SEMA-Auto: an efficient multi-turn jailbreak attack with observable responses and autonomous termination

The paper proposes a multi-turn jailbreak attack method, SEMA-Auto, and reports that it achieves the highest attack success rate across multiple datasets, victim models and judges. The method is trained in two stages: first, fine-tuning a base model on bootstrapped trajectories to establish concepts of attack objectives and decisions; then using decision-supervised reinforcement learning to separately optimize the jailbreak reward and the per-turn decision of whether to continue, terminating the session on its own once successful. On AdvBench against DeepSeek-V4-Flash, it reports 76.0% ASR@1 with an average of 3.0 turns, whereas the best static baseline is 54.8% with a fixed 7 turns and the best interactive baseline is 43.8% with 3.7 turns. Against GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5 and GPT-6-Astra, it reports an average of 59.6% ASR@1 on HarmBench, 13.8% higher than the previous SOTA. Code at github.com/microsoft/SEMA.