the uncertainty principle (Eq. (7)). The constraint set S κ which limits the possible value of κ AB can be obtained as and the maximum value of S G BE can be obtained by searching in the set.
Overall, the secret key rate at the asymptotic limit can be FIG. 5. The performance of different heterodyne detected discretemodulated CV-QKD security analysis, including the linear SDP (red and blue line), the nolinear SDP (purple line) and the security analysis using uncertainty principle (UP) (green line). The modulation variance are the optimal for different security analysis. The performance of the no-switching protocol is also presented (yellow line). calculated as follow: where I(M A : H B )is the classical mutual information, and β is the reconciliation efficiency.
In 2019, S. Ghorai et al. proposed another security framework based on formulating the above problem as a semidefinite program (SDP) and focused on analyzing the security of a QPSK protocol 126 . In this framework, SDP is used to search a state bounded by specially designed statistics between modulation and detection data. It can be extended to a high-order modulation format and can be derived with an analytical solution of secret key rate in a symmetric modulation case 128 .
Soon later in 2019, J. Lin et al. proposed another strategy to analyze the security of a discrete-modulated CV-QKD protocol with SDP 127 . The security of two QPSK protocol, with homodyne and heterodyne detection respectively are analyzed. It adopts a mapping and postselection based on the detection data to construct the positive operator valued measurement of the receiver. In principle, this security framework can also be extended to high-order modulation format, but practically, it is limited by the demand of high computational resource.
In the method proposed by J. Lin et al. 127 , the secret key rate under collective attacks in the asymptotic limit can be can rewritten as where D(σ ∥τ) := tr(σ logσ ) − tr(σ logτ) is the quantum relative entropy, G is a completely positive map related to the postselection in terms of actions on the bipartite state ρ AB and Z is a completely positive trace preserving map related to the key map, δ EC stands for the actual amount of information leakage per signal and p pass is the sifting probability.
In the transformed formula, only the first term is unknown, so the rate calculation problem has become a convex optimiza-tion problem for solving the minimum value of the first term in the formula. The set S is the feasible set of the optimization problem, which contains all bipartite density operators ρ AB that are compatible with experimental observations. From the measurement of Bob, the expectation values of the first and second moments of the quadrature operators ⟨x⟩, ⟨x 2 ⟩, ⟨p⟩, ⟨p 2 ⟩ can be obtained. In addition, the operatorŝ n =â †â andd =â 2 + (â † ) 2 to constrain ρ AB .
In addition to the security analysis methods we mentioned above, there also exists some other strategies that can reach security under finite-size effect, such as the binary modulated protocol 198 , and the QPSK protocol using the entropy accumulation 199 . The recent progress of the security analysis of discrete-modulated protocol is shown in Table. IV and the performance is shown in Fig. 5. In conclusion, the mainstream strategy to provide a general security analysis of the discrete-modulated protocol is to introduce more correlation between Alice and Bob, which contributes to a tighter bound on the possible eavesdropping behavior.

Practical protocol with trusted noise
The practical measurement of a CV-QKD system usually suffers from the imperfect detection efficiency and electronic noise, leading to the increase of channel loss and excess noise. However, since the devices inside the receiver can be trusted, a tighter estimation to the potential eavesdropping behavior is achievable through an accurate calibration of the imperfections. Normally, the detector of a CV-QKD system is trusted, therefore the loss and noise inside the detector can be trusted modeled by an EPR state with one mode (denoted as F 0 ) coupled into the signal path by a beam splitter 200 . The trusted detector module significantly enhances the transmission distance and the secret key rate of the system, which is demonstrated in the early experiment 132 . Further, the feasibility of FIG. 6. The EB scheme of the seucurity analysis with trusted detector module. The structure of Alice is the same as preparing coherent state with EPR states. The beamsplitter at the receiver site has the transmittance of η, and the variance of the EPR state is Here, ν ele is the electronic noise of the homodyne detector.
enhancing the system performance using optical amplifiers is proved [201][202][203][204][205] . As shown in Fig. 6, here we denote the output mode after the coupling as F, and the other mode of the EPR state as G. The transmittance of the beam splitter, η, reflects the detection efficiency. The variance of the EPR state is written as, where ν ele reflects the variance of the electronic noise of a homodyne detector. For heterodyne detection, ν ele should be replaced by 2ν ele . The security analysis is based on the covariance matrix γ AFGB For convenience, we will discuss both homodyne and heterodyne scenarios simultaneously in this section. A practical detector is characterized by an efficiency η and a noise ν ele due to detector electronics. As we did for the channel, we can define a detection-added noise referred to Bob's input and expressed in shot-noise units that we devote in general as χ h , and is given by the expressions and for homodyne and heterodyne detection, respectively. The total noise refered to the channel input can then be expressed as The mutual information between Alice and Bob is given in the case of practical protocol with trusted noise by the same expressions as Eq. (11) by replacing χ line to χ tot . The upper bound of Eve's knowledge, χ BE becomes where λ ′ 1,2 represent the symplectic eigenvalues of covariance matrix γ AB . λ ′ 3,4,5 represent the symplectic eigenvalues of covariance matrix γ AFGB|m A which is given by Here, γ AFG and σ AFGB are the sub-matrix of γ AFGB . The symplectic eigenvalues can be given by expressions of the form, and λ ′ 5 = 1. For the homodyne case, and for the heterodyne case, where ∆, D are given in Table. III.

III. CV-QKD SYSTEM AND KEY MODULE
In this section, we will provide an overview of the architecture and the details of the main modules in a CV-QKD system. A summary of the current status of the key modules in a CV-QKD system using coherent states can be found in Table V. Generally, CV-QKD system can be categorized into two types, the in-line LO and the local LO 120 . As shown in Fig. 7, of all the differences between these two types of systems, the greatest one is whether the LO is generated inside the receiver. For the in-line LO system, as shown in Fig. 7 (a), the light generated by the laser source is divided, where part of the light is modulated and attenuated to quantum level, while the other part of the light is used as the strong LO. The quantum signal and LO are then multiplexed and transmitted to the receiver simultaneously. For the local LO system, displayed in Fig.  7 (b), in principal the transmitter only need to modulate and send the quantum signal, and the receiver uses the locally generated LO to perform coherent detection, which simplifies the system structure and prevents the access of LO by Eve. These two different system schemes result in different main noise source, therefore various system architectures are adopted for suppressing the excess noise and raise the secret key rate.
Generally, the structure of a CV-QKD system can be concluded in Fig. 8. The transmitter and receiver are the optical modules of the system, which are responsible for the information encoding and decoding.
The transmitter consists of the laser source, the modulation module and the monitoring module. The laser source can be pulsed or continuous-wave light. The mostly commonly employed modulation formats are Gaussian and discrete modulation. Additionally, the modulator must modulate and multiplex a classical auxiliary signal with the quantum signal, which is the LO in an in-line LO system and the pilot tone in a local LO system. The quantum signal is multiplexed with LO or pilot tone using time-division, frequency-division and polarization multiplexing techniques. For security reasons, monitoring is typically employed at the output stage.
At the receiver end, the co-transmitted quantum and classical signals are demodulated and detected by shot-noiselimited balanced homodyne detectors. A seperate monitoring module is deployed to ensure the practical security. Several automatic feedback methods are used to calibrate sampling time, polarization, and phase of the quantum states in order to overcome perturbations in the channel due to changing environmental conditions. These calibrations can be realized using either hardware or digital techniques.
To map the output of the detector to the quadrature information, digital signal processing (DSP) is employed with the aim of achieving maximal correlation between the transmitter and receiver. With the assist of digital signal processing, SNU calibration enables the establishment of a connection between theoretical security analysis and the practical system, a crucial aspect of system security. Lastly, postprocessing is processed to extract the secret key bits from the correlation established by the aforementioned procedures. It comprises sifting, parameter estimation, information reconciliation, and privacy amplification. The randomness of the overall system is supported by the quantum random number generator (QRNG), which provides the information of modulation and controls the postprocessing. Randomness determines the security of a CV-QKD system. In fact, all of the random numbers used in a CV-QKD sys-tem should satisfy the true randomness, which is essential to the unconditional security [3][4][5][6] . An outstanding alternative is a QRNG, which exploits the intrinsic random nature of quantum mechanics, acts as a promising method in generating truly FIG. 8. The key modules in a CV-QKD system. The transmitter and receiver form the optical part. Optical fiber and free space are the two kinds of quantum channel, where the optical fiber is the mainstream way to transmit the quantum signals. System control is normally used to realize the synchronization between the transmitter and the receiver. QRNG are deployed at both sides to provide the random numbers for modulation, detection and postprocessing. Shot noise unit (SNU) calibration is the security module which provides the normalized unit of the detection data. Post-processing uses classical channel to exchange the information on modulation and detection data, and getting the final secret key bits. random numbers [206][207][208] .
The random numbers are used for controlling the modulators so that the sender can prepare random coherent states following a certain modulation format, determining the detection basis during homodyne detection, and constructing mappings or universal hash functions in postprocessing. Specifically, Gaussian distributed random numbers, Rayleigh distributed or uniformly distributed random numbers in continuous-variable form are required in Gaussian modulation of coherent states. Discrete-variable random numbers are required in discretemodulation, basis selection and postprocessing.
However, the most of the QRNG generates random numbers that are uniform distributed. Therefore, a transformation from the uniform distributed random numbers to the Gaussian distributed random numbers would be a mandatory step. There are several ways of transforming the uniform distributed random numbers into the Gaussian distributed random numbers. For example, the CDF Inversion Method 259 , Box-Muller Transform 260 , Central Limit Theorem 261 , Piecewise Linear Approximation using Triangular Distributions 262 , Rejection methods 263 and so on. Typically, the Box-Muller Transform is one of the most widely used methods. It is based on the independent samples, U 1 and U 2 , chosen from the uniform distribution on the unit interval (0, 1). Let Then Z 0 and Z 1 are independent random variables with a standard normal distribution. A discrete-modulated CV-QKD system can naturally avoid this issue, where the only step using continuous-variable random numbers, the Gaussian modulation, is replaced.  9. (a) The structure of modulation module for quantum signals. QRNG is used for providing modulation data, AM and PM is used to load the modulation information, and variable optical attenuator is used to adjust the intensity of quantum signal to quantum level. (b) The modulation module using IQ modulator. (c) A simple structure of the phase modulator, which consists of a PIN junction. (d) The structure of the amplitude modulator, which consists of two phase modulators. (e) The structure of the IQ modulator, with two amplitude modulators and one phase modulator.

B. Transmitter
The function of the transmitter of a CV-QKD system is to prepare the modulated quantum signals and the classical auxiliary signals such as the LO and pilot tones. It usually consists of the laser source, the modulation module and the monitoring module.

Source
Laser source usually requires the narrow linewidth and low relative intensity noise to achieve high-performance and stability. Among the wide range of lasers, fiber lasers are the most commonly used, which is advanced in monochromaticity, directionality, and stability. The distributed feedback lasers and external cavity lasers are also adopted in some systems [265][266][267] .
The laser source can be pulsed or continuous-wave form. The pulsed laser source usually consists of a laser diode with amplitude modulators, while the continuous-wave laser source only requires a narrow-linewidth laser diode. In the early stage of CV-QKD system, pulsed light is naturally used since the separation in time domain provides a clear understanding of different quantum states. Moreover, it is suitable for time division multiplexing to suppress the crosstalk between quantum and classical auxiliary signals. Since the necessary classical auxiliary signal is around 10 4 to 10 8 photons per pulse, to eliminate the leakage from the classical pulse to quantum signal pulse, the required extinction ratio is normally about 80 dB or more. Usually a conventional amplitude modulators has an extinction ratio less than 40 dB, therefore, two or more cascaded amplitude modulators are required for pulse generation 268 .
As the system repetition frequency increases for higher performance, it is harder to achieve pulses with high extinction ratio and high repetition frequency simultaneously, resulting in the demand of directly using continous-wave laser source. Meanwhile, the local LO system reduces the crosstalk between quantum and classical signals, which relaxes the requirement of the extremely high isolation. Therefore, the continous-wave laser source without the complex cascaded amplitude modulators is widely used in the recent local LO systems 143,[269][270][271][272][273] . However, for an accurate interference with signals from two different lasers, the laser diodes in an local LO system require narrower linewidth. In addition, a laser locking module can be optionally used to reduce the phase noise.

Modulation
The light output from the laser source is then modulated to encode the quantum information, generate the classical signals such as frame signals, and the LO or reference signal, which are combined at the output of the transmitter through various multiplexing techniques. In this part, we will detail the modulation process in three steps, encoding information, controlling the average power of quantum signal and adding classical auxiliary signals.
For encoding information, two mainstream methods are adopted as shown in Fig. 9 (a) and (b). One is the combination of a phase modulator and an amplitude modulator, and the other is the use of an in-phase quadrature (IQ) modulator. The structure of the modulators used here is detailed in Fig. 9 (c), (d) and (e). The modulation format of a CV-QKD system includes Gaussian modulation and discrete modulation, as shown in Fig. 10 (a) and (b). Both of them require displacements of coherent states on two quadratures of the phase space. An exception is the unidimensional modulation shown in Fig.10 (c), which only requires the modulation of one quadrature and can be realized with a single amplitude modulator. In addition, the Phase Shift Keying (PSK) discrete-modulation only requires a phase modulator for encoding, as shown in Fig. 10 (d).
In fact, using the phase and amplitude modulators or using an IQ modulator, are the different perspectives of a twodimensional distribution, as shown in Fig. 10 (a) and (b). Take the Gaussian modulation as an example, for an IQ modulator, if we denote I and Q as the data loaded to the in-phase and quadrature path of the IQ modulator, which corresponds to the x and p quadrature on phase space, they should obey normal where σ 2 is the variance, N represents the normal distribution. For phase and amplitude modulators, the information is loaded with a polar coordinate system, therefore requires the Rayleigh distributed amplitude, and the uniform distributed phase information. We remark that, sometimes the x or p quadrature is also called basis, but it is different to the basis in single-photon protocol since the security of CV-QKD is not determined by quadrature selection. Actually, the security of a coherent state CV-QKD system is ensured by the indistinguishability of coherent states on phase space. There also exists a noval CV-QKD protocol based on the basis encoding, where the secret information is encoded on the random choices of two measurement basis, and the security against individual attack has been proved 274 . The scheme exhibits the potential to tolerate high excess noise.
For practical implementations, we remark that these two methods require different acquisition 275 . Besides that, the working parameters of the modulators should be accurately adjusted, since the imperfect modulation may increase the excess noise and open security loopholes 276 .
After the encoding, one should adjust the average power of the prepared quantum states to a proper level. Although in principle, CV-QKD protocols can use the quantum states with high average power, the practical implementations always require the extremely low average power in a few photon number level, since the practical devices with limited resolution cannot measure the quantum characteristics of the high-power states. Using the variable optical attenuator with manual adjustment or automatic control is a general method to adjust the level of attenuation, as shown in Fig. 9. Further, Y. Zhang et al. used an amplitude modulator to realize the real time attenuation control. It allows one to flexibly raise the launching power of the frame signals for better SNR, and reduce the power of the quantum signals 139 .
In addition, the passive-state-preparation CV-QKD without modulation modules has also been proposed, where the transmitter consists of a thermal source, beam splitters, optical attenuators, and homodyne detectors 186,277,278 .
In the earliest experimental demonstrations, the quantum signals and the LOs are transmitted separately 130 . Later, in order to avoid any polarization and phase drifts that may occur between the signal and LO over long-distance fiber transmissions, time division multiplexing scheme was proposed to cotransmit the quantum signals and the LOs in the same fiber 132 . In another literature, B. Qi et al. also co-transmitted the quantum signals with the LOs, but adopted a scheme combining polarization and frequency multiplexing 279 . In later experimental demonstration, the co-transmission schemes basically adopt the combination scheme of time multiplexing and polarization multiplexing 133,136,137,139 . In this way, the leakage from the LOs to the quantum signals can be maximally suppressed, while maintaining a relatively simple implementation structure.
For local LO systems, though LO is generated by the receiver, a classical reference signal is still necessary for phase recovery. Early local LO systems using pulsed laser source is suitable with time division multiplexing, where the quantum signal and the classical pilot tone are alternately transmitted 141,142 . It can be combined with the polarization multiplexing to suppress the leakage of the pilot tone 280 . Towards high-speed and continuous-wave system, frequency division multiplexing of quantum signal and pilot tone is widely used 269,270,273 . Since the power of pilot tone is far lower than that of the LO, the requirement of isolation is relaxed. It can also be combined with polarization multiplexing for higher isolation 143,271 .
Besides the LO or reference signal, some classical frame signals are inserted in the quantum signal sequence to provide the essential information for synchronization, phase compensation, et al.. These frame signals are usually generated by the same modulation module of quantum signals, and time division multiplexed.

Transmitter Monitoring
A source monitor is deployed after the modulation module to evaluate Alice's real output state by detecting a fraction of the signal before entering into the quantum channel. It can be categorized into the active source monitor and the passive source monitor. As shown in Fig. 11 (a), the active source monitor adopts the optical switch for getting a part of the signal for monitor, while the passive source monitor uses a beam splitter to divide the quantum signal for monitor, shown in Fig.  11 The monitor module can be a homodyne or heterodyne detector, which provides the statistic of the modulated coherent states, including the modulation variance, which is related to the power of the modulated signals. Besides, for Gaussian modualtion, since the modulation variance corresponds to the average photon number, which is related to the optical power, an optical power meter can replace the homodyne or heterodyne detector for source monitor.
Specifically, for Gaussian modulation, we can get where V = V M + 1 is the variance of the mode, and V M is defined as the modulation variance. The average photon number of the output mode,n, can be achieved by detecting the power of the output signal, denoted as P out . Each photonic has the energy of E = hν, where h is the Plank constant and ν is the frequency. Assuming N pulses are detected, where N is a sufficient large number, and the repetition frequency of the system is f rep . The average photon number can be achieved by Therefore, the modulation variance is V M = 2P out f req /(hν). If we denote the modulation variance of the electrical data as V e M and assume the modulator works linearly, the scale coefficient can be achieved as c = V M /V e M . Therefore, the output of the sender can be denoted by is the calibrated modulation data on phase space.
In this way, one can define the data of state preparation on phase space corresponding to the electrical modulation data entered into the modulation module, and the estimated average power of the output quantum states, which is a crucial step for security analysis of a practical sytem.
The source monitor also contributes to a tight estimation of channel parameters. In a practical system, the laser fluctuation 281 , imperfect modulation 276 and other factors introduce source noise into state preparation stage 282 . It has been shown that the secure key rate may be undermined by the source noise 159,283,284 . Traditionally, source noise is ascribed into the channel noise to calculate the secure key rate, while in practice it is controlled neither by the eavesdropper (Eve), nor by legitimate users. So, this untrusted source noise model just overestimates Eve's power and leads to an untight security bound. By real-time monitoring the modulated quantum signals, the source noise can be calibrated and removed from the channel noise, which helps to enhance the system performance.
In addition, for practical security considerations, the monitoring module of the source can help to resist the potential attacks on the system by injecting a strong light, such as the Trojan-horse attack 285 , which can open a side channel for Eve. The monitoring structure is shown in Fig. 11 (c), where a circulator isolates the injected light from the components inside the transmitter, and directs it to the monitoring module, which can be a homodyne detector, or an optical power meter. The specific attack methods and countermeasures are detailed in the section of practical security.

C. Receiver
The receiver of a CV-QKD system should accurately measure the quadrature of the received coherent state on phase space, which normally contains the monitoring, demodulation and detection sub-modules, detailed as below.

Receiver Monitoring
The receiver monitoring module is mainly used to monitor the classical light from the channel, including the wavelength, frequency, power and amplitude of the LO in an in-line LO system, as well as the pilot tone in a local LO system 286 .
Receiver monitoring is essential for an in-line LO system, since the LO is transmitted in the quantum channel, which may be manipulated by Eve, and directly participates in the homodyne or heterodyne detection. For an in-line LO system with polarization multiplexed quantum signal and LO, after the de-multiplexing of the received signal, the LO can be divided by an unbalanced beamsplitter. The stronger output is sent to the detector and the weaker one is detected by a photodiode for monitoring.
Besides that, the monitor also need to ensure that the receiver is not affected by the potential injection of a strong light. Several efficient attacking strategies for the CV-QKD system are aiming at the receiver by injecting a strong light to disturb the detection or shot noise unit calibration process. The attacks and countermeasures are detailed in the section of practical security.

De-modulation
The de-modulation module responses for the compensation and de-multiplexing in optical path to well separate the quantum and classical signals, mainly including the polarization 287 and phase compensation [288][289][290][291] , as well as the de-multiplexing of polarization and time. It also includes the synchronization in hardware layer [292][293][294][295][296] .
Since the quantum signal is transmitted in single-mode fiber while the receiver is a polarization-maintaining system, the compensation of polarization is crucial for reducing the loss of quantum signals. More importantly, it can suppress the excess noise caused by the crosstalk of quantum and classical auxiliary signals in a polarization-multiplexing system. For proofof-principle experiments, the polarization compensation is realized by a manual polarization controller, while dynamic polarization controller with feedback systems is adopted in longterm or field tests 137 .
Phase noise is inevitably introduced in a CV-QKD system, caused by the phase mismatch between quantum signal and LO. Though they are co-transmitted in an in-line system, the differences in transmission paths before and after multiplexing, as well as the disturbance of fiber link, result in different phases. The local LO system is worse, since quantum signal and LO are generated separately. Generally, the phase mismatch consists of the slow-fading and fast-fading ones. The slow-fading phase noise is normally caused by the optical path difference, while the fast-fading phase noise is caused by the channel disturbance and the frequency drift between the two lasers in local LO systems. The slow-fading ones can be compensated with the inserted frame signals, such as the four-state modulated signals. While more reference signals are required for fast-fading phase compensation, such as pilot tones. The phase compensation in optical path is normally realized with a phase modulator. Specifically, for the system with GG02 protocol, phase compensation can be integrated with the phase modulator for detection basis switching.
In a pulsed CV-QKD system, a de-multiplexing operation is usually performed before the homodyne or heterodyne detection to seperate the quantum signals and LO (or pilot tone). After the polarization compensation at the beginning of the receiver, a polarization beamsplitter is used to separate the quantum and classical signals in orthogonal polarization directions. Then, for the time-division multiplexed signals, such as the quantum signal and LO, an optical delay line is adopted to align the quantum signal pulse and LO pulse for homodyne detection. In this structure, a phase modulator in the LO path realizes the basis switching and phase compensation as we mentioned before. Finally, the detection results can be used as the raw data.
The continous-wave system is different, where most of the de-multiplexing and compensation can be realized in digital domain, using the data after the detection. The architecture of the receiver is similar to the integrated coherent receiver in classical coherent optical communications, and lots of algorithms participate in the compensation and de-multiplexing process. We will detail this process in the part after detection. Clock synchronization responses for the alignment of the sampling points at the transmitter and the receiver site. If the sampling points of the receiver are mismatched to those of the transmitter, the correlation between the modulation data and the detection data will be reduced. As for clock synchronization, there are many hardware layer solution, such as transmitting in a cable 297 , in a paired fiber 298 , multiplexing with quantum signal in one fiber by wave-length division multiplex (WDM) 299 , and distilling the synchronization signal from local oscillator. Each of the above options has its advantages and disadvantages. The electric cable is not only expensive and also instable for distant transmission. Transmitting clock signal and quantum signal in the same fiber by WDM can compensate the difference of signal arrival time but may introduce excess noise generated by WDM crosstalk. Distilling the synchronization signal from local oscillator need divide the local oscillator beam. The division of local oscillator power will decrease the maximal transmission distance or require higher gain of homodyne detection to compensate. Transmitting clock signal in another independent fiber will generate the fluctuation between quantum and clock signal.
The recent system normally adopts the clock synchronization in digital domain, using algorithms to realize the above requirements, which will be detailed in DSP part.

Detection
Homodyne detection is the basis of measuring the quantum signals in a CV-QKD system [300][301][302][303][304][305][306][307][308][309][310][311] . As shown in Fig. 12 (a), the quantum and LO signals are interfered by a 50:50 coupler, then the two output signals are detected by two photodiodes. The two branches of the photocurrent generated by the photodiodes are differentiated and output. The differential current contains the information on the quadrature of the quantum signal. A simple derivation of homodyne detection is shown as below.
We define the modes of quantum signal and LO asâ S and a L . Therefore, the output modes of after the coupler arê Then, the photon number of the two output modes can be achievedn FIG. 12. The two mainstream detection strategies in CV-QKD systems. (a) The homodyne detector, where the quantum signal and local oscillator are interfered by a 50:50 coupler, then the two output signals are detected by two photodiodes, finally the output of the two photodiodes, the differential current, is output. A phase shifter is necessary to switch the detection basis between x and p for ensuring the system security.
(b) The heterodyne detector, where the quantum and local oscillator are divided respectively and detected by two homodyne detectors. A phase shift of π/2 between the two local oscillators is introduced to realize the detection of x and p quadratures of the quantum signals. LO: local oscillator, PD: photodiode, Diff: differentiator and HOM: homodyne detector.
The differential current can be written as The strong LO can be seen as a classical light, written aŝ Therefore, one can get We get the measurement result of x quadrature when θ = 0, where and p quadrature when θ = π/2, A homodyne detector can only measure one quadrature at a time but the security analysis requires detection of both quadratures. Therefore a phase modulator is deployed on the path of the LO, for switching the phase difference between the LO and quantum signal between 0 and π/2 randomly. This can realize the function of switching the detection basis, satisfying the requirement of getting the statistic data of both quadratures. Further, by combining two homodyne detector together, a heterodyne detector which enables the detection of both quadratures of the quantum signal is realized, as shown in Fig. 12 (b). It can simultaneously detect the x and p quadrature of a quantum signal since a phase shift of π/2 is introduced to one path of the LO. To avoid the low frequency noise, the heterodyne detection can also be realized by moving the quantum signal to the intermediate band in frequency domain 143,[269][270][271]273 . Both quadratures can be simultaneously distilled with down conversion in analog domain or digitally, while a full architecture is still required to avoid the image band issue. Here we remark that the heterodyne detector in CV-QKD represents the dual-homodyne structure, which has different meanings of that in coherent optical communications.
The homodyne detector can be divided into two types, with direct output and the integral output 315,319,320 . The integraloutput homodyne detector is widely used in the early CV-QKD system since the signal and LO are both pulsed light. Therefore, it requires the integration of each laser pulse and output a field quadrature signal. At this stage, the homodyne detector is heading towards the high bandwidth, balance, and common mode rejection ratio 307,314,[321][322][323] . Later, since the CV-QKD system adopts the continuous-wave light, the directoutput homodyne detector is enough, which has less requirement on the balance, and it is easier to realize a high-speed homodyne detection.
The bandwidth, detection efficiency, electronic noise and quantum to classical noise ratio (QCNR) are the key parameters of homodyne detectors. The bandwidth of the receiver directly affects the settings of the system in frequency domain, including the multiplexing and processing of the quantum and phase reference signals. The detection efficiency is another crucial parameter of the practical homodyne detector, corre-  sponding to the detector parameter η in Eq. (28). It is limited by the photodiodes, and the balance of the two arms of the homodyne detectors. The electronic noise of the practical homodyne detector is vital in the CV-QKD systems, which corresponds to ν ele in Eq. (28). Since the power of the quantum signal is extremely small, a high electronic noise can significantly reduce the SNR, therefore resulting in a low-quality detection. The last parameter that are normally used to describe the homodyne detector is the quantum to classical noise ratio (QCNR). The QCNR demonstrate how good the weak quantum signals can be amplified while suppressing the electronic noise. The general requirement for the QCNR is that it should be at least 10 dB. We also list some reported homodyne detectors with their parameters in Table. VII, common-mode rejection ratio is introduced to reflect the balance of the detector.
The homodyne detector can be integrated on chip driven by the photonics integrated circuit techniques, as shown in Fig.  13. The highly balanced photonics circuit, photodiode with high detection efficiency, and the low noise transimpedance amplifier are the core issues. The 3 dB bandwidth of the chipbased homodyne detector can break 1.5 GHz, the clearance between the shot noise and the electronic noise can reach 28 dB, and the common-mode rejection ratio can reach 80 dB 258 . These meaningful parameters show that the homodyne detectors on chip have achieved high-speed, low electronic noise and excellent balance.
FIG. 14. The power density of measurement. The electronic noise and the superposition of electronic and shot noise (vacuum noise) can be achieved in practical measurements. V d : the variance of total noise, V ele : the variance of the electronic noise. SNU: shot noise unit, which is the variance of the shot noise.

D. Shot noise unit calibration
As we mentioned before, the electrical modulation data is tranmformed to the phase space based on the source monitoring. Correspondingly, the electrical detection data also requires the transmformation, which is realized by shot noise unit (SNU) calibration.
SNU is defined as the variance of the shot noise. In security analysis, the variance of the quantum fluctuation on phase space is defined as unity, while in a practical system, this fluctuation can be measured and recorded as electrical signals, simply by measuring the vacuum. With enough electrical detection data of vacuum state, the variance of the shot noise measurement result can be estimated in a practical system and used for the normalization of the detection data of coherent states. In this way, the electrical detection output can be transformed to the data for security analysis.
However, SNU calibration of a practical system needs to consider the additive electronic noise, which is introduced inevitably by a practical measurement, shown in Fig. 14. Usually, the variance of electronic noise, V ele , can be calibrated independently. Therefore, SNU can be achieved in a practical CV-QKD system with twice measurements. As shown in Fig.  15 (a), the electronic noise in the CV-QKD systems can be directly calibrated as follows: fisrt, turn on the electric power of the homodyne detector, and cut off the two optical input ports, the measured variance is the raw electronic noise. Then, total noise can be calibrated with LO on, shown in Fig. 15 (b). The difference of the two variables is the SNU, denoted as u.  Specifically, considering the limited detection efficiency η d , the detection results of the quantum signal before normalization can be written as Here,x sxv and X ele are the quadrature information of quantum signal, vacuum state (shot noise), and electronic noise. X LO represents the effect of local oscillator, and A is the amplification coefficient of circuits. Therefore, the SNU calibrated with the method we mentioned before is (AX LO ) 2 . In this way, after normalization we can get Based on this normalized output, we can establish the trusted detector module detailed in Section II. The variance of electronic noise, ν ele , is the variance of X ele /(AX LO ). The scheme of the trusted detector is shown in Fig. 16 (a). In fact, this SNU calibration method has been widely applied in the early experimental demonstrations 134,324 through different implementation schemes. However, the LO power and electronic noise are not constant in the practical CV-QKD operations, it tends to drift with the time or temperature changes. Thus, the SNU calibration should be performed in real-time. For example, in the Ref. 324 , the SNU calibration is performed before the CV-QKD operation, which is called a pre-calibration scheme. The SNU would be calibrated through the above method, the raw data which is obtained in the later running of the CV-QKD can be normalized by using the calibrated SNU. This implementation scheme is surely fine in the proof-of-principle demonstrations, but in reality, the fading of SNU may may cause severe security issues. Therefore, monitor scheme that can trace the SNU change should be applied. The implementation scheme based on the combination of the pre-calibration scheme as well as the LO monitor scheme is adopted 133,134 . In this scheme, the pre-calibration still runs before the CV-QKD operation. Also, before the system running, Bob will measure a series of SNU according to different powers of the LO transmitted from Alice. These data would later form a linear relation between the optical power and the SNU. During the CV-QKD system operating, a small portion of the LO is separated and constantly measured. Then, based on the obtained optical power, Bob adjusts the SNU according to the linear relation that has been formed previously. The raw data obtained from the CV-QKD operation can be then normalized by the modified SNU.
Although the conventional SNU calibration method has been applied in many experimental demonstrations, there are still several issues that are unsolved. First, the SNU calibration process is rather complicated, two steps are required at the optical paths. What's more, with the deeper studies on the practical security of CV-QKD, it makes us realize that the existing SNU calibration method can have security loopholes.
Recently, the SNU calibration method has been improved to meet the needs of the practical implementations of CV-QKD systems, and to reduce the complexity of SNU calibration. An improved security analysis with one-time SNU calibration method has been proposed by redefining SNU as In this way, SNU can be achieved by just measuring the total noise, which significantly simplifies the procedure [325][326][327][328] . Therefore, we get Here, V ele is the variance of the electronic noise before normalization. Further, we can get the output after the normalization with SNU ′ as x ′ out = X out / √ u ′ . If we use another vacuum state to represent the electronic noise as X ele = √ V elex ′ v , then we can get where FIG. 17. The DSP routine of a CV-QKD system, which includes upsampling, pulse shaping and multiplexing in transmitter side, as well as de-multiplexing, clock synchronization (sync), static equalization, dwon sampling, dynamic equalization and frame sync in receiver side. RRC means Root-Rasied-Cosine, freq. means frequency, and Pol. means polarization.
This means the imperfect detector scheme in security analysis can be built with two beam splitters, one represents the detection efficiency, the other one represents the electronic noise, as shown in Fig. 16 (b). The beamsplitters represent the electronic noise and the detection efficiency can be can be exchanged in order. Note that, since electronic noise is not estimated in one-time SNU calibration, the output mode of the beam splitter representing the electronic noise cannot be seen as trusted. This means the loss introduced by electronic noise is untrusted, which is the reason that the performance of the protocol with one-time SNU calibration is slightly lower than that using the traditional calibration method 325 . With this novel SNU calibration method, it is possible to achieve a real-time SNU calibration, since we only need to monitor the power of the split LO, without the demand of constantly measuring the electronic noise to finish the calibration procedure. Several experimental demonstrations 137,325 have successfully adopted this SNU calibration methods. A conclusion of the SNU calibration methods in CV-QKD systems is shown in Table VIII.

E. Digital signal processing
For the early systems, digital signal processing (DSP) is mainly used for the compensation in optical layer, such as provding the feedback information for phase and polarization control. Later in the high-speed local LO systems, the DSP is gradually becoming widely used, which is applied to the transmitter and receiver, including the clock synchronization, the static equalization, the dynamic equalization and the frame synchronization. The ultimate purpose of DSP in a CV-QKD system is to maximize the data correlation between the transmitter and receiver, which is consistent with the traditional optical communication algorithm to improve SNR. Therefore, CV-QKD system can widely use the algorithms in classical optical communications, and finally form the current routine, as shown in Fig. 17.
At the transmitter site, for raising the accuracy of the modulation, upsampling is performed before the Root-Raised-Cosine (RRC) pulse shaping 331 . Then, the pulse shaping of the quantum signal is processed to reduce the correlation between each quantum signal and satisfying the definition of a quantum pulse in a CV-QKD protocol. Practically, the signal pulse should be bounded in frequency domain so that the modulation and detection with limited bandwidth will not affect the shape of the signal in time domain. But, this will result in the infinite expansion in time domain. The mostly used solution is the RRC filter, where the integration of each two quantum signal pulse is 0 in time domain while the frequency band is limited, which both satisfies the requirements of the temporal mode of a CV-QKD protocol and the practical implementation. After that, the quantum signal is digitally shifted in frequency domain at the transmitter site, and the pilot tone for phase reference is added. Also, for frame synchronization, a Const Amplitude Zero Auto-Corelation (CAZAC) sequence is added at the beginning of each frame. The widely used CAZAC sequence is the Zadoff-Chu sequence.
For the receiver, the frequency division multiplexed quantum and pilot signal are firstly separated from the output of the detection data, then the quantum signals are down converted to the baseband corresponding to the frequency shift at the transmitter. Secondly, clock synchronization is processed, which is a digital alternative to the hardware solution mentioned before. Subsequently, the static equalization algorithms are performed to compensate the impairments, including the IQ imbalance compensation and S21 compensation, and to recover the signal pulse with matched RRC filter. Down-sampling at the best sampling point is then performed to achieve the information with the best signal-to-noise ratio. Then, the dynamic equalization is processed to compensate the phase and polarization mismatch, normally using Multiple-Input Multiple-Output (MIMO) algorithms [288][289][290][332][333][334][335] . Finally, frame synchronization is performed to align the beginning of the modulation and detection data. The final output of the DSP is treated as the raw data, which is then sent to the postprocessing process.
The order of the DSP steps can be exchanged for the linearity of the algorithms. The coefficients in DSP is normally adjusted dynamically with the system situation for better performance, especially in long-distance or high-noise scene. For this purpose, machine learning is recently introduced to achieve consistently excellent phase estimation under a wide range of pilot signal-to-noise ratios 329,330 . The compatibility with classical coherent optical algorithms significantly promotes the development of CV-QKD, which provides a large number of tools and experience when developing towards high speed and long distance.

F. Postprocessing
The quantum stage is followed by classical data processing steps (normally called postprocessing) as is illustrated in Fig. 19, which includes four steps: base sifting, information reconciliation, parameter estimation, and privacy amplification 336,337 . For this purpose, Alice and Bob use an authenticated channel on which Eve cannot modify the communicated messages but can learn their content. Also, after the steps in postprocessing process, Alice and Bob will perform verification to ensure that the step is successful processed 338 .

Sifting
Base sifting is required for systems with homodyne detection or squeezed states, where only one quadrature can used for each measurement. Bob announces the detection basis after a round, and Alice save the corresponding quadrature data. Further developments of CV-QKD systems such as the heterodyne detection scheme can save the data of both quadratures, resulting in a system without sifting. The procedure is significantly simplified since the switching and sifting of detection basis is removed.

Parameter estimation
The parameter estimation requires Alice and Bob to estimate the security parameters of the system for getting the secret key rate, based on the modulation and detection data. Take the Gaussian modulated CV-QKD system as an example, the key point is to obtain the covariance matrix we detailed in Eq. (21). This requires firstly converting the electrical data to the information on phase space in a PM scheme (detailed in transmitter monitoring and SNU calibration), and then the conversion between a PM scheme and EB scheme. Specifically, we denote the modulation data as (D x B 0 , D p B 0 ) and the normalized detection data as (D x B , D p B ). For EB scheme, the sender performs heterodyne detection on one mode of the EPR state. If the detection results is (x A x , p A p ), the other mode B 0 is projected onto a Gaussian state with This means (x B 0 , p B 0 ) and (x A x , p A p ) has a linear transformation relationship. Note that, here the x and p quadrature corresponds to the modes after a 50:50 beamsplitter, where Here, A is one mode of the EPR state, N is the mode of vacuum state. A x and A p are the two modes after the beamsplitter. (x A x , p A p ) are the x and p quadrature of A x and A p respectively. Therefore the calibrated data (D x B 0 , D p B 0 ) can be converted to (D x Ax , D p Ap ). With (D x Ax , D p Ap ) and (D x B , D p B ), the covariance and variance of x A x , p A p , x B and p B can be estimated. Since mode A x and A p are symmetric, the covariance and variance of x A , p A , x B and p B can be further estimated, which results in the covariance matrix γ AB . Further, for a physical existed convariance matrix, the variance of mode B can be expressed as below where T and ε are the two parameters ralated to the system security, estimated from the modulation and detection data. Based on the security analysis with analytical solution we detailed in Section II, the secret key rate can be calculated. For a fiber channel, the loss and noise corresponds to the physical meanings of T and ε, which can be used for simulating the system performance.
The estimation above is based on the modulation and detection data with infinite size. However, in the practical CV-QKD systems, the length of the data should be limited. The finite-size data length leads to a fluctuation of the estimated parameter. The secret key rate under the finite-size analysis is Here, n/N represents the proportion of the preserved data, since part of the data, m = N − n, is publicized for parameter estimation. χ ε PE BE is the Holevo bound considering the effect of finite size, and the probability that the expression is wrong is ε PE , meaning that the true parameters lie within a certain confidence interval around the estimated channel parameters.
The estimation of χ ε PE BE is based on the parameters, t min and σ 2 max , which lead to the worst-case secret key rate. Here, t min means the minimum square root of the channel transmittance, and σ 2 max means the maximum of the variance of noise. Specifically, Here, z ε PE /2 should satisfy where er f is the error function.
∆(n) is related to the security of privacy amplification, which can be calculated as Here, H X corresponds to the Hilbert space of the raw key, ε is a smoothing parameter, ε PA is the failure probability 340 .

Information reconciliation
Information reconciliation is an essential part of CV-QKD postprocessing, which makes sure that the transmitter and receiver share a same bit string. It consists of two parts, mapping the quadrature results to several bits, and error correction. The reconciliation in practical systems requires the public transmission of part of the information, therefore causes the loss of the secret information, leading to the efficiency lower than 100 %, which can be written as β , Here, H(X) is the Shannon information of the target bit string, leak represents the information leakage during the public transmission (usually the syndrome), and I AB is the mutual information between Alice and Bob. The efficiency of information reconciliation plays a crucial role in the final system's secret key rate and the maximal transmission distance, which is seriously affected by the reconciliation strategy. The early reconciliation strategy corrects the detection data to make it consistent with the modulation data, so called the direct reconciliation 105 . However, the system cannot go beyond 3 dB loss since the potentially leaked information is larger than the information can be utilized be the receiver, which corresponds to the 15 km fiber transmission distance. Aiming at this problem, reverse reconciliation is proposed, where the modulation data is corrected to match the detection data. This enables the system to break the 3 dB limit, making reverse reconciliation the most common information reconciliation strategy in CV-QKD system. The main parameters of the information reconciliation in a CV-QKD system includes the reconciliation efficiency, the frame error rate, the throughput and the SNR range. Different approaches have been explored to increase the reconciliation efficiency for a Gaussian modulation, especially in the regime of a low SNR, detailed in Table IX.
Usually the detection data is converted to discrete format first, then the error correction code for discrete data is used. A first approach is the slice reconciliation using multilevel coding and multistage decoding, as shown in Fig. 20. It is suitable for the detection signal with large SNR, normally more than 0 dB. In principle, this method can extract more than 1 bit of information per pulse. When slice reconciliation is used, the SNR of each layer of data is different, so different error correction codes need to be used for subsequent error correction steps, such as the LDPC code or the Polar code.
The other method called multidimensional reconciliation was proposed to be employed for low SNRs, i.e., below 0 dB 131,352 , which reduces the Gaussian variables reconciliation problem to the discrete variable channel coding problem, shown in Fig. 21. It is suitable for the SNR lower than 0, even to -26 dB, which is the crucial technique for a long-distance CV-QKD system. The multidimensional reconciliation can be combined with the LDPC code or the other codes such as the Raptor codes 353 . The final reconciliation efficiency one obtains with such a scheme depends on two things: The intrinsic efficiency of the error correcting code used on the virtual channel on the Binary Input Additive White-Gaussian-Noise Channel (BIAWGNC). The quality of the approximation between the virtual channel and the BIAWGNC. One can therefore improve the reconciliation efficiency based on these two points.
In a long distance system, where the SNR is low, LDPC code is usually used [354][355][356][357][358][359] . The graphical representation of typical multi-edge-type LDPC is shown in Fig. 22. Towards the practical application, the rate adaptive error correction is proposed to support the system with fading SNR [360][361][362] . In addition, to raise the utilization rate of the raw data, exchanging the order of parameter estimation and reconciliation is pro-  posed. One can process the parameter estimation after the error correction. In this way, the abandoned data for parameter estimation can be reduced.

Privacy amplification
The output of the error correction is a same bit string between Alice and Bob, which can be denoted as K n with n bits. Privacy amplification is finally processed to realize the distillation of secret key, of which the requirements are consistent between CV-QKD and DV-QKD. The initial proposed method is aiming at the case of asymptotic limit 363 , after that, the leftover hashing is used which extends the it to the finite-size case 364 . We denote this operation as G, which is a universal hash function mapping the bit string with length N to L. If the mutual information between eavesdropper and K n is known, a proper privacy amplification can make the eavesdropper's knowledge on the final secret key, K l = G(K n ), close to 0. For practical implementation, the speed of privacy amplification is crucial 365,366 .
The most common method is using Toeplitz matrix, which can be written as The elements on the main diagonal of the Toplitz matrix are equal, and the elements on the lines parallel to the main diagonal are also equal. In this way, a Toeplitz matrix can be easily constructed. With the calculated secret key rate after parameter estimation, the length of the secret key bits can be distilled FIG. 23. The overview of the CV-QKD system development. Since the first demonstration in 2003, the in-line LO system has been subsequently developed. After the early stage development, the in-line LO scheme has effectively supported the long-distance system, by reducing the crosstalk from LO to quantum signals. In 2015, the local LO scheme was proposed, which then heads towards high speed system with advance DSP technique. is known. Assuming the length of K'is L' and the length of K is L, G can be a L × L' Toeplitz matrix.

IV. MAINSTREAM IMPLEMENTATIONS
The main purpose of the early CV-QKD systems is to demonstrate the feasibility of the Gaussian modulation and shot-noise limited homodyne detection 130 . After that, the enhancement of system performance begins. The efficient error correction successfully supports the long distance systems, from 80 km and up to 202 km. Meanwhile, different system strctures are proposed and implemented to suppress the excess noise, where the most representative one is the local LO scheme. The overview of the CV-QKD system development is shown in Fig. 23.
The CV-QKD system is heading towards high secret key rate at long distance. For the early CV-QKD systems, the quantum signal and LO are generated by the same laser in the transmitter and co-propagate through the quantum channel. However, the longer transmission distance raises the requirement of the power of LO, which leads to more excess noise caused by the LO leakage. Meanwhile, the transmission of LO in an unsecure quantum channel makes it easy for the manipulation of LO by an eavesdropper, leading to a security loophole. To solve the issues above, the local LO system with the LO generated at the receiver side is proposed. Here the LO no longer needs to be transmitted through the quantum channel, therefore it never affects the quality of quantum signals and the practical security of the system. However, the system is seriously affected by the phase mismatch between the LO and quantum signal since they are not generated from the same laser source, thus a classical pilot tone generated by the transmitter is necessary in most of the local LO systems for phase recovery.
Though the local LO system still requires the copropagation of quantum and classical signals, the leakage of the pilot tone will not seriously affect the excess noise, since the requirement of the power of the pilot tone is much lower than the LO. Therefore, the multiplexing of the quantum signal and pilot tone is more flexible. Various multiplexing schemes are proposed to adapt to different hardware configurations and system requirements, such as using the frequency division multiplexing, or further combined with polarization multiplexing in high isolation scenarios. Naturally, raising the repetition frequency contributes to the accuracy of phase tracking and phase noise suppression as we mentioned before. To compensate the influence from the limited hardware resources, digital signal processing is introduced. A highly digitized system can compensate both of the polarization and phase change in digital domain, which significantly simplifies the system structure and leads to a more practical system. In this section, we review the development of the in-line LO and local LO systems, as well as the system co-existed with classical network and the other system schemes such as the free-space system and the entanglement-based systems.

A. In-line LO systems
The main feature of the in-line LO CV-QKD system is that the quantum signal and LO are generated by the same laser, therefore the interference at the receiver is not seriously affected by the signal mismatch. However, the large power difference between the quantum signal and LO makes the leakage of LO significantly affect the quantum signal, which is the main noise source of the system. For instance, the average photon number of a quantum signal is no more than 20, but the average photon number of LO is usually higher than 10 7 at the receiver site to provide sufficient power for a high-quality shot-noise limited homodyne detection. The leakage of LO leads to the increase of excess noise. Moreover, longer transmission distance requires higher LO launch power. Therefore, higher isolation between quantum signal and LO is required by the long-distance in-line LO system.
The key to reduce the LO leakage is using multiplexing including time-division multiplexing, the polarization multiplexing and the frequency division multiplexing. The quantum signal and LO are encoded on different dimensions for co-transmission in fiber (that's why we call the in-line LO), and de-multiplexed in physical layer at the receiver 130,[132][133][134][135][136][137][138][139]279,[367][368][369][370] . Now we review the development of in-line LO CV-QKD systems, including the early systems, the long-distance achievements, the chip-based systems, and the field tests. The details of the representative in-line LO system experiments are concluded in Table. X.

Early systems
The first CV-QKD system implementation is realized in 2003, as shown in Fig. 24 (a), where the secret key rate can reach 1.7 Mbps in a loss free channel and 75 kbps in a chan-nel with 3.1 dB loss 130 . The system is based on the free space optical devices, working at the wavelength of 780 nm. Reverse reconciliation is firsly implemented to support a secret key distillation beyond 3-dB limit. The quantum signal and LO are generated from the same laser, where the light outputs from Alice's laser is firstly divided, part of the light is Gaussian modulated as the quantum signal of coherent states, and the other part of the light is used to provide the LO signal. The Gaussian modulation is realized based on the amplitude and phase modulation method with pulsed light. To compensate the phase difference between quantum signal and LO since they go through different path, training sequence is introduced. These features are reserved and improved in the later fiber based CV-QKD systems.
The first all-fiber CV-QKD system is realized in 2007, where 2 kbps secret key rate is achieved with a 25 km (5.2 dB) optical fiber channel 132 . The most important enhancement is that the quantum signal and the LO are co-transmitted in the same fiber to reduce the accumulation of phase noise caused by the seperate transmission. As shown in Fig. 24 (b), the multiplexing strategy is the time division multiplexing using an unbalanced Mach Zender interferometer (MZI) structure. Specifically, the light from the pulsed laser is divided by a 1:99 beamsplitter, where the 1 % weak light path is used to generate the modulated coherent states with amplitude and phase modulators, and the strong light is used as the LO. With a variable optical attenuator, the modulated coherent states are attenuated to the quantum level, which is then time-division multiplexed with the LO by combining with a 99:1 coupler, and then transmitted to the receiver side. The optical delay line deployed in the LO path is used to adjust the gap between quan- tum signal and LO. This time division multiplexing strategy is reserved in the long distance system to enhance the isolation between quantum signal and LO. The de-multiplexing is realized with an unbalanced beamsplitter (10:90) to reduce the loss of quantum signal, where the quantum signal with high power is interfered with the low power LO after the beamsplitter. A delay line is deployed at the quantum signal path to align the signal pulses. Besides, the automatic system control is introduced into the system, where the average power of the quantum signal is monitored and real-time adjusted to adapt the SNR requirement of error correction. The training sequence is used for synchronizing Alice and Bob, and determining the relative phase between the signal and the LO. An automatic adjustment of the bias voltages that need to be applied to the amplitude modulators in Alice's site is performed in every 10 s. The repetition rate of the system is 350 kHz, the detection efficiency of the detector is 0.606. The modulation variance of the system is 18.5, and the excess noise is 0.005. B. Qi et al. realized a CV-QKD system over 5 km fibers using polarization and frequency division multiplexing to cotransmit the quantum signals and LO 279 . The final secret key rate at 5 km is 0.3 bit/pulse. As shown in Fig. 24 (c), the quantum signals and LO in different polarizations are combined with a polarization coupler, and de-multiplexed at the receiver by another polarization beam splitter. The frequency division multiplexing is realized with an acousto-optic modulator. By applying both polarization and frequency division multiplexing, the isolation between quantum signal and LO comes up to 70 dB, well preventing the LO leakage. An isolator is placed in the signal arm of Bob's MZI to reduce the noise due to multiple reflections of LO. The phase compensation on hardware layer is replaced by a digital compensation at Alice's site. The noise from the receiver is assumed to be independent from Eve's control, which contributes to the per-formance enhancement.

Long distance achievements
In 2013, the first long-distance CV-QKD system shown in Fig. 25 (a) is realized by P. Jouguet et al., which achieves the secret key rate of over 100 bps at 80 km 133 . Such an improvement is supported by the optimized reconciliation strategy and system architecture. The multi-dimensional reconciliation firsly introduced into the practical experiment significantly enhances the reconciliation efficiency of a CV-QKD system, from no more than 90 % to 95 %. This promotes the developments of long-distance CV-QKD system and supports all of the long-distance CV-QKD system until now. The main features of this experimental system include the polarization and time division multiplexing, the trusted detection noise, the polarization control using a dynamic polarization controller and the clock synchronization with part of the LO. The multiplexing scheme used in this system is widely used for achieving high isolation between quantum signal and LO in most of the long-distance systems.
As shown in Fig. 25 (b), D. Huang et al. later realized a CV-QKD system with transmission distance over 100 km and more than 300 bps secret key rate by controlling the excess noise to low level 136 . An efficient scheme is proposed to perform high-precision phase compensation under low SNR conditions which contributes to the excess noise of 0.015. For system hardware, they developed a low-noise detector, which reduces the requirement of the high LO power.
As shown in Fig. 25 (c), the CV-QKD system with the longest transmission distance is realized by Y. Zhang et al. at 2020, where the transmission distance can reach 202.81 km, which doubles the previous transmission distance record 139 . In this work, two amplitude modulators are used for generating pulsed light, then an amplitude and a phase modulator are used for Gaussian modulation, and an amplitude modulator is used to attenuate the modulated light signal to quantum level, as well as enhancing the SNR of frame sequence. Timedivision multiplexing and polarization multiplexing are used to ensure sufficient isolation between the co-transmit of quantum signals and LO. Moreover, LO is amplified at the receiver site therefore the requirement of the launch power of LO at the transmitter site is reduced, which is beneficial for reducing the cross talk. Automatic feedback systems are used to overcome the channel perturbations, and high-precision phase compensation is adopted to supress the excess noise and highly efficient postprocessing is realized to achieve long transmission distances at sufficiently high secret key rates. Besides the transmission distance of 202.81 km, the system was also tested with the link distance of 27 The key modules of an in-line LO CV-QKD system are the multiplexing module and the reconciliation module. It can be seen that the development of the reconciliation directly supports the long-distance transmission, where the long transmission distance always combines with high reconciliation efficiency. The multiplexing scheme finally evolves into the time and polarization division multiplexing, since this is the simplest method to achieve sufficient isolation between quantum signal and LO. Besides the reconciliation and multiplexing, the modulation, monitoring, sampling and compensation techniques are also well developed. The generation of light pulses with high extinction ratio is demonstrated in 2015 268 , where the extinction ratio overpasses 80 dB by using a triple cascaded MZI modulation. Later, the imperfect quantum state preparation is theoretically and experimentally investigated in 2017, which demonstrates that the incorrect calibration of the working parameters for the amplitude modulator and phase modulator can lead to a significant increase of the excess noise and misestimate of the channel loss. Schemes for calibrating the working parameters of the modulators are proposed and demonstrated to solve the imperfect state preparation issue. An LO monitoring scheme is proposed to enhance the practical security of a CV-QKD system 286 . The LO is monitored by the balanced photodiode, and the SNU is real-time calibrated. Finite sampling bandwidth of the analog-to-digital (AD) converter may lead to inaccurate results of pulse peak sampling, which is solved by a dynamic delay adjusting module and a statistical power feedback-control algorithm 371 .
As for polarization compensation, a feedback algorithm is proposed to stable the system, where a polarization feedback signal is produced by an amplified Root Mean Square to Direct Current conversion by picking out a 10 % portion of the LO light in real time 372 . With the output data, one can estimate the mean value and the standard deviation of the polarization drift. Then a dynamic polarization controller is deployed at the receiver's site to stable the polarization automatically. For phase noise compensation, a widely used scheme is to insert one frame of training sequence into the quantum signal path, to calculate the expectations and evaluate the phase difference 372 . Long term stable phase locking is employed to seperately compensate the fast-fading and the slow-fading phase mismatch by adjusting the phase modulator and fiber length 373 . Later, a novel phase compensation scheme based on an optimal iteration algorithm is proposed to realize the fast-fading phase compensation accurately 374 .

Field tests
Besides the system in laboratory, field tests of the in-line CV-QKD system are also widely performed. The first field test CV-QKD system is realized by S. Fossier in 2009 324 , the system structure is shown in Fig. 26 (a). It was automatically operated over 57 h, and achieved a secret key rate of 8 kbps over a 3 dB loss optical fiber. The system is part of the SECOQC network 93 , where its practical fiber length is 9 km. Later, the system was used for the encryption of point-topoint communications, which demonstrated the reliability of a CV-QKD system over a long period of time in a server room environment 134 . The map of the CV-QKD link is shown in Fig. 26 (b). The stability of this field test system is studied in detail, and the results show that, the birefringence, and consequently the polarization, in the installed fibre typically varied ten times slower than a laboratory fibre spool of equivalent length, while the phase drift linked to temperature changes in the devices is typically of 2π every 30 s and these vibrations have a typical frequency of 50-1000 Hz.
A full-mesh 4-node CV-QKD field test is realized in 2016 by D. Huang et al. 135 , where 6 point-to-point CV-QKD links with distances of 19.92, 35.35, 37.44, 15.34, 17.52 and 2.08 km connect 4 nodes together, as shown in Fig. 26 (c). This work adopts wavelength division multiplexing to co-transmit the quantum signal and the essential classical signals for clock synchronization and the forward and backward classical data communication. The reflection caused by the connectors of the field fiber links is well studied, and the results show that the connectors feature a nominal reflectance of -40 dB, and more than 20 reflective events are measured in the experiments.
The longest field test of CV-QKD system is realized in 2019, by Y. Zhang 137 , through 49.85 km commercial fiber, as shown in Fig. 26 (d). By applying an efficient calibration model with one-time evaluation, a rate-adaptive reconciliation method which maintains high reconciliation efficiency with high success probability in fluctuated environments, and a fully automatic control system which stabilizes system noise, a secret key rate which is two orders-of-magnitude higher than the previous field test demonstrations is achieved.
Later, the first network application demonstration with clear application scenarios over a long period of time through existing commercial optical fiber links is tested in Qingdao, China, as shown in Fig. 27 (a) and (b) 140 . The performance of the 3-node network is tested for a month, where the the total length of the application demonstration link is 71.03 km, with a trusted relay in the middle. As shown in Fig. 27 (c), the average secret key rate achieves higher than 12.00 kbps over 71.03 km optical fiber line, which paves the way to deploy continuous-variable QKD in metropolitan settings.

System on chip
Photonic integrated circuit is a promising way to realize a large scale and cost effective system. After the design is finalized, the production cost of the chip will sharply decrease with the increase of production. Therefore, in addition to miniaturizing the system, chipization can also greatly promote the low-cost mass production for the cost sensitive CV-QKD system. The earliest attempt to chip-based CV-QKD systems is in 2015, where a silicon photonic chip comprising all major CV-QKD components as well as complete subsystems is designed and fabricated 375 .
Later the first chip-based CV-QKD platform is demonstrated in 2019 138 , where most of the active devices such as the phase modulator, amplitude modulator, optical variable attenuator and homodyne detector are integrated on Silicon-On-Insulator chip, as shown in Fig. 28. The phase and amplitude modulator have a 90 % switching time of 2.5 ns, corresponding to a 200-MHz modulation frequency. However, the homodyne detector limits the bandwidth of the system to 10 MHz, mainly affected by the two-stage transimpedance amplifier. The shot noise is 5 dB higher than the electronic noise, and the detection efficiency is 0.498. With these on-chip devices, an in-line LO system is demonstrated. A grating coupler introduces the light from an external laser source into the chip, then an 1:99 directional coupler splits it into two path, where the weak one is used for quantum signal modulation, while the stronger one is the LO. After that, the Gaussian modulated quantum signal and LO are multiplexed into two orthogonal polarization states with a 2D grating coupler, and output to the channel. The receiver uses a 2D grating coupler to seperate the quantum signal and LO, then the quantum signal is homodyne detected. The system is tested with a 2 m fiber for proof-of-principle demonstration, the secret key rate can reach 0.25 Mbps.
This work demonstrate that the Silicon-On-Insulator platform can basically satisfy the requirement of a CV-QKD system. A two-dimensional grating coupler integrated on chip can be directly used for the polarization multiplexing and demultiplexing. The pulse generation, the Gaussian modulation, the variable optical attenuator and the detector are all realized with chip-based components. The insertion loss of the grating coupler, the detection efficiency and the bandwidth of the chip-based detector are the concerns, where a part of these issues are solved in the later works, and we detailed them in the local LO system part. A comparison of the secret key rate of different systems is shown in Fig. 29.

Other in-line LO systems
Besides Gaussian modulation, discrete modulation and unidimensional modulation is also realized with in-line LO system, as shown in Fig. 30. The discrete modulation format has lower requirement for digital to analog conversion, and the unidimensional modulation can be realized with a single amplitude modulator, which are suitable for cost-effective applications. Polarization multiplexing is also used in these systems. The four-state modulation CV-QKD system from X. Wang et al. can reach 1 kbps secret key rate with the transmission distance of 30.2 km 378 , the four-state modulation CV-QKD system from X. Wang et al. can reach 50 kbps secret key rate with the transmission distance of 10 km 376 , and the unidimensional modulated system achieves 5.4 kbps and 0.7 kbps secret key rate at 30 and 50 km 377 .

B. Local LO systems
Though the in-line LO system has developed for a long time, some problems are still inevitable. The most critical issue is the security loophole caused by the LO accessible to a potential eavesdropper [386][387][388][389] . The manipulation of LO can make the sender and receiver perform parameter estimation mistakenly, leading to an overestimate of secret key rate. Monitoring the LO can defend part of the attacks, but the loophole still exists and more attacking strategies aiming at it can be continuously developed. Besides, from the system development, when we hope to achieve high key rate by raising the repetition frequency or achieve long distance overcoming the large channel loss, the crosstalk from LO to quantum signal will increase, which weakens the system performance. Therefore, after more than a decade of development, the local LO CV-QKD system without the transmission of LO is proposed.
The local LO system is firstly proposed in 2015, intends to solve the problems above by generating LO inside the receiver, which is a once and for all solution. Since the quantum signal and the LO are generated by different lasers, a fastfading phase noise is introduced, leading to the increase of excess noise. The key of a local LO system is to establish a reliable phase reference between the sender and receiver, usually realized by a classical reference signal, namely pilot tone. When heading towards high-speed system with high repetition rate, the pulsed system with time division multiplexing is no more effective. Considering that the power of pilot tone is low enough so that its leakage is not as much as the in-line transmitted LO, the frequency division multiplexed quantum and pilot tone signals with continuous-wave light becomes the mainstream scheme of the local LO system. In addition, the digital signal processing is introduced to the local LO system for more accurate phase recovery, high speed modulation with continuous-wave light and simpler detection. A review of the evolution of local LO CV-QKD system is shown in Table. XI.

The early systems
The early experiments adopt a pulsed laser source with LiNbO3 amplitude and phase modulators for generating quantum and pilot tone signals 141,142 . In the work finished by B. Qi et al. 141 , the quantum signals and pilot tones are time-division multiplexed and then detected by receivers using heterodyne detection. The sender's and receiver's LO laser sources are free running without any connections, and the heterodyne detection results of the pilot tone provide the phase reference for data rotation. In D. Soh's work 142 , the signal and LO are generated from one laser for proof-of-principle demonstration. Homodyne detection is used for detecting the quantum signal and pilot tone. Each pilot tone is sent twice in a pair for the receiver to get both quadratures with homodyne detection.
In the above works, continuous-wave LO signals are adopted, while in Huang's work 267 , an amplitude modulator is deployed inside the receiver side for generating pulsed LO. The quantum and pilot tone signals are also generated by the same modulation module with time division multiplexing. The commonalities of these early systems are using pulsed light, and time-division multiplexed quantum and pilot tone signals are generated by the same modulation module. The key role of these early systems is verifying the possibility of compensating the phase mismatch between the quantum and LO signal with high precision required in a CV-QKD system using a pilot tone.

Systems with continuous-wave light
As we mentioned above, the most crucial issue of a local LO CV-QKD system is the phase recovery with pilot tone. To improve the accuracy of the phase recovery, raising the repetition frequency of the quantum and pilot tone signals for a more accurate track of the phase shift is a direct and effective way. However, the pulsed system with time division multiplexing significantly limits the system repetition frequency. Therefore, it is a general trend to use continuous-wave light instead of pulsed light to support a high speed system 269,270 . Without time division multiplexing, the repetition rate of the system is significantly enhanced, resulting in a high-rate system with 1 GHz repetition rate 143,271,272 .
Besides, for the multiplexing of quantum signal and pilot tone, since the high power pilot tone is not necessary required, the quantum signal and pilot tone can be modulated simultaneously with the same modulation module in a frequency division multiplexed scheme 269,270 . Naturally, by introducing a frequency difference between the quantum signal and LO, a digital heterodyne detection can be realized, where we can use the detection results from one homodyne detector to recover both information of quadratures 143,[269][270][271][272]380 . In this way, the experimental demonstration of the system is significantly simplified.
H. H. Brunner et al. demonstrated a local LO CV-QKD system as shown in Fig. 31 (a) 269 . The 4-state discrete modulation of coherent states is realized with quadrature phase-shift keying modulation used in classical communications, and a variable optical attenuator is used to adjust the power to the quantum level. No amplitude modulator for pulse genera-tion is used, instead, a RRC filter in the digital domain completes the pulse shaping. Moreover, combined with an analog electronic low-pass filter at the output of the digital-toanalog (DA) convertor, the quantum signal is concentrated in the 10 MHz bandwidth. Digitally, the quantum signal is upconverted and combined with a pilot tone. To reduce the quantization noise since the weak quantum signal is produced and detected together with a much stronger pilot tone, the DA and AD convertor bit width are 16 bits and 14 bits respectively. The heterodyne detection is also performed digitally, the LO is set to have a frequency difference with the quantum signal, and a down conversion in digital domain is then performed to recover the information on both quadratures.
As shown in Fig. 31 (b), S. Kleis et al. realized a complete system with the simultaneous modulation of 8 phaseshift keying discrete modulated quantum signal and two pilot tones using a dual-parallel Mach-Zehnder modulator 270 . Digital heterodyne detection is used to get both quadratures with a single homodyne detector. This work achieved the secret key rate of 6 × 10 −3 bit/symbol at 40 km, which shows the way of low-complexity QKD system demonstration within metropolitan distances. The core ideas of the above works is to realize CV-QKD system with continuous-wave light and a structure similar to the classical coherent communications, digital signal processing is widely used in the system, which opens the new way of CV-QKD systems.
Subsequently, the discrete local LO CV-QKD system is extended to high-order modulation formats for better performance. As theoretically analyzed, the increasing of modulation order results in higher secret key rate with most of the security framework of discrete-modulation CV-QKD. Moreover, when the constellation is similar to the Gaussian distribution, the secret key rate of the system can be better than the constellation with uniform distribution. In this guidance, a high-order discrete modulated CV-QKD system is realized with 16-order two-ring phase shift key modulated coherent states 379 . Compared with the high-order quadrature amplitude modulation, 16-order two-ring phase shift key modulation can be realized with less DA requirements, contributing to suppressing the modulation noise. The achieved secret key rates are 49.02 Mbps, 11.86 Mbps and 2.11 Mbps over 25-km, 50-km, and 80-km optical fiber. 67.4 %, 70.0 % and 66.5 % of the performance of a Gaussian modulated protocol can be achieved with this simpler scheme.

Systems with polarization multiplexing
Besides modulating the quantum signals together with pilot tone, the quantum signals can also be modulated individually and combined with the pilot tone in different polarization directions 271,280,380,390,391 .
As shown in Fig. 32 (a), the optical carrier is firstly amplitude modulated to generate 250 MHz signal pulses, then sent into the dual-polarization IQ modulator for the modulation of the discrete coherent states and the pilot tone. The quantum signal and pilot tone are multiplexed in different frequency and polarization directions. The receiver performs heterodyne detection of both polarizations after the compensation of a polarization controller. This scheme can help to reduce the excess noise since the isolation between the quantum signal and pilot tone is more sufficient than the frequency division multiplexed method.
Further, a Gaussian modulated system with frequency division multiplexing and polarization multiplexing is realized by H. Wang et al. 271 , shown in Fig. 32 (b). Digital heterodyne detection is used for detecting quantum and pilot tone signals respectively. It can achieve 7.04 Mbps asymptotic-limit secret key rate at 25 km and 1.85 Mbps with finite-size.

Recent progress
Based on the digital modulation and detection scheme, local LO CV-QKD system is heading towards high secret key rate 143 , composable security 273 and long distance 330 .
As shown in Fig. 33 (a), in H. Wang's work 143 , using frequency division multiplexing and polarization multiplexing to transmit the quantum and pilot signal, as well as two digital heterodyne detector for measuring, a system with 4-state discrete modulated coherent states achieved 233.87 Mbps, 133.6 Mbps and 21.53 Mbps secret key rate at 5 km, 10 km and 25 km. This increases the asymptotic secret key rate to sub-Gbps level, which can satisfy the one-time pad cryptographic task. The further investigation on optimizing the practical system parameters shows an effective way to the high-performance system 392 .
N. Jain's system with composable security realized 0.0471 bits/symbol secret key rate at 20.3 km with extremely simple devices shown in Fig. 33 (b), an IQ modulator produces frequency division multiplexed quantum and pilot signals which are detected by a digital heterodyne detector 273 . The system is able to generate composable secret keys with 2 × 10 8 coherent states, which is far less than the previous requirements due to FIG improvements to the security proof.
A recent work with the structure shown in Fig. 33 (c) can realize a transmission distance over 100 km, and the asymptotic secret key rate can reach 10.36 Mbps, 2.59 Mbps and 0.69 Mbps over transmission distance of 50 km, 75 km and 100 km 380 . This work significantly increases the transmission distances of a local LO CV-QKD system, and shows a promising way to realize long-distance and high-speed QKD using telecom devices.

C. CV-QKD systems co-existed with classical communication environment
The homodyne and heterodyne detection in CV-QKD system act as a matched filter since the LO naturally introduce a frequency selection on the received signal, therefore the filter in time and frequency domain is unnecessary. Moreover, the devices in a CV-QKD system is compatible with the classical coherent optical communications. Therefore, CV-QKD is suitable for coexisting with classical signals, which is easy for deployments.
The test of the system co-existing with classical channels was firstly demonstrated in 2010 397 , and has been further developed in recent years 265,393,398,399 . The further test results show that, over a 25 km fiber, a CV-QKD operated over the 1530.12 nm channel can tolerate the noise arising from up to 11.5 dBm classical channel at 1550.12 nm in the forward direction and 9.7 dBm in backward 265 . The system with 75 km transmission distance can work in the channel with -3 dBm forward classical signals or -9 dBm backward classical signals. These results demonstrate the outstanding capacity of CV-QKD to coexist with classical signals of realistic intensity in optical networks. In 2018, the spontaneous Raman scattering noise of a CV-QKD system co-exisiting with classical channels is investigated, which is the most dominant impairment in a wavelength division multiplexed co-existence environment for CV-QKD 393 . The setting of the quantum signal and the classical signals in frequency domain is shown in Fig.  34. The influence of the spontaneous Raman scattering noise on a CV-QKD system under different transmission situation is investigated, resulting in a scheme which can support a secret key rate of 90 kbps over 20 km, for an ideal QKD system multiplexed with 2 mW optical power.
A CV-QKD system co-propagates with large-scale C-band DWDM channels is investigated in 2019 400 . By operating the quantum signals in S-or L-band, the number of copropagating channels is doubled. 56 density wavelength division multiplexing (WDM) channels with a total launch power of 14.5 dBm are co-propagated with the quantum signal at the distance of 25 km. Meanwhile, CV-QKD system co-existing with 18.3 Tbps data channels is tested, which contains 100 WDM channels, more than 90 times higher classical bit rate than the previous results 266 , shown in Fig. 34 (b). In 2020, B. Chu et al. investigated the LO quality of an in-line LO system in a co-existing environment, which is normally ignored in former studies. It is shown that, four-wave mixing in excess noise analysis is a visible factor causing local oscillator fluctuation characterized by the statistical properties of the power evolution of local oscillator 401 .

D. Others
In this part, we introduce the free space and the entanglement based CV-QKD systems. The free space CV-QKD is crucial for the wide range CV-QKD, which is a promising way to connect two distant parties by using the satellite as the relay. On the other hand, for accessing multiple users in complex environment, free space links can be used to construct an access network with simple system structure. For the value in the long-distance and access network applications, the free space CV-QKD is studied, and some results have been achieved. The entanglement-based CV-QKD systems are suitable to distill secret key bits against the high excess noise, which can be used in the scenario with worse channel situation.

Free space systems
Compared to the fiber link, the free space link suffers from the disturbance of atmosphere, leading to the fading channel and the beam wandering. Except for the fast fading of the channel parameters such as the channel loss and excess noise, the fading of phase also increases the difficulty of phase recovery. Therefore, new coding strategy and phase compensation methods should be developed.
In 2014, a free-space continuous-variable quantum communication is demonstrated with a point-to-point free-space link of 1.6 km in urban conditions 394 . Later, a satellite to ground experiment on the quantum limited measurement of the quadrature information is demonstrated 402 , as shown in Fig. 35 (a). A series of technologies are developed to support the measurement of the coherent state generated by the laser communication terminal on the geostationary Earth orbit, including the pointing, acquisition, and tracking system of the Transportable Adaptive Optical Ground Station, the adaptive optics system to process the phase front distortions for launching the beam into a single mode fiber, and an optical phase lock loop to lock the phase between the signal and the LO, where the LO is generated by the laser source inside the ground station.
In 2020, as shown in Fig.35 (b), a phase compensation strategy is developed and experimental demonstrated 395 . This work checks the correlation between data held by Alice and Bob in a free-space channel, and proves that the fluctuation of transmittance disappears in the correlation, thus enabling phase compensation for signals over fluctuant channels. Recently, a passive-state-preparation CV-QKD system shown in Fig. 35 (c) with free-space channel is experimentally demonstrated 396 . Thermal-state polarization multiplexing transmitted LO, synchronized channel transmittance monitoring and fine-grained phase compensation techniques are proposed to support a secret key rate of 1.015 Mbps with a free-space channel of -15 dB simulated transmittance.

Entanglement-based systems
The entanglement-based systems have also been developed in recent years as an alternative approach of the CV-QKD system implementation [403][404][405][406][407][408][409] . The first entanglement-based CV-QKD system is realized in 2009, a pair of bright EPR entangled beams produced from a non-degenerate optical parametric amplifier is used as the source. The secret key rates of 84 kbps and 3 kbps are achieved agianst collective attack with the channel the transmission efficiency of 80 % and 40 % 403 . Later in 2012, a system using modulated fragile entangled states is realized. The system can generate secret key bits against the excess noise of 0.45, which is unable for any coherent state protocols to distill secret key bits 404 . In 2018, the performance of the entanglement-based CV-QKD system is further enhanced, which can achieve an asymptotic secret key rate of 0.03 bit per sample at a channel excess noise level of 0.01 406 .

V. THE ADVANCED CV-QKD SYSTEM PROGRESS FOR FUTURE APPLICATIONS
The future CV-QKD system will head towards the highspeed and compact integration, rely on full scale DSP and integration with photonic chip. Besides that, the point-tomultipoint CV-QKD system will be widely applied to support a high-speed quantum access network for end-user access.
A. Digital CV-QKD systems Impairment compensation on digital domain can significantly simplify the system structure, contributing to a simple and stable system. The study on classical coherent communications promotes the DSP algorithms in a CV-QKD system.
For instance, at the transmitter side, the pulse shaping algorithm is used to raise the availability of the frequency band. For the receiver, the frequency shift is recognized and the down conversion is completed in digital domain, time recovery algorithm is used to obtain the optimal sampling points, digital filter is used to reduce the spectrum mismatch between the transmitter and receiver site, and various of algorithms are developed to distill the parameters of polarization compensation and phase compensation. Thanks to the wide application of DSP in CV-QKD systems, the speed of the system is becoming higher and higher, the latest achievement reach the baud rate of 10 GBaud 146 .
With more DSP algorithms being introduced to the CV-QKD system, the security of the DSP is getting more concerns. The security of the linear DSP algorithms in CV-QKD application is proved in 2023, based on the continous-mode quantum optics theroy 410 .
For the transmitter, the modulation based on the continuous-wave light and the pulse shaping can be seen as a sequence of coherent states with different temporal modes, which raises the requirement that the pulse shaping function in different period should be integrated orthogonality. The commonly used RRC pulse shaping function can satisfy this defination.
For the receiver, the pilot tone is individually processed for distilling the parameter for impairment compensation of quantum signals. Various algorithms can be used to raise the accuracy of distilling compensation parameters, since the process of pilot tone does not affect the quantum signal, only how to use the parameters for compensation matters. While the processing of quantum signals has two main steps, including the static and dynamic equalization. The static equalization aims at compensating the imperfections of the measurement process to provide the right quadrature measurement results, in which a proper SNU normalization is crucial. After that, the dynamic equalization is performed to compensate the mismatch of the polarization and phase during the transmission in FIG. 36. The advanced point-to-point dual-polarization CV-QKD systems with digital technologies. Here, both of the polarization direction is modulated with quantum signals, the DSP is used to compensate the phase mismatch and polarization rotation. The polarization controller in the optical path is not required. DP IQ modulator: Dual polarization IQ modulator. quantum channel. This can be easily mapped to linear quantum optics, for instance, the phase or polarization rotation and beamsplitters (attenuation). Therefore, the key of the security is the static equalization, to obtain a reasonable quadrature measurement result.
The security of static equalization algorithms depends on proper calibration of SNU. The measurement result of t j period,D N t j , is defined by a linear function of multiple sampled data {D t j−k+i }, If SNU is calibrated from vacuum input following the same equalization procedure, then after SNU normalization, the measurement result forms a single-mode quadrature measurement result (with relative phase θ to LO) with certain temporal mode, Ξ t j DSP , defined by the hardware features and equalization algorithms.
With digital polarization compensation, the polarizationdiversity integrated coherent receiver (ICR) can be used to simplfy the system, in which optical polarization controller is no longer required, as shown in Fig. 36. Recently, a dual-polarization local LO CV-QKD system is experimentally demonstrated 145 . It performs the probability-shaping discretemodulated 64 and 256 QAM with dual-polarization IQ modulator, and the polarization-diversity ICR is used at receiver side. With all compensation finished in digital domain, it can achieve 91.8 Mbps of secret key rate at 9.5 km and 24 Mbps at 25 km, which can support the high-speed connection within metropolitan distances.

B. Chip-based local LO system
The advanced local LO CV-QKD system is developing towards compact module with photonics integration, benifiting from stability and scalability, which enables cost-effective deployments in large-scale. Recently, a seires of investigations have been carried out on high-performance chip-based transmitter and receiver for local LO CV-QKD system 146,[383][384][385] . There are two mainstream fabrication platforms, Silicon-On-Insulator and III-V.
The Silicon-On-Insulator platform has the advantages of low cost and good ductility, which can utilize mature silicon CMOS processes to manufacture optical devices. The refractive index of the silicon waveguide is 3.42, which can form a significant refractive index difference with silicon dioxide, ensuring that the silicon waveguide can have a smaller waveguide bending radius, which is beneficial for high-density device integration. Recently, a Silicon-On-Insulator CV-QKD receiver shown in Fig. 37 (a) for a digital system is tested. The bandwidth is significantly enhanced to 250 MHz which makes detect the frequency division multiplexed quantum and pilot signal possible 383 . The maximal detection efficiency of the overall receiver is 0.26, with a shotnoise-to-electronic-noise ratio of 20 dB at low frequencies and more than 7 dB for 250 MHz. Under the untrusted loss of 1.38 dB, a secret key rate of 280 kbps is achieved with excess noise of 0.1102 at Alice's side.
However, the Silicon-On-Insulator platform also suffers some issues, such as the low coupling efficiency for the optical signal input, which limits the detection efficiency, and the lack of an integrated high performance light source. The first issue can be solved through device optimization, such as low loss grating couplers and edge couplers. The latter issue FIG. 38. The prepare-and-measure scheme of the point-to-multipoint CV-QKD protocol. From Y. Bian et al. 147 . Each coherent state prepared by Alice can be responded by all Bobs, for security analysis and secret key distillation. The syndrome is secretly transmitted to avoid the cross information leakage between different Bobs. is quite challenging, since silicon is not suitable for producing high performance integrated lasers.
One promising solution is using III-V platform such as InP, the other way is making heterogeneous integration, where the III-V chip-based laser is combined with the silicon chip via bonding or growing. Some recent researches have shown the feasibility of implementing the above two technical routines. J. Aldama et al. has demonstrated a InP CV-QKD transmitter 384 shown in Fig. 37 (b), including an electroabsorption modulator, an IQ modulator and a variable optical attenuator. These three devices are cascaded and integrated on one chip, supporting more than 1 GHz bandwidth. 0.4 and 2.3 Mbps secret key rate is achieved via a test with 11 km fiber and back-to-back connection, which verfies the possibility of using InP platform to produce a transmitter satisfying the requirement of CV-QKD. Once the laser diode is integrated to the InP chip, a fully integrated CV-QKD chip can be realized.
Recently, using the silicon based on-chip receiver with high-efficiency Ge photodiodes, a high-speed system at 10 GBaud is realized 146 , as shown in Fig. 37 (c). The system is able to generate high secret key rates exceeding 0.7 Gbps over a distance of 5km and 0.3 Gbps over a distance of 10km, paving the way of the high-performance and compact CV-QKD system.
For chip-based laser diode, L. Li et al. have demonstrated two high-performance on-chip external cavity lasers based on Si3N4 platform for local LO CV-QKD system 385 . The secret key rate can reach 0.75 Mbps within 50 km fiber and the excess noise is controlled at 0.0579. In conclusion, the last obstacle to the fully chip-based CV-QKD system, which is the integrated light source, is expected to be solved through III-V platform with an overall or heterogeneous integration. The chip-based CV-QKD system is a promising way to realize large-scale, small-size and cost-effective applications.
C. Point-to-multipoint system Quantum access network is an efficient way to realize the point-to-multipoint connection between a network node and massive end users 411 . There are two mainstream routines, using optical switch with active time-multiplexing control between different end users 381 , or passive optical nework (PON) with simpler network facilities. However, the 1 × N beamsplitter in a PON significantly increases the equivalent channel loss for individual end users. Moreover, multiplexing techniques are required to seperate different users for upstream configuration 412,413 . Recently, a downstream pointto-multipoint CV-QKD scheme based on PON is proposed to solve the problems above 147 . The performance is significantly improved with a multiuser protocol, shown in Fig. 38.
The state preparation and measurement are similar to the Gaussian modulated protocols. One of the key points of this FIG. 40. The CV-QKD quantum access network using multiuser protocol. From Y. Pan et al. 414 . The network is based on the local LO scheme, where the transmitter generates quantum signal and pilot tone, which are multiplexed in different polarization directions and frequency. After the transmission in a passive optical network with an optical power splitter, different receivers at different site detects the signal independently, and distill secret key bits.
protocol is the multi-user parameter estimation and security analysis, in which all Bobs work together with Alice for a tighter estimation of the potential channel eavesdropping behavior. Specifically, Alice discloses part of the modulation data, denoted as X est , and all Bobs disclose their corresponding detection data, Y est 1 ,Y est 2 , ...,Y est N . With these data, the correlations between Alice and Bobs can be estimated, which forms a covariance matrix γ AB 1 B 2 ...B N consists of all trusted modes. Further, the secret key rate between Alice and each Bob can be calculated with γ AB 1 B 2 ...B N .
The other key point is the parallel key distillation for all end users, which enhances the secret key rate of the overall network. In this protocol, each prepared quantum state can be measured by all users. Several techniques are developed to suppress the negative influence of the correlation between different end users on system performance. Therefore, all users can generate independent secret keys with the sender at the same time. The simulation results in Y. Bian et al. show the ability of supporting 128 end users with more than 100 km distance (see Fig. 39), which can well satisfy the multiuser interconnection requirements within metropolitan distances 147 .
A high-rate CV-QKD access network with 4 end users is realized, as shown in Fig. 40. For the transmitter, quantum signal is generated with an IQ modulator, which is multiplexed with pilot tone signal with frequency division multiplexing and polarization multiplexing. For the receiver, the de-multiplexing is realized by a polarization controller and a polarization beam splitter. Then, quantum signal and pilot tone are seperately detected by heterodyne detection. The average secret key rate of each user can reach 4.1 Mbps at 15 km, with the repetition frequency of 500 MHz 414 . This result can well support the quantum access network, such as linking the end users within a campus (see Fig. 41).

VI. PRACTICAL SECURITY
The security of CV-QKD is based on the protocols using ideal devices, where the source and detectors match the basic assumptions. However, in practical implementations, the unperfect devices may introduce security loopholes, which can be used by Eve to attack the systems. Correspondingly, countermeasures are proposed to defense the attacks and close the security loopholes, which ensure the practical security. The future quantum access network with point-tomultipoint protocol. From Y. Bian et al. 147 . The OLT means the optical line terminal, and the ONU means the optical network unit. The network can be an optical distribution network, which is widely deployed by the fiber-based classical optical communication network, using as the access network. The quantum signal and classical signals can be co-transmitted with frequency division multiplexing (FDM), while the downstream and upstream signals can be transmitted with time division multiplexing.

A. Attacks and countermeasures
The theoretical security analysis of CV-QKD is based on the assumption that Alice and Bob are both trusted, where the attack by the eavesdropper can only be performed in channel, without affecting the devices of the legitimate parties. However, the source and the detector of a practical CV-QKD system cannot satisfy the requirement that the devices can be perfect and fully trusted, since the actual optical and electrical devices inevitably introduce the imperfections. These imperfections can be used by the eavesdropper to increase the knowledge to the legitimate parties, which weakens the security of the system. According to the different attack targets, the hacking schemes against the CV-QKD system can be classified into hacking schemes against the LO, the source, and the measurement devices. The related attack and defense schemes are summarized in Table XII. At present, all the hacking schemes can be defended, and the research of hacking is mainly to better improve the practical security of the system. By manipulating the LO, the representative attack strateiges against the CV-QKD systems, such as the local oscillator fluctuation attack 386,425 , calibration attack 389 , polarization attack citezhao2018polarization and so on, can be performed. It is assumed in the theoretical security analysis of CV-QKD that the LO is trustworthy and will not be controlled by the eavesdropper, but in the actual in-line LO system, since the LO needs to be transmitted over the channel, it is very likely to be controlled by an eavesdropper. Variations in the intensity of the LO can cause the SNU calibrated with the measurement results to be different from the system's true value, which leads to a biased estimation of the system's excess noise, leaving a security loophole. These attack schemes can be defended by monitoring the mean and variance of the intensity of the LO. The local LO system is proposed to defend the attack at the LO by generating LO locally. Moreover, since the classical pilot tone is transmitted in the unsecured channel, some attacking schemes at the pilot tone are proposed such as the reference pulse attack and so on [422][423][424] .
Aiming at the source, the imperfect coherent source attack 415 , Trojan-horse attack 416 , laser seeding attack 420 and reduced optical attenuation attack 421 are developed. In a Trojan-horse attack, Eve detects modulation information in the CV-QKD system by injecting bright light pulses and analyzing the reflected pulses. These reflected pulses originate from refractive index changes, such as density fluctuations at the junction between two optical devices or inside the optical devices. The reflected pulse signals contain the markings of the optical modulator (used to encode the quantum state), which allows Eve, the eavesdropper, to extract part of the original key. The counter measure of the source attack is using an optical isolator to prevent the injected light and a source monitoring detector to achieve the output of the system.
Exploiting the unlinear behavior of the homodyne or heterodyne detectors, the detector saturation attack 417 and the homodyne-detector-blinding attack 419 are developed. A detector saturation attack involves saturating the detector by increasing the light intensity so as to reduce the output signal variance, which reduces the increase in excess noise caused by interception-retransmission operations, making it impossible for the legitimate parties to detect the eavesdropping behavior. A strategy to defend against the detector saturation attack scheme can be realized by monitoring the operating state of the detector by detecting the relationship between the output signal and the channel transmittance.
Taking advantage of the vulnerability that the beam splitting ratio of the beam splitter at both output ends depends on the wavelength, a wavelength attack scheme for real CV-QKD systems has been proposed. The strategy to defend against this attack scheme can be realized by adding filters in front of the detector and monitoring the intensity of the LO in real time.
Researchers have also proposed a series of corresponding countermeasures to address the potential security loopholes in the practical CV-QKD system. In order to better evaluate the degree of harm caused by different attack strategies and the effectiveness of corresponding countermeasures, it is necessary to conduct grading evaluation for different countermeasures, and quantify their defense performance 426 . The effectiveness of countermeasures is divided into four levels, with specific levels and grading methodologies as the following table.
The above grading scheme for countermeasures mainly focuses on their effectiveness, without paying attention to the "cost" of countermeasures. We focuses on the attacker's point of view, and is more concerned with the effect of countermeasures on the risk of attack. The"cost" is mainly related to needs of users whose devices are being attacked. For example, when the security demand for users is high, that is, they need to protect to national-level secrets, the defender will not consider the "cost" of defense, but rather the the effectiveness of countermeasures as the main consideration. When the user demand is low, that is, only personal information needs to be protected, defenders need to primarily consider the "cost" of countermeasures. Here, a certain amount of cost is discussed concerning practical CV-QKD devices. The CV-QKD equipment is a set of communication equipment that integrates electronics and optical devices, and the "cost" of countermeasures can be discussed and analyzed in the following aspects: the price of the equipment, the difficulty of integrating the defense scheme, the difficulty of the technical implementation, the computational power and the number of original keys sac- The imperfections of devices in the CV-QKD system has been included in the security analysis, or there is no security risk.

C 2 Solution robust
It can effectively defense the specific attack in experiments, but it has not yet been included in the security analysis. This solution is effective only for certain attack strategies, but is ineffective for others or modified versions of original attack.

C 0 Insecure
Security vulnerabilities have been proven to exist, but there is currently no effective countermeasures.

C X No test
The imperfections of the practical devices are suspected to exist, but testing and verification have not yet been conducted.
rificed in the postprocessing process required for defense. In summary, the relationship between defense "cost" and defense effectiveness is a trade-off, requiring experts from multiple fields to combine different practical application scenarios to form a more comprehensive evaluation system.

B. Measurement-device-independent system
In order to completely eliminate the security loopholes due to the imperfection of devices, completely device-independent QKD protocols have been proposed. This type of protocol does not rely on any security assumptions for QKD devices, and thus is one of the most secure protocols that can guarantee its security even when the device is completely controlled by an eavesdropper. However, completely device-independent protocol face significant experimental challenges since they require key acquisition using the loophole-free Bell test. The key rate of such protocols is too low under the existing experimental conditions, which makes it difficult to meet the usage requirements. As a result, the concept of semi-deviceindependent CV-QKD protocols has been proposed, which is a good compromise between security and performance, and can have high security and high key generation rate at the same time. The main idea of the semi-device-independent CV-QKD protocol is that the security of some devices in the system is not required, while other devices are considered to be trusted. Typical semi-device-independent protocols are the CV-SDI QKD protocol and the CV-MDI QKD protocol. In this part, we mainly introduce the process of the CV-MDI QKD system.
In an CV-MDI QKD, both two legitimate parties, namely Alice and Bob, are the transmitter, while the detection is performed by the untrusted third party. Therefore, the protocol is naturally immune to any attacks at the receiver's side. For the coherent state CV-MDI QKD, normally the legitimate parties adopt Gaussian modulation, they send the Gaussian modulated coherent states to the third party Charlie, who performs the continuous-variable Bell-state detection. Specifically, Charlie uses a beamsplitter to interfere the two received coherent state, then uses two homodyne detectors to measure the output results. After that, Charlie announces the detection results, and the legitimate parties correct their data with the results announced by Charlie. Finally, Alice and Bob use their corrected data to perform the postprocessing and get the final secret keys. During the above process, the legitimate parties can both correct their data, or correct the data by only one side. The theroetical analysis shows that the CV-MDI QKD is FIG. 43. Structure of the furture quantum secure network, which consists of the backbone network, the metropolitan network and the access network. Here, the backbone network connects the main network node of different cities, the metropolitan network connects the nodes in a city, and the access network connects the network node with end users.
limited by the symmetry of the protocol. When Charlie is deployed at the center, where the loss of the Alice-Charlie link is equal to that of the Bob-Charlie link, the transmisson distance of the protocol is the worst. When Charlie is near one of the legitimate parties, the performance of the protocol is enhanced.
The first proof-of-principle of CV-MDI QKD system is demonstrated in 2015, shown in Fig. 42 (a). With free space optical devices working in 1064 nm band, it demonstrates the high-rate characteristic of CV-MDI QKD 173 . Compared with the qubit-based protocols, the secret key rate increases by 3 orders of magnitude within metropolitan distances, providing a promising way of building the pratical secure metropolitan CV-QKD network. The difficulties of the experimental CV-MDI QKD is the implementation of the CV Bell detection, which requires highly efficient photodetectors, locking systems, and the free space devices.
Later, the recent progresses of CV-MDI QKD system solve the issues left above. As shown in Fig. 42 (b), the CV-MDI QKD with optical fiber links is realized in 2022, where the optical phase locking, phase estimation, real-time phase feedback and quadrature remapping are developed to realize an accurate CV Bell-state measurement. In this work, the optical phase-locked loop is a key technique to make the two lasers used for Alice's and Bob's QKD laser source have the identical center frequency. Part of the Alice's laser beam is frequency-up-shifted by 80 MHz and sent to Bob's station for frequency-locking. Moreover, a free-space time-domain homodyne detector is developed, which can reach the detection efficiency of 99%. The secret key rate can break 0.19 bit/pulse over a 10 km optical fiber, which paves the way of a high-rate metropolitan MDI-QKD network 427 .
In 2023, the frequency and optical phase locking in a CV-MDI QKD system is removed by using a new relay structure based on a polarization-based 90-degree optical hybrid and a well-designed DSP pipeline 428 , shown in Fig. 42 (c). Moreover, this system uses continuous-wave laser with digital pulse shaping and digital time synchronization, therefore the additional amplitude modulation for pulse generation and a delay line for time synchronization is unneccessary. A secret key rate of 600 kbps over 2 dB loss channel is achieved.

VII. SUMMARY AND OUTLOOK
In this review, we have presented the development of the continous-variable quantum key distribution system, started from the basic protocol and security analysis, including the system structure, advanced system implementations and the practical security. The key challenges facing by different system schemes and the countermeasures are detailed, showing the methodology towards a high-performance system. The existing achievements of continous-variable quantum key distribution system demonstrate the advantages of compatibility, high-speed, chip-based integration, and networking. For the future system implementations, it is necessary to develop a seires of methods for suppressing the noise caused by the high repetition frequency, such as the dispersion. Closing the side channel at the transmitter site and accurate shot-noise unit calibration are crucial points for practical security, which will be studied in depth. Chip-based systems and coexistence with traditional optical networks will be further investigated to facilitate the deployment of systems at scale.
Continued theoretical researches are also expected to support longer transmission distance, simpler system structure and large-scale network in protocol layer. The composable finite-size security of various protocols including the discretemodulated protocols needs further refinement.

ACKNOWLEDGMENTS
We are thankful for the enlightening discussions with and helpful comments from reviewers and numerous colleagues,