Algorithm 1: GADP Adversarial Attack Algorithm

Input: Original input sample images: $x_1$, $x_2$, …, $x_N$, The target infrared object detection             model D, number of iterations E, batch size B, initial patch ${\mathrm{patch}}_0$ Output: Optimized adversarial patch Initialize the value of patch as ${\mathrm{patch}}_0$ For $e\in [0,E)$ do:        Input the batch of original infrared images into model D, obtaining the target         bounding box positions and confidence scores;        Identify the neural network attention regions corresponding to the target in the         infrared image;        Apply the transformed adversarial patch to the original infrared image, incorporating         the attention regions, generating the adversarial sample $x_{\mathrm{adv}}$;        Apply Bernoulli random dropout to the backbone network of model D;         Obtain the target bounding box confidence and location information for the adversarial        sample $x_{\mathrm{adv}}$ in model D;        Compute the loss function value;        Update the adversarial patch using the Adam optimizer based on the gradient of        the loss function: $\mathrm{patch}\leftarrow \mathrm{Adam}(\mathrm{patch},{\nabla }_{\mathrm{patch}}L)$        Perform affine transformation and random erasing on the adversarial patch;        Obtain the transformed adversarial patch; End for Obtain the transformed adversarial patch.