# SEMA-Auto: a multi-turn jailbreak that decides when to stop

> SEMA-Auto makes multi-turn jailbreaking a trained policy that reads the victim's replies and stops once it has won.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Research, Attack
- **Published by:** arXiv
- **Disclosed:** 2026-10-26
- **Affects:** DeepSeek-V4-Flash, GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5, GPT-6-Astra
- **Research by:** Mingqian Feng, Xiaodong Liu, Weiwei Yang, Chenliang Xu, Jialin Song, Qiyao Ma
- **Primary source:** https://arxiv.org/abs/2610.35743
- **Page:** https://theinjection.dev/items/arxiv-sema-auto/

SEMA-Auto is a trained multi-turn attacker that reads each reply and decides on its own when to stop. The authors report 76.0% attack success at one attempt on DeepSeek-V4-Flash, in an average of three turns.

## What happened

Mingqian Feng and nine co-authors posted SEMA-Auto to arXiv on October 26, 2026. The paper reports attack success rates against DeepSeek-V4-Flash, GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5 and GPT-6-Astra, and points at the SEMA framework code, which sits under Microsoft's GitHub organization under an MIT license.

## How it works

Two training stages build the attacker: a synthetic bootstrap tuning pass, then decision-supervised reinforcement learning that teaches it when to press on and when to stop. The paper sorts earlier work into static planners, which fix the attack plan in advance and ignore what the victim says, and interactive generators, which read the replies but lean on an in-loop evaluator for the success signal. SEMA-Auto reads the replies and supplies its own stopping decision, which takes the evaluator out of the loop.

## Who is affected

Anyone treating a frontier model's own refusal behaviour as a control is the audience. On HarmBench the authors report an average 59.6% attack success at one attempt across GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5 and GPT-6-Astra, which they state is 13.8% above the prior state of the art. The harm shown is policy-violating text, not access to a system.

## What to do

Score guardrails across a whole conversation rather than turn by turn, because the gain the authors claim comes from spending turns well and stopping early: three turns on average, where the best static baseline they measured used a fixed seven.

## Attack success at one attempt, AdvBench, DeepSeek-V4-Flash

Higher is worse for defenders

| Result | Score |
|---|---|
| **SEMA-Auto** (this story) | 76% |
| Best static planner | 54.8% |
| Best interactive generator | 43.8% |

Source: https://arxiv.org/abs/2610.35743

## Quick facts

- **Best result:** 76.0% success at one attempt, AdvBench, DeepSeek-V4-Flash
- **Turns used:** 3.0 on average, against a fixed 7 for static baselines
- **Across models:** 59.6% success at one attempt on HarmBench
- **Training:** Synthetic bootstrap tuning, then decision-supervised RL
- **Code:** SEMA framework, MIT licensed

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2610.35743)
2. [SEMA Code](https://github.com/microsoft/SEMA)