Backdoor Attack Against Vision Transformers via Attention Gradient-Based Image Erosion