  Quantum key distribution (QKD) allows two distant parties to share secret
keys with the proven security even in the presence of an eavesdropper with
unbounded computational power. Recently, GHz-clock decoy QKD systems have been
realized by employing ultrafast optical communication devices. However,
security loopholes of high-speed systems have not been fully explored yet. Here
we point out a security loophole at the transmitter of the GHz-clock QKD, which
is a common problem in high-speed QKD systems using practical band-width
limited devices. We experimentally observe the inter-pulse intensity
correlation and modulation-pattern dependent intensity deviation in a practical
high-speed QKD system. Such correlation violates the assumption of most
security theories. We also provide its countermeasure which does not require
significant changes of hardware and can generate keys secure over 100 km fiber
transmission. Our countermeasure is simple, effective and applicable to wide
range of high-speed QKD systems, and thus paves the way to realize ultrafast
and security-certified commercial QKD systems.
