  Lithium niobate (LiNbO3, LN) devices play critical roles in quantum
information processing. However, for special applications like quantum key
distribution (QKD), the characteristics of materials and devices and their
impact on practical systems must be intensively inquired. For the first time,
we reveal that the photorefractive effect in LN can be utilized as a potential
loophole to carry out malicious attacks by the eavesdroppers. We take a
commercial LN-based variable optical attenuator as an example to demonstrate
the method we named Induced-photorefractive attack (IPA) and propose two
techniques to enable controllable attacks. Our results show that eavesdroppers
can fulfill an efficient source-side attack by injecting an optimized
irradiation beam with only several nanowatts, which is realistic when accessing
commercial fiber channels. These measure and techniques can be employed for all
individual and on-chip LN devices and initially explored a new security branch
for system design and standardization of real-life QKD.
