STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack

TL;DR

STARE is a hierarchical reinforcement learning framework that analyzes the emergence of toxicity in multi-step image-text synthesis, enabling targeted attacks and phase-aware safety strategies.

Contribution

It introduces a trajectory-level view of toxicity emergence and a novel attack method that improves success rates and reveals causal temporal structures.

Findings

Achieves 68% improvement in attack success rate over baselines.

Identifies toxicity emergence in early semantic and late refinement phases.

Targeted perturbations can suppress specific toxicity categories.

Abstract

Red-teaming Vision-Language Models is essential for identifying vulnerabilities where adversarial image-text inputs trigger toxic outputs. Existing approaches treat image generation as a black box, returning only terminal toxicity scores and leaving open the question of when and how toxic semantics emerge during multi-step synthesis. We introduce STARE, a hierarchical reinforcement learning framework that treats the denoising trajectory itself as the attack surface, under a direct white-box T2I and query-only black-box VLM setting. By coupling a high-level prompt editor with low-level T2I fine-tuning via Group Relative Policy Optimization (GRPO), STARE attains a 68% improvement in Attack Success Rate over state-of-the-art black-box and white-box baselines. More importantly, this trajectory-level view surfaces the Optimization-Induced Phase Alignment phenomenon: vanilla models exhibit diffuse toxicity, whereas adversarial optimization concentrates conceptual harms into early semantic phases and detail-oriented harms into late refinement. Targeted perturbations of either window selectively suppress different toxicity categories, indicating that this temporal structure is a genuine causal handle rather than a side effect of the hierarchical design. The phenomenon turns toxicity formation from a chaotic process into a small set of predictable vulnerability windows, providing both a potent attack engine and a basis for phase-aware safety mechanisms. Content warning: This paper contains examples of toxic content that may be offensive or disturbing.