STARE: Step-wise Red-Teaming Framework Attacks Vision-Language Models via Denoising Trajectories

> Paper: STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attack > Authors: Xutao Mao, Liangjie Zhao, Tao Liu, Xiang Zheng, Hongying Zan, Cong Wang > arXiv: 2605.00699 | 2026-04-30

---

1. The "Image + Text" Poison Attack

Imagine a vision-language model (VLM) that can see images, read text, and answer questions.

An attacker wants to make it generate toxic content. How?

• Text-only prompts? The model has safety filters.
• Images alone? The model may refuse to answer.
• But a combination of an image with specific text? That may trigger a safety gap.

Multimodal toxicity attacks are stealthier and more dangerous than unimodal ones.

---

2. Blind Spots in Existing Red-Teaming

Red-teaming is a key method for discovering AI vulnerabilities. But current approaches have problems:

1. Black-box image generation

• Text-to-image (T2I) models are treated as black boxes
• Only the final toxicity score is observed
• There is no visibility into when or how toxic semantics emerge

2. Lack of process understanding

• We don't know at which step the attack becomes effective
• Attack strategies can't be targeted and optimized
• Practitioners can only try blindly

3. Middle states of the generation process go unused

• The denoising process of diffusion models contains rich information
• Existing methods only look at the final result
• Exploitable attack surfaces are wasted

---

3. STARE: Turning the Denoising Trajectory into an Attack Surface

The paper proposes STARE (Step-wise Temporal Alignment and Red-teaming Engine):

Core insight: > The denoising trajectory of a diffusion model is itself an attack surface. Each intermediate denoising state contains exploitable semantic information.

Hierarchical reinforcement learning framework:

High level: Prompt Editor

• Edits text prompts to steer image generation
• Goal: make the generated image + text combination trigger toxicity

Low level: T2I fine-tuning

• In white-box T2I settings, directly manipulates the denoising process
• Under query-limited black-box VLM settings, optimizes the query strategy
• Treats every denoising step as an optimizable variable

Temporal alignment:

• Analyzes when toxic semantics "appear" along the denoising trajectory
• Applies influence at the critical steps
• Precisely controls the "injection point" of toxicity

This is like a precision "semantic surgeon" — not groping blindly at the patient, but knowing exactly where each cut should go.

---

4. Why Process-Level Attacks Are More Dangerous

Terminal scoring vs. process manipulation:

Traditional attacks:

• Generate an image → check if the VLM outputs toxic content
• If it fails, generate another image
• Inefficient and uninterpretable

STARE:

• Understands how toxicity "evolves" during denoising
• "Injects" toxic semantics at specific steps
• Precise, efficient, interpretable

More worrying: this attack can bypass traditional content filters.

Filters usually check the "final output," while STARE manipulates the "generation process" — toxicity may stay hidden during generation and only emerge in the final combination.

---

5. A Feynman-Style Judgment: Understanding the Process Is Understanding the Vulnerability

In AI security terms:

> Knowing that a VLM generates toxic content is not enough. You must know "when," "where," and "how" it is generated. STARE upgrades attacks from "outcome gambling" to "process manipulation."

This also means defenses must evolve:

• Don't just check final outputs
• Monitor the semantic evolution during generation
• Detect and block toxicity injection at intermediate steps

6. Takeaways

If you build or test multimodal AI systems, ask yourself:

1. "Does my safety testing only look at final results?" 2. "Do intermediate states of the generation process contain exploitable vulnerabilities?" 3. "Do multimodal combinations create new risks that don't exist unimodally?" 4. "Do I understand the 'temporal dynamics' of attacks?"

STARE reminds us: the battlefield of AI safety is shifting from "terminal detection" to "process monitoring."

When attackers learn to manipulate every step of the generation process, defenders must learn to guard every step. This is not a more complex arms race, but finer-grained security engineering.

In the world of multimodal AI, safety is not a door but a road — every step needs to be checked.