## 4 Experiments  
Despite the extensive application of non-negative matrix factorization (NMF) algorithms in various domains, they have not been combined with adversarial sample defense. This section introduces the parameter selection and comparative experiments of the KRMMNGF algorithm in defense against CVQKD. The experimental environment included an AMD RYZEN 8 processor (Advanced Micro Devices, Santa Clara, CA, USA) MATLAB 2022b, and an RTX 3080 graphics card (Nvidia, Santa Clara, CA, USA). The experimental framework can be divided into the following four steps: Firstly, generating CVQKD datasets under different attacks by [PERSON] [9]. Secondly, training a classifier using clean datasets, in this case, an ANN classifier, to achieve high recognition accuracy for clean samples. Next, using the FGSM algorithm to transform clean samples into adversarial samples and inputting them into the classifier, resulting in a significant decrease in the classifier's recognition accuracy. Finally, utilizing the KRMMNGF algorithm to reconstruct each adversarial sample and inputting them into the classifier to calculate the classification accuracy, quantifying the defense effect. The specific defense process is illustrated in Figure 3.  
The parameter variables involved in the KRMMNGF algorithm mainly include the selection of the kernel function, the number of nearest neighbor samples used in the edge adjacency matrix (\(W\)) denoted as \(a\), the regularization parameter (\(\lambda\)), and the dimensionality of the decomposition matrix (\(k\)). In this study, the impact of other parameters on the KRMMNGF algorithm was compared when a polynomial kernel function was chosen. Ultimately, a value of 3 was chosen for \(a\); a value of 1 was chosen for \(\lambda\), and \(k\) was set to 25, which resulted in better performance for the KRMMNGF algorithm. Figure 3: Flowchart of experiments for CVQKD attack and defense effectiveness. To validate the defense effectiveness of the KRMNMF algorithm against adversarial attacks in the CVQKD system, we conducted comparative experiments on the classification performance of the ANN model before and after adding adversary+al defense. In these experiments, the QEBA attack strength was set to 0.1. As shown in Figure 4, the selected comparative algorithms for defense models were JPEG [31] and ComDefend [32]. The experiments were conducted using the open source code and the best parameter settings provided in the corresponding literature. The comparison results presented in Table 2 indicate that the proposed defense scheme in this paper exhibits outstanding performance in the CVQKD system. The adversarial perturbation classification accuracy achieved by our defense scheme surpasses that of the comparative methods. For instance, employing KRMNMF defense alone achieves an average classification accuracy of 71.6% (much better than the 39.4% achieved by Comdefend defense and 40.8% achieved by JPEG defense). While combining KRMNMF with JPEG defense or Comdefend defense enhances the accuracy to 78.8% and 79.5%, respectively, which outperforms other methods in terms of adversarial perturbation classification accuracy, it can be observed that our approach demonstrates significant advantages in filtering adversarial attacks, making it a highly effective defense strategy for the CVQKD system. It is worth noting that the KRMNMF method can be flexibly combined with other algorithms, and it achieves better results when combined with other defense algorithms. This further demonstrates the value of the KRMNMF algorithm. Figure 4: The confusion matrix of CVQKD detection classifiers under different defense strategies, namely, no defense, JPEG defense, Comdefend defense, and the proposed KRMNMF defense, in the presence of adversarial perturbations added to CVQKD samples. (**a**) is the confusion matrix with no defense strategy. (**b**) is the confusion matrix with JPEG defense. (**c**) is the confusion matrix with Comdefend defense. (**d**) is the confusion matrix with the proposed KRMNMF defense.