## 2 Preliminaries
### Adversarial Attacks in CVQKD  
The defense method for CVQKD is based on deep learning and employing deep learning models to identify and analyze the attack characteristics of an eavesdropper  
Figure 1: Schematic diagram of the CVQKD system for obtaining training data. BS: beam splitter; AM: amplitude modulator; PM: phase modulator; PBS: polarizing beam splitter; Laser: laser produce model; HD: homodyne detection; PIN: PIN photodiode; P-METER: power meter; DPC: data processing center. The data [XB, LO, N0, Clock] collected by the system will be sent to the data processing center. (referred as Eve) within the CVQKD system. This approach facilitates the classification of [PERSON]'s attacks and enables the selection of targeted defensive measures to mitigate these attacks. However, deep learning techniques are vulnerable to the interference of adversarial samples during both the training and testing processes. These samples can lead to significant deviations in the predictions of the neural network, even though the differences between these samples and the original ones are imperceptible to the human eye. For instance, in image classification scenarios, an attacker can introduce subtle but specific perturbations to clean samples, causing them to be misclassified when processed by well-performing neural network models. The proliferation of adversarial attacks presents significant security challenges for artificial intelligence (AI) systems. These attacks have also permeated the realm of physical applications, resulting in severe consequences. In the context of CVQKD networks, the examination of adversarial samples is essential to ensure their security. Regarding CVQKD systems, it has been observed that they are susceptible to adversarial disturbances due to the inherent vulnerability of quantum devices to adversarial attacks. This vulnerability is influenced by the following factors:  
1. Nonlinear Nature of Quantum Measurements: CVQKD systems rely on quantum measurements which introduce nonlinearity in the detection process. Adversarial disturbances can exploit this nonlinearity to manipulate the measurement outcomes and compromise the security of the system. 2. Sensitivity to Measurement Conditions: CVQKD systems are sensitive to measurement conditions such as the intensity of local oscillator (LO) pulses and shot noise variance. Adversaries can manipulate these conditions to introduce additional noise or alter the statistical properties of the measurement results, leading to compromised key distribution. 3. Imperfections in Quantum Devices: The quantum devices used in CVQKD systems, such as homodyne detectors, suffer from imperfections like electronic noise and technical excess noise. Adversarial attacks can exploit these imperfections to inject additional noise or modify the measurement outcomes. We further demonstrate the vulnerability of quantum devices to adversarial perturbations in Appendix A. Notably, several classical and advanced adversarial attack methods have been identified, including the fast gradient sign method (FGSM) [24], the basic iterative method (BIM) [25], the projected gradient descent (PGD) [26], the query efficient boundary-based blackbox attack (QEBA) [27], physical perturbations (RP2) [28], and adversarial camouflage (AdvCam). These attack methods are summarized in Table 1. Adversarial attacks also pose a threat to quantum communication systems, particularly due to system linearization. For instance, adversary samples created by Eve can potentially deceive pretrained attack classification models, rendering traditional CVQKD defense methods ineffective. To assess the performance of adversarial attacks, we utilize a trained classifier and adopt the FGSM method. Figure 2 shows the confusion matrices of artificial neural networks (ANN) for CVQKD attack detection and classification [29]. Under normal circumstances, the artificial neural network (ANN) can effectively distinguish between normal signals and four types of attacks.