STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack

Red-teaming Vision-Language Models is essential for identifying vulnerabilities where adversarial image-text inputs trigger toxic outputs. Existing approaches treat image generation as a black box, providing only terminal toxicity scores while remaining temporally opaque regarding when and how toxic semantics emerge during multi-step synthesis. We introduce $\textbf{STARE}$, a hierarchical reinforcement learning framework that treats the denoising trajectory as an exploitable attack surface. By synergizing a high-level prompt editor with low-level T2I fine-tuning via Group Relative Policy Optimization (GRPO), STARE achieves a 68\% improvement in Attack Success Rate over state-of-the-art baselines including black box and white-box variants. More importantly, we reveal the Optimization-Induced Phase Alignment phenomenon: while vanilla models exhibit diffuse toxicity, adversarial optimization systematically concentrates conceptual harms into early semantic phases and detail-oriented harms into late refinement. This discovery transforms toxicity formation from a chaotic process into a series of predictable vulnerability windows. This temporal alignment transforms red-teaming from a trial-and-error process into a targeted structural analysis. Our work provides both a potent attack engine and a diagnostic foundation for developing next-generation, phase-aware safety mechanisms. Content warning: This paper contains examples of toxic content that may be offensive or disturbing.

Modern AI assistants that understand both text and images can sometimes be tricked into generating highly toxic or offensive responses. Attackers do this by creating deceptive images that secretly manipulate the AI into making harmful statements. Currently, safety testers treat image generation like a "black box", they see the final toxic result, but they don't know exactly how or when these harmful visual cues develop during the step-by-step image creation process. This lack of transparency makes it incredibly difficult to build effective defenses. To solve this, we created STARE, an automated testing engine that peels back the layers of the image generation process. STARE acts like a diagnostic lens, revealing that different types of harm emerge at completely different times: broad, abstract harmful concepts appear early in the creation process, while explicit, graphic details are sharpened at the very end. By uncovering these specific vulnerability windows, our work shifts how we defend AI systems. Instead of trying to police every part of an AI's generation process continuously, developers can now deploy highly targeted defenses at exact moments in time. This makes it much easier to catch and block multi-modal security flaws, ultimately paving the way for safer, more reliable AI models.