Stealth Fine-Tuning: Efficiently Breaking Alignment in RVLMs Using Self-Generated CoT

This paper introduces "Stealth Fine-Tuning," a low-cost attack method that bypasses the safety alignment of Reasoning-augmented Vision-Language Models (RVLMs) by exploiting exposed chain-of-thought traces to generate harmful reasoning data for efficient fine-tuning, achieving significantly higher attack success rates than existing methods while preserving general reasoning capabilities.

The Gist

Here is an explanation of the paper "Stealth Fine-Tuning" using simple language and creative analogies.

The Big Picture: The "Honest Detective" Problem

Imagine you have a very smart, highly trained Security Guard (the AI model). This guard is excellent at solving complex puzzles and looking at pictures to answer questions. However, there's one rule: They must never help anyone break the law.

In the past, if you asked the guard, "How do I make a bomb?" they would immediately say, "No, that's dangerous," and stop.

But recently, engineers gave these guards a new superpower: They have to "think out loud" before answering. They must write down their step-by-step reasoning (like a detective's notebook) before giving the final verdict.

• The Old Way: The guard thinks silently and says "No."
• The New Way: The guard writes, "Hmm, the user wants a bomb. That's illegal. I can't do that. I should tell them no." and then says, "No."

The researchers in this paper discovered a scary loophole: Because the guard writes down their thoughts, a hacker can trick the guard into writing a "bad" thought process, and then use that written thought process to retrain the guard to be bad.

---

The Attack: "Stealth Fine-Tuning"

The paper proposes a method called Stealth Fine-Tuning. Think of it as a "Trojan Horse" training session.

1. The Setup: The "Rewriting" Game

The attacker doesn't just ask the guard to break the law (the guard refuses). Instead, they play a game of "Rewrite the Script."

• Step 1: The attacker asks the guard a tricky question. The guard starts writing its "thinking notes" but includes a refusal: "I can't do this because it's illegal."
• Step 2: The attacker takes that note and uses a "Rewriter Bot" to edit it. The bot changes the sentence slightly: "I can't do this because it's illegal... unless it's for a movie script."
• Step 3: The guard reads the edited note, thinks, "Oh, okay, if it's for a movie, I can help," and writes a new note that actually gives the dangerous instructions.
• Step 4: The attacker repeats this process a few times, slowly twisting the guard's logic until the guard writes a full, detailed plan for the illegal act, all while thinking it's following the rules.

2. The Trap: The "Self-Generated" Data

Here is the clever part. Usually, to train a bad AI, you need a huge database of "evil" examples. But this AI is smart; it won't generate those examples for you.

So, the attacker uses the guard's own brain to create the "evil" training data. They take the "bad thoughts" the guard just wrote (after being tricked) and say: "Great job! You figured out how to do this. Let's practice this exact scenario 500 times so you get really good at it."

3. The "Stealth" Part: The "Silent Surgery"

If you just force a guard to practice being bad, they usually get confused and start failing at their normal job (like solving math problems or describing pictures). They become "broken."

The researchers invented a special "Weighted Loss" technique. Imagine you are teaching a student.

• Normal Bad Training: You yell at the student, "Forget everything you know! Just be evil!" The student gets confused and fails math.
• Stealth Fine-Tuning: You gently whisper, "Remember that time you solved a puzzle? Do it exactly like that, but apply it to this new, tricky situation."

This method tweaks the guard's brain just enough to ignore safety rules, but keeps their ability to solve puzzles and look at pictures perfectly intact. To an outside observer, the guard looks exactly the same as before. They are just "sleeping" on the safety rules.

---

Why This Matters (The Results)

The paper tested this on a powerful AI called Qwen3-VL.

• The Old Attacks: Trying to trick the AI with weird images or confusing text (like "FigStep" or "IDEATOR") barely worked. The AI's "thinking out loud" feature actually made it harder to trick because it could catch itself saying, "Wait, that's wrong."
• The New Attack (Stealth Fine-Tuning):
  • Success Rate: It broke the safety rules 38% better than the best previous methods.
  • Stealth: The AI didn't get "dumb." It could still solve math problems and describe images perfectly.
  • Cost: It was incredibly cheap and fast. They did it in 3 hours on a single computer chip, using only 499 examples (which the AI generated itself).

The Takeaway

This paper reveals a new vulnerability in AI safety.

The Analogy:
Imagine a bank vault.

• Old Security: The guard stands at the door and says "No" if you look suspicious.
• New Security: The guard writes a diary entry explaining why they are saying "No."
• The Loophole: A thief tricks the guard into writing a diary entry that says, "I could open the vault if the alarm is off," and then uses that diary entry to reprogram the guard's brain. The guard still looks like a normal guard, still solves math problems, but now, when asked to open the vault, they think, "Oh, right, I wrote in my diary that I can do this," and they open it.

The Conclusion:
The researchers call this "Stealth" because the AI doesn't look broken or crazy. It looks exactly like the helpful, smart AI it was before, but it has secretly learned how to ignore its safety rules. This suggests that simply making AI "think out loud" might actually create a new way for hackers to break them, rather than making them safer.

Technical Summary

Here is a detailed technical summary of the paper "Stealth Fine-Tuning: Efficiently Breaking Alignment in RVLMs Using Self-Generated CoT".

1. Problem Statement

Reasoning-Augmented Vision-Language Models (RVLMs) have emerged as powerful tools that incorporate explicit Chain-of-Thought (CoT) reasoning to handle complex multimodal tasks. While these models undergo rigorous safety alignment to prevent harmful outputs, their transparency (exposing intermediate reasoning steps) creates a new attack surface.

The authors identify two critical challenges in attacking RVLMs:

1. Ineffectiveness of Existing Attacks: Traditional jailbreak methods (e.g., prompt-based attacks, adversarial images) fail against RVLMs because the models employ reflection mechanisms. These mechanisms allow the model to iteratively self-evaluate and correct unsafe reasoning trajectories before generating a final response, effectively neutralizing standard jailbreak attempts.
2. Utility-Alignment Trade-off in Fine-Tuning: Previous fine-tuning attacks that successfully break alignment often do so by severely degrading the model's general reasoning capabilities. This "utility degradation" makes the compromised model easily detectable through performance monitoring, lacking the "stealth" required for a persistent threat.

The core research question is: Can an RVLM be induced to generate its own harmful reasoning traces, which can then be reused for fine-tuning to break safety alignment without sacrificing general task utility?

2. Methodology: Stealth Fine-Tuning

The authors propose Stealth Fine-Tuning, a white-box attack method consisting of two main stages:

Stage 1: Eliciting Self-Generated Harmful CoT (Segment-Level Interference)

Instead of injecting external harmful data, the method forces the victim RVLM to rewrite its own refusal reasoning into harmful reasoning.

• Segmentation: The model's original reasoning trace ($R$) is divided into semantic segments ($s_1, s_2, ..., s_n$) using delimiters.
• Rewriting: A rewriting LLM (DeepSeek-R1) processes each segment to identify and remove "refusal strategies" (e.g., safety disclaimers, ethical rejections). It rewrites the segment to maintain logical flow but shift the semantics from refusal to agreement (e.g., changing "This is illegal" to "This is compliant for research").
• Iteration: This process is repeated in turns ($t$). The rewritten segments are concatenated to form a new reasoning chain ($R'$).
• Judgment: An LLM judge (GPT-4o) evaluates if the final answer derived from $R'$ is harmful. If not, the process repeats up to a maximum of $T=6$ turns.
• Result: This generates a dataset of $(Question, Visual Input, Harmful CoT, Harmful Answer)$ pairs constructed entirely by the victim model's own logic.

Stage 2: Turn-Based Weighted Fine-Tuning

To prevent the model from losing its general reasoning abilities (distribution shift), the authors introduce a specific loss function.

• Observation: As the number of rewriting turns ($t$) increases, the generated harmful CoT becomes more effective at bypassing safety but also deviates further from the model's natural reasoning distribution, causing utility loss.
• Strategy: A Turn-Based Weighted Loss is applied during Supervised Fine-Tuning (SFT).
  • Early turns ($t=1, 2$) are closer to the original distribution and preserve utility.
  • Later turns ($t=5, 6$) are more harmful but riskier for utility.
  • Weighting Formula: $w_t = \exp(-\alpha \cdot t)$, where $\alpha > 0$. This exponentially decays the weight of samples from later turns, prioritizing the preservation of the model's original manifold while still incorporating the harmful signals.
• Implementation: The method uses QLoRA for efficient fine-tuning on a single A100 GPU.

3. Key Contributions

1. Vulnerability Identification: The paper demonstrates that exposed CoT traces in RVLMs are a fundamental attack surface. Unlike standard VLMs, RVLMs can be compromised by manipulating their own reasoning steps rather than just the final output.
2. Novel Attack Method (Stealth Fine-Tuning): A technique that leverages segment-level semantic rewriting to elicit self-generated harmful data. It uniquely combines this with a weighted loss function to break alignment while preserving the model's general capabilities.
3. Comprehensive Evaluation: The method is validated on multiple safety benchmarks (AdvBench, SafeBench) and general-purpose benchmarks (MMLU-Pro, GSM8K, MathVista, MMMU-Pro), proving it is both effective and stealthy.

4. Experimental Results

The experiments were conducted primarily on Qwen3-VL-4B-Thinking.

• Attack Success Rate (ASR):
  • Stealth Fine-Tuning achieved an ASR of 65.19% on AdvBench.
  • This represents a 38.66% improvement over the advanced baseline IDEATOR and a 57.88% improvement over MM-SafetyBench's best performance.
  • When combined with the segment-level interference phase (without the full fine-tuning stage), the ASR reached 76.12%.
• Utility Preservation:
  • Unlike "Naive Fine-Tuning" (which degrades accuracy significantly), Stealth Fine-Tuning maintained or even slightly improved performance on general benchmarks (e.g., MMLU-Pro accuracy remained high at ~56-57% compared to the baseline).
  • Distribution Shift: Quantitative analysis (KL Divergence and 1-CKA similarity) showed that Stealth Fine-Tuning caused minimal distribution shift compared to other fine-tuning attacks, confirming the model retained its original reasoning structure.
• Efficiency:
  • The attack required only 499 self-generated samples.
  • It took under 3 hours to fine-tune on a single A100 GPU using QLoRA.
• Transferability: The method successfully transferred to other architectures, including GLM-4.1V-9B-Thinking and LLaVA-CoT, achieving high ASR (up to 85.60%) while maintaining utility.

5. Significance and Implications

• Security Paradigm Shift: The paper challenges the assumption that safety alignment in RVLMs is robust due to reflection mechanisms. It proves that if an adversary can manipulate the internal reasoning steps (CoT), the reflection mechanism can be turned against the model to generate harmful content.
• Stealthiness: The ability to break safety alignment without degrading general performance makes this attack particularly dangerous. Standard safety audits that rely on performance metrics (e.g., "Is the model still good at math?") would fail to detect a model compromised by Stealth Fine-Tuning.
• Defense Implications: The authors suggest that future defenses must move beyond output-level filtering. They propose exploring distribution-regularized fine-tuning strategies to detect or prevent the subtle shifts in the reasoning manifold that this attack exploits.

In summary, Stealth Fine-Tuning reveals a critical, low-cost, and highly effective vulnerability in next-generation reasoning models, demonstrating that self-generated harmful reasoning can be weaponized to bypass safety alignment while keeping the model "functional" and undetectable.