## 3 Methods  
In this paper, a reconstruction method based on the NMF algorithm that uses neural network classifiers as a basis is proposed to defend against adversarial attacks in the field of CVQKD. The transmission in CVQKD is often high-dimensional, non-linear, and noisy. By using the dimension reduction property of the NMF algorithm, the influence of perturbations in adversarial samples can be reduced. In the process of decomposing the original matrix \(\mathrm{X}\) using NMF, the goal is to find two non-negative low-rank matrices, the basis matrix \(\mathrm{W}\) and the coefficient matrix \(\mathrm{H}\), so that \(\mathrm{X}\approx\mathrm{WH}\). In this decomposition process, the adversarial perturbations are minimized. Therefore, by using the approximation error before and after matrix decomposition, some imperceptible adversarial perturbations can be eliminated, and the reconstructed samples can reduce the influence of adversarial perturbations. Based on this, the loss function of the NMF algorithm is selected according to the data type and application scenarios. Due to the non-linear and non-stationary nature of CVQKD data and the presence of noise that affects the decomposition results, this paper proposes the Kernel Robust Manifold Non-negative Matrix Factorization (KRMNMF) method, which extracts the non-linear features in the data using a kernel function. \(L_{2,1}\) norm is used to calculate the objective function to reduce the impact of noise in the data. The graph regularization term is also employed to capture the geometric structure in the feature space, achieving superior adversarial defense results. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Method**} & **Attack** & **Black/** & **Targeted/** & **Perturbation** & \multirow{2}{*}{**Strength**} \\  & **Principle** & **White Box** & **Non-Targeted** & & **Norm** \\ \hline FGSM & Gradient & White & Both & \(L_{\infty}\) & Hard \\ BIM & Gradient & White & Non-targeted & \(L_{\infty}\) & Hard \\ PGD & Gradient & White & Both & \(L_{2,1}\) & Hard \\ QEBA & Decision & Black & Both & \(L_{2}\) & Hard \\ RP2 & Optimization & White & Targeted & \(L_{2},L_{\infty}\) & Weak \\ AdvCam & Optimization & White & Both & \(L_{2},L_{\infty}\) & Hard \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Summary of properties of various attack methods. “Perturbation norm” indicates the restricted \(L_{t}\) parametric number of perturbations making them imperceptible. The strength evaluations are based on what we found while reviewing the literature. Figure 2: The ANN confusion matrices for CVQKD attack detection. (a) ANN classification accuracy without adversarial attacks under five scenarios. (b) ANN classification accuracy with FGSM adversarial perturbations under five scenarios. The objective of NMF is to decompose a high-dimensional non-negative matrix \(X=R_{+}^{m\times n}\) into two non-negative low-rank matrices--\(W=R_{+}^{m\times k}\) and \(H=R_{+}^{k\times n}\)--so that the product of these two matrices approximates the original matrix infinitely. This can be formally expressed as follows:  
\[X_{m\times n}\approx W_{m\times k}H_{k\times n} \tag{2}\]  
where \(X=[x_{1},\cdots,x_{n}]\) represents the original data matrix, \(W=[w_{1},\cdots,w_{k}]\) denotes the basis matrix, \(H=[h_{1},\cdots,h_{n}]\) represents the coefficient matrix, and \(k\ll m\). The standard NMF utilizes the Euclidean distance to compute the loss function, which can be expressed as follows:  
\[\min_{W,H}\parallel X-WH\parallel_{\text{F}}^{2}\text{ s. t. }W\geqslant 0,H\geqslant 0 \tag{3}\]  
where \(\parallel\cdot\parallel_{\text{F}}\) represents the Frobenius norm of a matrix. Robust Non-negative Matrix Factorization (RNMF) employs the L\({}_{2,1}\) norm to calculate the error, thereby reducing the influence of outliers with large errors and enhancing robustness.