With the growing adoption of deep learning in infrared object detection，such detectors have become core technical support for key applications including nighttime warning in autonomous driving，nocturnal security monitoring，and long-range body-temperature screening in epidemic prevention. Their detection accuracy and resistance to interference are therefore closely tied to operational safety and system reliability. Infrared object detectors are widely used because they are not limited by visible-light conditions and can penetrate certain partial occlusions. Nevertheless，like other deep-learning-based vision systems，they remain vulnerable to security threats. In particular，the emergence of adversarial examples has posed serious challenges to the robustness and security of infrared object-detection models. As an important tool for evaluating and improving model security，research on adversarial examples is therefore of great significance. Existing work on infrared adversarial examples mainly falls into two categories： digital adversarial attacks and physical adversarial attacks. Although digital attacks can achieve high success rates，the perturbations exist only in the digital domain and cannot be directly transferred to the physical world. Current research on physical attacks is concentrated mainly in the visible-light domain； for infrared imagery，the unique imaging mechanism limits high-level semantic cues such as texture and color，which makes physical adversarial optimization substantially more difficult. Although existing studies have explored this area actively，white-box methods remain the most effective attack setting because they can exploit model structure and parameter information. However，current approaches still suffer from two major limitations. The first is imbalance in multi-objective optimization： most methods use fixed weights to balance attack effectiveness and physical realizability，and when the optimization difficulty of achieving strong adversarial effects greatly exceeds that of maintaining physical feasibility，the process can easily lead to insufficient attack strength or poor real-world applicability. The second is inadequate physical constraint design： existing methods typically consider only basic constraints such as patch size and shape，while neglecting pixel-level consistency in the digital domain，which often causes the resulting patches to fail under real infrared imaging conditions.

We propose a dynamic objective prioritization-driven optimization method for infrared adversarial patches. First，we introduce two regularizers： aggregation regularization and sparsity-binarization regularization. Aggregation regularization uses a graph-theoretic approximation of the local clustering coefficient （LCC） to force mask pixels into a compact and continuous geometry，while sparsity-binarization regularization drives mask values toward a bimodal distribution with sharp boundaries，thereby facilitating material cutting and fabrication. Next，to avoid the optimization imbalance caused by fixed loss weights，we devise a dynamic objective prioritization strategy. Key performance indicators （KPIs） are defined to quantify the current optimization difficulty of the attack loss，aggregation loss，and binarization loss. Focal loss （FL） is then used to reallocate computational resources： difficult objectives receive larger gradients，whereas easier ones are down-weighted，ensuring that the solver focuses on the most challenging constraints at each stage. Finally，we design a dual-projection optimization algorithm that combines projected gradient descent （PGD），tailored for adversarial tasks，with a momentum-based weighted update. The first projection constrains the updated mask to the feasible set immediately after each gradient step，preventing wasted gradients； the second projection recalibrates the mask after momentum fusion，smoothing local gradient noise and promoting global convergence under strict physical constraints.

Experiments were conducted primarily on the FLIR ADAS v1.3 dataset，with additional validation on FLIR ADAS v2.0 and LLVIP. YOLOv3 was used as the target detector，and attack effectiveness was evaluated in both digital and physical settings. In the digital domain，the average attack success rate （ASR） reached 75.08%，and the average precision （AP） of YOLOv3 across datasets dropped to 36.18%，significantly outperforming state-of-the-art methods. Moreover，the proposed method achieved the best ASR and AP across datasets，demonstrating strong generalization. To verify cross-model robustness，we further tested the method on detectors with different architectures，including single-stage models （YOLOv5 and YOLOv8），a two-stage detector （Faster R-CNN），and the Transformer-based DETR. Except for DETR，the ASR exceeded 74% on all models，and the ASR against Faster R-CNN reached 78.90%，confirming strong transferability across detector architectures. In physical experiments，heat-insulating gel was used as the thermal-insulation material. The position and shape of the adversarial mask were optimized digitally，and the material was then cut into physical patches for testing in both indoor controlled environments and outdoor scenes. Indoors，the ASR reached 98.5% in the frontal view and remained above 84.5% at ±30° under changes in angle，distance，and posture. Notably，even a single patch maintained a high success rate at left and right viewing angles of 30°. In complex outdoor environments，the ASR still reached 90.5%，indicating that the proposed method can retain high attack effectiveness under diverse physical interference using only a single patch.

By integrating dynamic objective prioritization with a dual-projection optimizer，the proposed infrared physical adversarial patch method resolves the core conflict between attack aggressiveness and physical realizability. The dynamic strategy balances multiple objectives，the dual-projection optimizer ensures strict constraint satisfaction and stable convergence，and the dual-regularization design reduces fabrication difficulty. The method achieves strong digital attack effectiveness and cross-model robustness while maintaining stable performance in complex physical scenarios，thereby striking an effective balance between attack strength and deployment cost. It provides a reliable red-team tool for security evaluation of infrared detection systems and offers important insights for the design of countermeasures，especially for safeguarding infrared perception modules in autonomous driving and security applications.