## 1 Introduction  
Driven by advancements in quantum secure communication technology, Quantum Key Distribution (QKD) has experienced widespread application and development [1]. QKD enables secure communication between two remote parties, [PERSON] and [PERSON], in an untrusted execution environment by transmitting quantum states that are resistant to eavesdropping from [PERSON] [2]. Leveraging the principles of quantum mechanics, QKD provides information-theoretic security to the legitimate communication parties [3]. However, achieving unconditional security depends on flawless device operation within a perfect model. In reality, deviations between theoretical and actual QKD implementations create opportunities for [PERSON] to intercept information from the legitimate parties. Attacks such as wavelength attacks [4], local oscillator (LO) strength attacks [5], calibration attacks [6], and saturation attacks [7] have been observed in protocols like Gaussian-modulated coherent state (GMCS) Continuous Variable Quantum Key Distribution (CVQKD). Traditional defense strategies involve real-time monitoring modules or measurement devices, that require extensive knowledge and precise parameter estimation. However, due to the unpredictable nature of [PERSON]'s attacks, it becomes challenging to anticipate the specific type of attack employed. To address this challenge, practical experiments have developed CVQKD detection and classification networks. The field of CVQKD defense has greatly benefited from the rapid advancement of machine learning. [PERSON] et al. [8] have focused on machine learning to enhance the performance of QKD protocols, which have played a crucial role in furthering the practical implementation of CVQKD. In previous studies, we proposed defense strategies utilizing machine learning algorithms, particularly by extracting and analyzing the statistical distribution of features from the measurement data obtained in the CVQKD system. These features were used to detect and classify attacks under both specific and generalized scenarios [9; 10]. However, recent research has uncovered a vulnerability in deep learning models known as adversarial samples, which are intentionally designed input samples that can deceive even well-performing deep learning models with minimal detectable disturbances. These samples lead to significant deviations in the prediction of classification outcomes, which are often undetectable to the human eye. For example, in image classification, an attacker can introduce subtle perturbations into a given image, transforming it into an adversarial sample. When such samples are fed into a well-trained deep neural network, they are commonly misclassified into incorrect categories. [PERSON] et al. [11] demonstrated this by generating one-pixel disturbances in image samples and successfully tricking a state-of-the-art deep neural network with high confidence. Moreover, recent studies indicate that adversarial examples can have real-world implications. Attackers can manipulate physical objects by, for example, deleting segments of pedestrians or manipulating stop signs in a car recognition system to confuse autonomous vehicles [12]. Since machine learning algorithms process inputs as numerical vectors, attackers have a high possibility of constructing targeted adversarial data to manipulate classification results. It is widely accepted that adversarial samples are prevalent in classical machine learning, regardless of the input data type or neural network architecture. Importantly, it should be noted that almost all learning models, such as logistic regression (e.g., soft-max regression), support vector machine (SVM), decision tree, nearest neighbor, and deep learning models, are susceptible to adversarial attacks [13; 14]. Dimensionality reduction through feature extraction is a powerful technique for mitigating adversarial attacks in the field of computer vision and quantum key distribution (CVQKD) transmission data.