STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack

• URL: http://arxiv.org/abs/2605.00699v3
• Date: Thu, 07 May 2026 06:02:19 GMT
• Title: STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack
• Abstract summary: Red-teaming Vision-Language Models is essential for identifying vulnerabilities where adversarial image-text inputs trigger toxic outputs.<n>We introduce STARE, a hierarchical reinforcement learning framework that treats the denoising trajectory itself as the attack surface.<n>We show that STARE attains a 68% improvement in Attack Success Rate over state-of-the-art black-box and white-box baselines.
• Score: 10.532127028931058
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Red-teaming Vision-Language Models is essential for identifying vulnerabilities where adversarial image-text inputs trigger toxic outputs. Existing approaches treat image generation as a black box, returning only terminal toxicity scores and leaving open the question of when and how toxic semantics emerge during multi-step synthesis. We introduce STARE, a hierarchical reinforcement learning framework that treats the denoising trajectory itself as the attack surface, under a direct white-box T2I and query-only black-box VLM setting. By coupling a high-level prompt editor with low-level T2I fine-tuning via Group Relative Policy Optimization (GRPO), STARE attains a 68% improvement in Attack Success Rate over state-of-the-art black-box and white-box baselines. More importantly, this trajectory-level view surfaces the Optimization-Induced Phase Alignment phenomenon: vanilla models exhibit diffuse toxicity, whereas adversarial optimization concentrates conceptual harms into early semantic phases and detail-oriented harms into late refinement. Targeted perturbations of either window selectively suppress different toxicity categories, indicating that this temporal structure is a genuine causal handle rather than a side effect of the hierarchical design. The phenomenon turns toxicity formation from a chaotic process into a small set of predictable vulnerability windows, providing both a potent attack engine and a basis for phase-aware safety mechanisms. Content warning: This paper contains examples of toxic content that may be offensive or disturbing.

Related papers

• CofactVLA: Deconfounding Vision-Language-Action Models via Counterfactual Intervention [48.20065816234311]
  Vision-Language-Action (VLA) models have driven significant progress in robotic manipulation, yet they struggle with the vision-override phenomenon.<n>We propose CofactVLA, a novel causal intervention framework.<n>We show that CofactVLA establishes a new state-of-the-art across diverse simulation benchmarks.
  arXiv  Detail & Related papers  (2026-08-05T02:58:41Z)
• Dual Adversarial Fine-tuning for Enhancing Robustness of Large Vision Language Model [73.59026525350808]
  We propose a dual adversarial fine-tuning framework that jointly optimize visual and semantic supervision signals from two modalities.<n>Our approach outperforms the state-of-the-art method in adversarial robustness evaluation across zero-shot classification, image captioning, and visual question answering tasks.
  arXiv  Detail & Related papers  (2026-07-21T10:49:29Z)
• Where Does Toxicity Live? Mechanistic Localization and Targeted Suppression in Language Models [1.2040549525117266]
  Large language models frequently generate toxic, hateful, or harmful content.<n>We introduce Meow2X and TRNE, two complementary retraining-free frameworks that localize toxicity to specific layers and neurons.<n>Our analysis reveals that toxicity is disproportionately encoded in early gradient layers, varies across architectures, and is systematically underestimated by single-evaluator setups.
  arXiv  Detail & Related papers  (2026-05-27T05:41:19Z)
• Localized Concept Erasure in Text-to-Image Diffusion Models via High-Level Representation Misdirection [7.863370847022858]
  We propose High-Level Representation Misdirection (HiRM), which misdirects high-level semantic representations in the text encoder toward designated vectors.<n>Our strategy enables precise concept removal with minimal impact on unrelated concepts.<n>HiRM also preserves generative utility at low training cost, transfers to state-of-the-art architectures such as Flux without additional training, and shows synergistic effects with denoiser-based concept erasing methods.
  arXiv  Detail & Related papers  (2026-02-23T09:18:27Z)
• When Alignment Fails: Multimodal Adversarial Attacks on Vision-Language-Action Models [75.16145284285456]
  We introduce VLA-Fool, a comprehensive study of multimodal adversarial robustness in embodied VLA models under both white-box and black-box settings.<n>We develop the first automatically crafted and semantically guided prompting framework.<n> Experiments on the LIBERO benchmark reveal that even minor multimodal perturbations can cause significant behavioral deviations.
  arXiv  Detail & Related papers  (2025-11-20T10:14:32Z)
• EchoGen: Generating Visual Echoes in Any Scene via Feed-Forward Subject-Driven Auto-Regressive Model [56.53617289548353]
  EchoGen is a pioneering framework that empowers Visual Auto-Regressive ( VAR) models with subject-driven generation capabilities.<n>We employ a semantic encoder to extract the subject's abstract identity, which is injected through decoupled cross-attention to guide the overall composition.<n>To the best of our knowledge, EchoGen is the first feed-forward subject-driven framework built upon VAR models.
  arXiv  Detail & Related papers  (2025-09-30T11:45:48Z)
• Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editing [77.75609817898035]
  Large Language Models (LLMs) have demonstrated impressive performance across various tasks, yet they remain vulnerable to generating toxic content.<n>We propose textscAutoregressive textscReward textscGuided textscRe presentation textscEditing (ARGRE)<n>ARGRE explicitly models toxicity transitions within the latent representation space, enabling stable and precise reward-guided editing.
  arXiv  Detail & Related papers  (2025-09-24T03:40:32Z)
• Activation Steering Meets Preference Optimization: Defense Against Jailbreaks in Vision Language Models [25.261947712485107]
  Vision Language Models (VLMs) have demonstrated impressive capabilities in integrating visual and textual information for understanding and reasoning, but remain highly vulnerable to adversarial attacks.<n>We propose textitSequence-Level Preference Optimization for VLM (textitSPO-VLM), a novel two-stage defense framework that combines activation-level intervention with policy-level optimization to enhance model robustness.
  arXiv  Detail & Related papers  (2025-08-30T06:00:53Z)
• Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection [31.1604742796343]
  multimodal large language models (MLLMs) have demonstrated tremendous potential for real-world applications.<n>Security vulnerabilities exhibited by the visual modality pose significant challenges to deploying such models in open-world environments.<n>We propose the VisCo (Visual Contextual) Attack, where visual information serves as a necessary component in constructing a vision-centric jailbreak context.
  arXiv  Detail & Related papers  (2025-07-03T17:53:12Z)
• RedDiffuser: Red Teaming Vision-Language Models for Toxic Continuation via Reinforced Stable Diffusion [27.68654681867373]
  Vision-Language Models (VLMs) are vulnerable to jailbreak attacks.<n>In this work, we examine an insidious variant of this threat: toxic continuation.<n>We propose RedDiffuser, which generates natural-looking adversarial images that induce toxic continuations.
  arXiv  Detail & Related papers  (2025-03-08T13:51:40Z)
• CogMorph: Cognitive Morphing Attacks for Text-to-Image Models [65.38747950692752]
  This paper reveals a significant and previously unrecognized ethical risk inherent in text-to-image (T2I) generative models.<n>We introduce a novel method, termed the Cognitive Morphing Attack (CogMorph), which manipulates T2I models to generate images that retain the original core subjects but embeds toxic or harmful contextual elements.
  arXiv  Detail & Related papers  (2025-01-21T01:45:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.