 Path (a) stays inside Alice's secure device and path (b) goes to Bob.By rejecting the photons that Bob receives and only accepting the ones he doesn't receive, Bob & Alice can set up a secure channel, i.e.Eve's attempts to read the "counterfactual" photons would still be detected.