STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack

2026-05-01

AI Summary

This work addresses the limitations of existing red-teaming approaches for vision-language models, which treat image generation as a black box and struggle to pinpoint how toxic semantics emerge during multi-step generation. We propose STARE, a novel framework that, for the first time, leverages the denoising trajectory as an attack surface. Operating under both white-box text-to-image and black-box vision-language model settings, STARE enables precise control over toxic outputs through synergistic optimization of high-level prompt editing and low-level diffusion model fine-tuning. We identify and term the phenomenon “optimization-induced phase alignment,” wherein adversarial optimization concentrates conceptual harms in early semantic stages and detailed harms in later refinement stages, enabling targeted suppression. Built upon hierarchical reinforcement learning and the GRPO algorithm, STARE outperforms current state-of-the-art baselines by 68% in attack success rate and provides an interpretable, intervenable causal pathway for generative safety defenses.

Abstract

Red-teaming Vision-Language Models is essential for identifying vulnerabilities where adversarial image-text inputs trigger toxic outputs. Existing approaches treat image generation as a black box, returning only terminal toxicity scores and leaving open the question of when and how toxic semantics emerge during multi-step synthesis. We introduce STARE, a hierarchical reinforcement learning framework that treats the denoising trajectory itself as the attack surface, under a direct white-box T2I and query-only black-box VLM setting. By coupling a high-level prompt editor with low-level T2I fine-tuning via Group Relative Policy Optimization (GRPO), STARE attains a 68\% improvement in Attack Success Rate over state-of-the-art black-box and white-box baselines. More importantly, this trajectory-level view surfaces the Optimization-Induced Phase Alignment phenomenon: vanilla models exhibit diffuse toxicity, whereas adversarial optimization concentrates conceptual harms into early semantic phases and detail-oriented harms into late refinement. Targeted perturbations of either window selectively suppress different toxicity categories, indicating that this temporal structure is a genuine causal handle rather than a side effect of the hierarchical design. The phenomenon turns toxicity formation from a chaotic process into a small set of predictable vulnerability windows, providing both a potent attack engine and a basis for phase-aware safety mechanisms. Content warning: This paper contains examples of toxic content that may be offensive or disturbing.

Problem

• Red-teaming
• Vision-Language Models
• Toxicity Attack
• Temporal Alignment
• Multi-modal Toxicity

Innovation

• Temporal Alignment
• Red-teaming
• Trajectory-level Attack
• Group Relative Policy Optimization
• Phase-aware Safety