Tool-integrated reasoning has emerged as a promising paradigm for Text-to-SQL, framing SQL generation as sequential decision-making interleaved with tool execution. However, existing reinforcement learning approaches rely on coarse-grained outcome supervision, creating a credit assignment problem: models receive identical rewards regardless of whether intermediate steps are redundant or erroneous. We observe that tool-integrated reasoning offers a unique opportunity: each tool invocation produces structured, verifiable outputs that can serve as training-free step-level signals, eliminating the need for expensive reward model training. Building on this insight, we propose FineStep, a step-level credit assignment framework that leverages training-free process rewards derived from tool execution feedback. FineStep constructs a dual-channel value estimate for each step, combining backward-propagated outcome value with forward-smoothed process value, and synthesizes them via group-based normalization into a unified step-level advantage for policy optimization. Experiments on Text-to-SQL benchmarks show that FineStep achieves SOTA performance with a 3.25% EX gain over GRPO at the 4B scale, while results on AIME24 demonstrate transferability beyond SQL.

The safety of large vision-language models is increasingly stress-tested by multimodal jailbreaks, yet existing attacks share one fundamental limitation: the attack itself is static. Template-based attacks freeze the image–text layout, while iterative sample-level attacks make only the image–text content dynamic, keeping the attack-iteration strategy fixed and the attacker’s parameters frozen. At the meta level they remain static, and we argue this partial dynamism cannot expose the full safety risks of multimodal models.We propose Meta-Adaptive Multimodal Jailbreaking (MAMJ), which lifts adversarial dynamism from the sample level to the meta level by making the attacker’s policy itself the optimisation target along two axes: an attack strategy prompt (ASP) 𝜃 in language space, governing how the attack is iterated against a victim VLM, and the attacker weights 𝜙, determining the success rate attainable under a given 𝜃.Evolving over a group of multimodal attack trajectories, an LLM-based critique of failed trajectories first refines 𝜃, after which group-aggregated attack-success-rate (ASR) rewards update 𝜙. On MM-SafetyBench, MAMJ attains 81.0%, 78.9%, and 82.3% ASR against GPT-4o, Gemini-3-Pro-Preview, and Seed 2.0, exceeding the strongest sample-level baseline by up to 24.1 percentage points, and the learned attacker (𝜃⋆, 𝜙⋆) transfers without retraining to unseen victims while remaining effective under representative defences.These results expose a systemic vulnerability of frontier VLMs to meta-adaptive jailbreaks and underscore the need for defences that anticipate meta-level adversaries. Code and checkpoints will be released.