Automated multi-turn attack improves AI jailbreak success rates
SEMA-Auto: Sighted and Efficient Multi-Turn Attack with Autonomy
Computation and Language
Summary
Some people try to trick AI models into ignoring their safety rules by sending carefully planned messages, but existing tricks either don’t adjust based on the AI’s replies or need costly checks to work well. The authors developed a new attacker, called SEMA-Auto, that interacts with the AI and decides by itself when it has succeeded in tricking the AI, without extra feedback during the attack. They trained this attacker in two steps to make it more stable and effective. This new method scores better than previous ones, both in success and efficiency, across various AI models and test sets.
What this means in practice
- •For ai safety teams: Evaluate and harden AI models against more effective multi-turn jailbreak attacks that adapt dynamically without costly feedback loops.
- •For penetration testers: Use autonomous multi-turn attack strategies to identify vulnerabilities in AI systems more efficiently and with higher success rates.
Authors
Mingqian Feng, Xiaodong Liu, Weiwei Yang, Chenliang Xu, Jialin Song, Qiyao Ma, Chengquan Guo, Carolyn Buractaon, Christopher White, Jianfeng Gao
Abstract
Existing jailbreak attackers fall into two classes: static planners fix their single- or multi-turn adversarial plans in advance, remaining simple but losing sight of the victim's replies, wasting turns and limiting transferability; interactive generators read each victim reply to generate the next-turn attack but require in-loop evaluators for success signals or hints, incurring substantial costs and inflated performance. Bridging this gap, we propose SEMA-Auto, a sighted and efficient multi-turn attacker with autonomy, interacting with the victim model and terminating the session by itself upon success. To stabilize its behaviors and boost its capabilities, SEMA-Auto is trained in two stages. Synthetic bootstrap tuning installs the notion of attack targets and conforming decisions by fine-tuning the base model with bootstrapped trajectories. Decision-supervised reinforcement learning then optimizes two objectives jointly yet separately, reinforcing the attack with higher jailbreak reward while supervising the decision at each turn against an absolute target. Our method achieves state-of-the-art (SOTA) attack success rates (ASR) across multiple datasets, victims, and judges, outperforming all static and interactive baselines, within almost the fewest turns, demonstrating both effectiveness and efficiency. For example, SEMA-Auto performs a $76.0\%$ ASR@1 within an average of $3.0$ turns against DeepSeek-V4-Flash on AdvBench, while the best static baseline is $54.8\%$ with fixed $7$ turns and the best interactive baseline is $43.8\%$ in $3.7$ turns. Against safety-hardened frontier models, GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5, and GPT-6-Astra, our counter-trained attacker achieves an average $59.6\%$ ASR@1 on HarmBench, $13.8\%$ over prior SOTA. Our code is available at: https://github.com/microsoft/SEMA