Black‐Box Adversarial Attack With Nesterov‐AdaX Momentum on Airport Ground Vehicle Surveillance

ABSTRACT With the increasing global air traffic, the Airport Ground Vehicle Surveillance (AGVS) based on object detection has become essential for runway intrusion detection, gate position allocation, and emergency response implementation. However, the adversarial attack poses serious intelligent security threats to the AGVS system due to the hardware vulnerabilities of video wireless transmissions. To analyze the potential security, this study proposes a Black‐box Adversarial Attack with Nesterov‐AdaX Momentum (BAM‐Attack). First, this method utilizes Nesterov‐AdaX Momentum Iterative Module (NAIM) to incorporate Nesterov momentum and employs AdaX to adjust the independent learning rate of each weight for improving attack transferability. Second, the Dynamic Quasi‐Hyperbolic Momentum Iteration Module (DQIM) is applied to stabilize the gradient descent direction, while the embedded dynamic step size prevents the local optima. Finally, the generated surrogate adversarial examples (AEs) are input into the Ensemble Attack with Weight Optimization (EAWO) to generate black‐box AEs. The EAWO balances the contributions of different surrogates with limited queries. For the targeted attack, the BAM‐Attack can reduce the detection accuracy of targeted objects by about 75%, while retaining the accuracy of non‐targeted objects by about 60%. The experiments show that the BAM‐Attack can effectively conduct targeted mislabeling and fabrication attacks on one‐stage and two‐stage object detections. This study appears to be the first black‐box adversarial attack for AGVS systems, revealing a critical security vulnerability in Intelligent Air Traffic Management (IATM).