With the remarkable success of Vision-Language Models (VLMs) on multimodal tasks, concerns regarding their deployment efficiency have become increasingly prominent. In particular, the number of tokens consumed during the generation process has emerged as a key evaluation metric. Prior studies have shown that specific inputs can induce VLMs to generate lengthy outputs with low information density, which significantly increases energy consumption, latency, and token costs. However, since output length is non-differentiable, existing methods mainly prolong the generated content by disrupting the distribution of the next-step token following the prompt, thereby steering the output away from the original normal response. This strategy neglects the subsequent autoregressive generation process, which makes the attack effect unstable and difficult to control. To address these limitations, this paper proposes a novel gray-box verbose-text induction attack (VTIA) to inject imperceptible adversarial perturbations into benign images via a two-stage framework. Specifically, we first perform adversarial prompt search, employing reinforcement learning strategies to automatically identify adversarial prompts capable of inducing the LLM component within VLMs to produce verbose outputs. We then conduct vision-aligned perturbation optimization to craft adversarial examples on input images, maximizing the similarity between the perturbed image’s visual embeddings and those of the adversarial prompt, thereby constructing malicious images that trigger verbose text generation. Comprehensive experiments on five popular VLMs demonstrate that our method achieves significant advantages in terms of effectiveness, efficiency, and generalization capability.