SEMA-Auto: a multi-turn jailbreak that decides when to stop
SEMA-Auto makes multi-turn jailbreaking a trained policy that reads the victim's replies and stops once it has won.
· arXiv · Research by Mingqian Feng, Xiaodong Liu, Weiwei Yang, Chenliang Xu, Jialin Song, Qiyao Ma
SEMA-Auto is a trained multi-turn attacker that reads each reply and decides on its own when to stop. The authors report 76.0% attack success at one attempt on DeepSeek-V4-Flash, in an average of three turns.
01What happened
Mingqian Feng and nine co-authors posted SEMA-Auto to arXiv on October 26, 2026. The paper reports attack success rates against DeepSeek-V4-Flash, GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5 and GPT-6-Astra, and points at the SEMA framework code, which sits under Microsoft's GitHub organization under an MIT license.
02How it works
Two training stages build the attacker: a synthetic bootstrap tuning pass, then decision-supervised reinforcement learning that teaches it when to press on and when to stop. The paper sorts earlier work into static planners, which fix the attack plan in advance and ignore what the victim says, and interactive generators, which read the replies but lean on an in-loop evaluator for the success signal. SEMA-Auto reads the replies and supplies its own stopping decision, which takes the evaluator out of the loop.
03Who is affected
Anyone treating a frontier model's own refusal behaviour as a control is the audience. On HarmBench the authors report an average 59.6% attack success at one attempt across GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5 and GPT-6-Astra, which they state is 13.8% above the prior state of the art. The harm shown is policy-violating text, not access to a system.
04What to do
Score guardrails across a whole conversation rather than turn by turn, because the gain the authors claim comes from spending turns well and stopping early: three turns on average, where the best static baseline they measured used a fixed seven.
Measured results
Attack success at one attempt, AdvBench, DeepSeek-V4-Flash
Higher is worse for defenders
| Result | Score |
|---|---|
| SEMA-Autothis story | 76% |
| Best static planner | 54.8% |
| Best interactive generator | 43.8% |
Scale 0 to 100% · Source: arxiv.org, as published
Sources 2 links, all fetched
- 1arxiv.orgarXiv Paper
- 2github.comSEMA Code