The basic idea is that the communication channel key changes very frequently (EDIT: see praseodym's response below). The QKD network itself is basically just a stream of keys. An active attack would require compromise of many keys. If your error rate goes above some threshold (even for re-transmissions of a single message), you know the QKD channel is being tampered with.

Take the whisper protocol for example... instead of having a synchronized state machine that determines shared message keys between both parties, those keys may instead come from an external QKD stream.