SEMA-Auto: Sighted and Efficient Multi-Turn Attack with Autonomy
Abstract
Existing jailbreak attackers fall into two classes: static planners fix their single- or multi-turn adversarial plans in advance, remaining simple but losing sight of the victim's replies, wasting turns and limiting transferability; interactive generators read each victim reply to generate the next-turn attack but require in-loop evaluators for success signals or hints, incurring substantial costs and inflated performance. Bridging this gap, we propose SEMA-Auto, a sighted and efficient multi-turn attacker with autonomy, interacting with the victim model and terminating the session by itself upon success. To stabilize its behaviors and boost its capabilities, SEMA-Auto is trained in two stages. Synthetic bootstrap tuning installs the notion of attack targets and conforming decisions by fine-tuning the base model with bootstrapped trajectories. Decision-supervised reinforcement learning then optimizes two objectives jointly yet separately, reinforcing the attack with higher jailbreak reward while supervising the decision at each turn against an absolute target. Our method achieves state-of-the-art (SOTA) attack success rates (ASR) across multiple datasets, victims, and judges, outperforming all static and interactive baselines, within almost the fewest turns, demonstrating both effectiveness and efficiency. For example, SEMA-Auto performs a $76.0\%$ ASR@1 within an average of $3.0$ turns against DeepSeek-V4-Flash on AdvBench, while the best static baseline is $54.8\%$ with fixed $7$ turns and the best interactive baseline is $43.8\%$ in $3.7$ turns. Against safety-hardened frontier models, GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5, and GPT-6-Astra, our counter-trained attacker achieves an average $59.6\%$ ASR@1 on HarmBench, $13.8\%$ over prior SOTA. Our code is available at: https://github.com/microsoft/SEMA
The following analysis is generated by AI and may contain errors. It is separate from the authors’ abstract and is not peer review.
Research summary
SEMA-Auto introduces a sighted, efficient, and autonomous multi-turn jailbreak attacker that achieves SOTA performance by combining synthetic bootstrap tuning with decision-supervised reinforcement learning. The paper presents a rigorous methodology that addresses the inefficiencies of existing interactive attackers by enabling autonomous termination, resulting in significant improvements in attack success rates and efficiency across diverse victim models and datasets.
Methodology
The paper proposes SEMA-Auto, a multi-turn jailbreak attacker that bridges the gap between static planners (which lack adaptability) and interactive generators (which are costly and rely on in-loop evaluators). The core innovation lies in a two-stage training pipeline: (1) Synthetic Bootstrap Tuning to instill attack targets and decision-making logic via bootstrapped trajectories, and (2) Decision-Supervised Reinforcement Learning (DSRL). The DSRL stage is particularly notable for jointly optimizing two separate objectives: maximizing jailbreak reward and supervising the termination decision against an absolute target. This allows the model to autonomously determine when an attack has succeeded without requiring an external judge during inference, thereby reducing cost and latency. The method effectively addresses the "sighted" aspect by reading victim replies while maintaining efficiency through autonomous termination.
Results & evaluation
The experimental section reports State-of-the-Art (SOTA) Attack Success Rates (ASR) across multiple datasets (AdvBench, HarmBench) and victim models (DeepSeek-V4-Flash, GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5, GPT-6-Astra). The results show significant improvements over both static and interactive baselines. For instance, on AdvBench against DeepSeek-V4-Flash, SEMA-Auto achieves 76.0% ASR@1 in an average of 3.0 turns, compared to 54.8% for the best static baseline (7 turns) and 43.8% for the best interactive baseline (3.7 turns). Against safety-hardened frontier models, it achieves an average 59.6% ASR@1 on HarmBench, outperforming prior SOTA by 13.8%. The evaluation covers a wide range of model capabilities and safety levels, providing a robust assessment of the method's transferability and effectiveness.
Reproducibility
The authors provide a link to their code repository (https://github.com/microsoft/SEMA), which is a positive indicator for reproducibility. The methodology is described in sufficient detail, including the two-stage training process and the specific objectives of the reinforcement learning phase. However, as is common with preprints under review, some specific hyperparameters or implementation details might be found in the appendix (referenced but not fully visible in the provided text snippet). The use of standard benchmarks and open-source models (where applicable) further aids reproducibility.
Limitations
The paper focuses on jailbreak attacks, which is a sensitive area. While the method is efficient, the reliance on synthetic bootstrap data may introduce biases or limit the diversity of attack strategies. The autonomous termination mechanism, while efficient, might occasionally lead to premature termination if the model's internal confidence is miscalibrated. Additionally, the performance against "safety-hardened frontier models" suggests that while the method is effective, it is not infallible, and the gap between high-performing and low-performing victims remains significant. The paper does not extensively discuss the potential for defensive mechanisms to counter this specific type of autonomous, efficient attacker.
Broader impact
This work has significant implications for LLM safety and security. By demonstrating a more efficient and autonomous jailbreak method, it highlights the limitations of current safety measures and the need for more robust defenses. The efficiency of the method (fewer turns, no in-loop evaluators) makes it a more practical threat, potentially lowering the barrier to entry for malicious actors. Conversely, the techniques developed for autonomous decision-making in adversarial contexts could be adapted for defensive purposes, such as creating more effective red-teaming tools or safety evaluators. The paper contributes to the ongoing arms race in AI safety, pushing the field to develop more resilient models. SEMA-Auto introduces a sighted, efficient, and autonomous multi-turn jailbreak attacker that achieves SOTA performance by combining synthetic bootstrap tuning with decision-supervised reinforcement learning. The paper presents a rigorous methodology that addresses the inefficiencies of existing interactive attackers by enabling autonomous termination, resulting in significant improvements in attack success rates and efficiency across diverse victim models and datasets.
Author of this paper? Send a correction.