## 4 Experiments
To better evaluate the effectiveness of our algorithm, we compared it with existing classical NMF, kernel non-negative matrix factorization (KNMF), robust non-negative matrix factorization (RNMF), manifold non-negative matrix factorization (GNMF), and recent methods such as local non-negative matrix factorization (LNMF) [33], kernel robust non-negative matrix factorization (KRNMF) [34], and sparse non-negative matrix factorization (SNMF) [35]. We compared these algorithms in terms of feature extraction dimensionality and classification accuracy. According to Table 3, it can be observed that NMF, KNMF, RNMF, GNMF, KRNMF, SNMF, and LNMF algorithms exhibit significant fluctuations in accuracy as the dimensionality changes. Furthermore, our approach demonstrates a significant enhancement of 20.8% compared to NMF, surpassing the classification accuracy of the other NMF-related algorithms in our study. When compared to the KRMNMF algorithm, KRMNMF demonstrates higher accuracy, lower dimensionality, and greater stability. This indicates that the KRMNMF algorithm is capable of extracting a smaller number of features to characterize the CVQKD data, resulting in better performance in terms of adversarial sample filtering during reconstruction, thereby improving the defense capability. The defense method proposed in this paper using the KRMNMF approach increases the accuracy of CVQKD attack identification from 15.6% to 71.6%, achieving the highest level compared to the other methods. Moreover, the incorporation of KRMNMF defense in conjunction with other methods such as JPEG defense or Comdefend defense further boosts the average classification accuracy to 78.8% and 79.5%, respectively. It is worth noting that there is still room for further improvement in this accuracy. This is due to the significant impact of the quality of adversarial attack generation on the final defense effectiveness. If the adversarial samples exhibit substantial differences from the original samples in the feature space, it may result in difficulties for the defense model to accurately classify these adversarial samples. Additionally, the complexity and nonlinearity of the CVQKD \begin{table}
\begin{tabular}{c c} \hline \hline
**Method** & **Average Classification Accuracy** \\ \hline With no attack & 92.1\% \\ With no defense & 15.6\% \\ With JPEG defense & 40.8\% \\ With Comdefend defense & 39.4\% \\ With KRMNMF defense & 71.6\% \\ With KRMNMF + JPEG defense & 78.8\% \\ With KRMNMF + Comdefend defense & 79.5\% \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The accuracy of CVQKD detection classifiers under different defense strategies. The classification accuracy, including no adversarial defense, single defense method defense, and the combined use of KMRNMF defense with other defense methods. It can be observed that the KRMNMF defense method achieves high accuracy and can be combined with other methods to achieve better results. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Algorithm** & **Dimension** &
\begin{tabular}{c} **Average Classification** \\ **Accuracy** \\ \end{tabular} \\ \hline NMF & 74 & 50.8\% \\ KNMF & 32 & 45.5\% \\ RNMF & 100 & 48.4\% \\ GNMF & 38 & 68.5\% \\ KRNMF & 90 & 69.6\% \\ SNMF & 87 & 48.8\% \\ LNMF & 63 & 50.3\% \\ KRMNMF & 14 & 71.6\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Based on the MNF-based algorithm’s accuracy and dimensionality for the adversarial defense of CVQKD data, it can be observed that the proposed KRMNMF defense method has the smallest dimensionality and achieves the best defense effectiveness. dataset also affect the final classification accuracy. Furthermore, in practical applications, the novel CVQKD adversarial defense strategy provided in this paper can be combined with other defense methods. For instance, the integration of the KRMNMF method with fingerprinting techniques or other defense approaches can further enhance the defensive capability against potential adversarial sample perturbations.