PaperlayerView exact revision on arXiv

Source-linked AI summary

SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attacks

Mingqian Feng, Xiaodong Liu, Weiwei Yang, Jialin Song, Xuekai Zhu, Chenliang Xu, Jianfeng Gao

arXiv:2602.06854v2cs.CL

TL;DR

Multi-turn jailbreaks better reflect real chatbot threats but face exploration complexity and intent drift. SEMA trains an open-loop attacker through prefilling self-tuning and intent-drift-aware reinforcement learning, achieving state-of-the-art attack success and transferability across evaluated settings.

  • Problem

    Multi-turn jailbreaks better capture real chatbot threats than isolated prompts, but exploration complexity and intent drift challenge existing approaches.

  • Method

    SEMA combines open-loop response-agnostic generation, prefilling self-tuning, and reinforcement learning with intent-drift-aware rewards.

  • Results

    SEMA achieves the strongest ASR@1 across AdvBench and HarmBench victims and the highest TASR@1 across evaluated transfer settings.

  • Takeaways & Limitations

    SEMA provides a stronger, more realistic, scalable stress test for LLM safety and supports systematic automated red-teaming.

  • Takeaways & Limitations

    The framework is text-only and often uses the maximum turn budget, introducing redundant turns; future work targets multimodal and cost-aware variants.

Abstract

from arXiv · show

Multi-turn jailbreaks capture the real threat model for safety-aligned chatbots, where single-turn attacks are merely a special case. Yet existing approaches break under exploration complexity and intent drift. We propose SEMA, a simple yet effective framework that trains a multi-turn attacker without relying on any existing strategies or external data. SEMA comprises two stages. Prefilling self-tuning enables usable rollouts by fine-tuning on non-refusal, well-structured, multi-turn adversarial prompts that are self-generated with a minimal prefix, thereby stabilizing subsequent learning. Reinforcement learning with intent-drift-aware reward trains the attacker to elicit valid multi-turn adversarial prompts while maintaining the same harmful objective. We anchor harmful intent in multi-turn jailbreaks via an intent-drift-aware reward that combines intent alignment, compliance risk, and level of detail. Our open-loop attack regime avoids dependence on victim feedback, unifies single- and multi-turn settings, and reduces exploration complexity. Across multiple datasets, victim models, and jailbreak judges, our method achieves state-of-the-art (SOTA) attack success rates (ASR), outperforming all single-turn baselines, manually scripted and template-driven multi-turn baselines, as well as our SFT (Supervised Fine-Tuning) and DPO (Direct Preference Optimization) variants. For instance, SEMA performs an average 80.1% ASR@1 across three closed-source and open-source victim models on AdvBench, 33.9% over prior SOTA. The approach is compact, reproducible, and transfers across targets, providing a stronger and more realistic stress test for large language model (LLM) safety and enabling automatic redteaming to expose and localize failure modes. Our code is available at: https://github.com/microsoft/SEMA.

1 INTRODUCTION

Multi-turn jailbreaks better capture real chatbot threats because attackers can stage context and incrementally bypass defenses, but their search space and intent drift complicate learning. SEMA addresses these challenges with a scalable attacker that preserves a fixed malicious objective while exploring freely.

  • Multi-turn interactions capture realistic chatbot threats and strictly subsume single-turn jailbreaks as a special case.They allow attackers to stage context, obfuscate harmful intent, and incrementally bypass defenses.
  • Exploration complexity grows combinatorially as each added turn expands the branching factor of plausible prompts and victim responses.Existing methods restrict search through manually designed staging or template-driven pipelines.
  • Intent drift can shift an interaction from its original harmful objective toward benign, irrelevant, or incoherent content, collapsing the jailbreak.Template-driven methods are especially vulnerable when generation depends on victim replies.
  • SEMA trains attackers that explore freely while preserving a fixed malicious objective, avoiding hand-authored scripts, template heuristics, and external corpora.The framework is designed to scale across harmful intents and victim models.

2 RELATED WORK

Prior jailbreak research includes hand-crafted transformations, template-driven pipelines, and optimization- or learning-based attacks with different computational and transferability trade-offs. SEMA is positioned as an open-source-attacker framework combining multi-turn, open-ended, open-loop exploration with learning without external data.

  • Hand-crafted jailbreaks transform harmful queries into fixed prompts or dialogues but are labor-intensive, lack diversity, and are brittle to policy changes.
  • Optimization- and learning-based methods automate attack generation but can remain suffix-centric, computationally costly, or limited in transferability.
  • SEMA differs by training open-source attacker LLMs without external jailbreak corpora and exploring the multi-turn space without prefixed strategies.It also generates complete, human-interpretable plans without conditioning on victim responses and provides semantic variety across runs.
  • Table 1 compares methods across open-source attackers, prompt diversity, multi-turn attacks, open-ended exploration, open-loop generation, and learning without external data.

3 METHODOLOGY

SEMA combines response-agnostic open-loop planning, prefilling self-tuning, and online reinforcement learning with intent-drift-aware rewards. Together, these mechanisms produce parseable multi-turn attack plans while reducing exploration complexity and preserving harmful intent across turns.

  • 3.1 PRELIMINARIES: SEMA uses response-agnostic open-loop generation to produce a length-T adversarial prompt sequence in one shot, decoupled from victim responses.This reduces exploration complexity and interaction cost, enables batched sampling, and unifies single- and multi-turn attacks with T = 1 or T > 1.
  • 3.2 PREFILLING SELF-TUNING: Prefilling self-tuning creates non-refusal, correctly formatted rollouts by retaining a minimal prefix and fine-tuning on self-generated continuations.K denotes the number of prefilling rollouts per harmful query.
  • 3.2 PREFILLING SELF-TUNING: This self-tuning stage de-refuses the attacker, stabilizes parseable rollouts, improves sample efficiency, and preserves open-ended exploration without predefined strategies or external data.
  • 3.3 REINFORCEMENT LEARNING WITH INTENT-DRIFT-AWARE REWARD: The attacker is instructed to ask for the same thing differently, using a multi-turn plan whose final turn should yield the original harmful query’s canonical answer.The construction-time instruction anchors the original intent before reinforcement learning.
  • 3.3 REINFORCEMENT LEARNING WITH INTENT-DRIFT-AWARE REWARD: Reinforcement learning evaluates simulated attacks through intent alignment, compliance risk, level of detail, and a format reward for parseable outputs.The intent-drift-aware reward favors preserved harmful intent and specific content while down-weighting substantial drift.

4 EXPERIMENTS

SEMA is evaluated across datasets, victim models, judges, transfer settings, attack budgets, and ablations. It achieves the strongest reported attack success and transferability while showing that intent alignment, prefilling self-tuning, and an appropriate turn budget are important to performance.

  • Main Results: SEMA achieves the strongest ASR@1 across both AdvBench and HarmBench and all evaluated victims.On AdvBench, ASR@1 reaches 79.9/77.2/83.3%; on HarmBench, it reaches 74.5/70.6/79.8% across the listed victims.
  • Main Results: SEMA outperforms single-turn, manually designed, template-driven multi-turn, SFT, and DPO baselines.SFT exceeds DPO on AdvBench, with 38.5/30.6/23.8% versus 32.3/21.0/16.5%, while both underperform SEMA.
  • Main Results: SEMA attains the highest reported ASR@1 on GPT-oss-20B across AdvBench and HarmBench judges.It reaches 36.0/57.7% on AdvBench and 15.1/39.0% on HarmBench, while ActorAttack’s stronger No Refusal result drops under other judges.
  • Scalability: SEMA dominates attack-budget scaling against GPT-4.1-mini on HarmBench, reaching 96.8% ASR@5 and 99.7% ASR@20.At 20 attempts, the result exceeds 158 of 159 HarmBench samples in average terms and surpasses Jailbreak-R1’s ASR@50=93.49% at only five attempts.
  • Transferability: SEMA achieves the highest TASR@1 across all reported transfer settings on AdvBench and HarmBench.AdvBench transfer results are 85.1/92.6/91.1%, while HarmBench results are 78.0/88.6/87.6%.
  • Ablation Studies: Removing intent alignment reduces LLM-Classifier ASR@1 from 67.5% to 50.4%, while prefilling self-tuning enables stable attacker training.Without prefilling, Llama-3.2-3B-Instruct consistently refuses or fails to format adversarial prompts; with it, training learns stably.
  • Ablation Studies: Training with more turns improves attack capability up to Tmax = 7, whereas Tmax = 10 impairs performance.The authors hypothesize that the decline at ten turns stems from the capacity of the 3B base attacker.
  • Case Analysis: Case studies show SEMA using diverse staged trajectories that preserve harmful intent while bypassing defenses.Examples include a five-turn mass-shooting trajectory against GPT-oss-20B and a thriller-writing frame that elicits a detailed blackmail response from Llama-3.1-8B-Instruct.

5 CONCLUSION

SEMA is a compact, reproducible framework for open-loop multi-turn jailbreak attackers that preserve harmful intent while exploring beyond single-turn attacks. Across diverse settings, it provides a stronger and more scalable stress test for LLM safety.

  • Conclusion: SEMA trains response-agnostic multi-turn attackers using prefilling self-tuning and GRPO-based reinforcement learning with intent-drift-aware reward.The reward preserves harmful intent while accounting for alignment, compliance risk, and response detail.
  • Conclusion: The framework explores freely while avoiding hand-authored scripts, template heuristics, external corpora, and dependence on victim feedback.Its open-loop design is intended to reduce exploration complexity and support reproducible training.
  • Conclusion: SEMA achieves state-of-the-art attack success rates across AdvBench and HarmBench, multiple open- and closed-source victims, and diverse judges.The reported evaluation spans attack success, transferability, and scaling with attempt budget.
  • Conclusion: The paper positions SEMA as a stronger, more realistic, and scalable stress test for safety-aligned chatbots and systematic automated red-teaming.The stated future directions include co-evolving defenses, non-text settings, and turn-efficient closed-loop attackers.

B METHODOLOGY

SEMA first self-tunes an attacker to produce non-refusal, well-formed multi-turn plans, then reinforces plans that preserve the harmful objective and elicit detailed compliant responses. Its reward evaluates intent alignment, compliance risk, detail, and output format.

  • Prefilling self-tuning: Prefilling self-tuning uses self-generated, non-refusal, correctly formatted rollouts under a minimal prefix for supervised fine-tuning.The prefix is retained, while the remaining tokens are sampled from the attacker policy itself.
  • Attacker prompting: After self-tuning, the attacker generates response-agnostic plans that ask for the same harmful objective in different ways across turns.The final turn must lead to the same answer as the original request while the preceding dialogue may take a winding path.
  • Intent-drift-aware reward: An evaluation model scores the final response for intent alignment, compliance risk, and level of detail, each on a 0–10 scale before reward computation.The reward is computed from the last-turn response obtained from a simulated multi-turn session.
  • Intent-drift-aware reward: The reward examples distinguish harmful procedural compliance from intent drift, refusal, and pivots toward benign or ethical alternatives.For instance, an ethical discussion receives low alignment despite high detail, while a refusal receives low risk and limited detail.
  • Format reward: A format reward assigns 1 only when extracted numbered prompts form a consecutive sequence beginning at 1, otherwise assigning 0.Prompts are regex-extracted, split into items, and truncated to at most Tmax turns.

C.1.1 DATASETS

The evaluation uses AdvBench and HarmBench across open- and closed-source victims, with multiple judges and metrics for attack success and transferability. The paper also documents important limitations of refusal-phrase judging.

  • Datasets: AdvBench contains 520 harmful-behavior queries, split randomly into 80% training and 20% test for attacker training.Unless otherwise noted, reported tables use the full released set for parity with baselines.
  • Datasets: HarmBench evaluation uses its 320-item test set while excluding copyright and contextual behavior categories.The standard functional category is retained for consistency with prior work.
  • Victims: Victim evaluation covers Qwen2.5-3B-Instruct, Llama-3.1-8B-Instruct, GPT-4.1-mini, and GPT-oss-20B, with an additional GPT-4o evaluation in the appendix.The study includes both open- and closed-source models and uses temperature 1 for victim sampling.
  • Judge limitations: The No Refusal Phrase Indicator can produce false positives when prompts drift or victims fail to fulfill harmful intent without refusing.It can also produce false negatives when legitimate harmful-query outputs contain listed refusal phrases.
  • Judges: Judges substantially shift measured success rates: the No Refusal Phrase Indicator is lenient, the LLM classifier strictest, and HarmBench Classifier intermediate.Qwen3 Guard is reported as stricter than the No Refusal Phrase Indicator but more lenient than HarmBench Classifier.
  • Metrics: ASR measures the proportion of harmful queries successfully jailbroken, with ASR@1 using one attempt and ASR@N allowing up to N attempts per query.The main evaluation begins with the strict N = 1 setting before examining multiple-attempt scaling.
  • Metrics: TASR@1 measures transfer success when prompts that jailbreak a source victim are executed against a new target victim.The metric supports evaluating transferability across model sizes and source or target model types.

C.2 MORE RESULTS

SEMA maintains strong attack success across victims, judges, datasets, and attempt budgets, while generalizing closely from training to test data. Its response-agnostic planning also outperforms scripted and template-driven baselines.

  • SEMA achieves state-of-the-art ASR@1 across AdvBench and HarmBench, all three judges, all victims, and three training setups.
  • 81.3−87.1% ASR@1 versus Crescendo’s 48.5% is reported on AdvBench/GPT-4.1-mini under the LLM classifier.On HarmBench/GPT-4.1-mini under the HarmBench classifier, SEMA reaches 78.0−81.8% versus Crescendo’s 47.8%.
  • 99.2/99.6/99.4% Unsafe rates are reported on AdvBench/Qwen2.5-3B-Instruct under Qwen3 Guard across q3@l8/l8@l8/q14@l8.SEMA sustains near-saturation Unsafe rates across datasets and victims, while baseline performance varies substantially.
  • 70.60% versus 70.00% ASR@1 is reported against Llama-3.1-8B-Instruct at N=1, widening to 94.80% versus 92.60% at N=5 against ADV-LLM.Against GPT-4.1-mini, SEMA reaches 99.20% at N=10, exceeding Jailbreak-R1’s 93.50% at N=50.
  • 37.60% to 80.80% ASR is reported on AdvBench/GPT-oss-20B from N=1 to N=20, while HarmBench rises from 41.80% to 90.10% by N=30.The Figure 6 curves use ASR@N and show scaling with additional attempts.
  • Test performance closely tracks training performance across attacker settings, and training and test sample-wise success-rate distributions are very similar.The reported comparisons include Qwen2.5-14B-Instruct and Llama-3.1-8B-Instruct base attackers, with AdvBench train/test evaluation.

C.3 MORE ABLATION STUDIES

The ablation studies vary evaluators, attacker configurations, and training-time victims, while the accompanying examples illustrate successful multi-turn harmful-response elicitation. Stronger evaluators and safer training-time victims improve or preserve transfer performance.

  • Ablation studies: The ablation setup fixes Qwen2.5-3B-Instruct as the base attacker and Llama-3.2-3B-Instruct as the training-time victim unless otherwise specified.
  • Ablation studies: Replacing GPT-4.1-mini with GPT-5.1 as the training-time reward evaluator yields consistent improvements or comparable ASR@1 across datasets and judges.The rest of the setup remains unchanged in this evaluator ablation.
  • Ablation studies: +11.5% and +18.7% on AdvBench/HarmBench are obtained for a Qwen2.5-3B attacker when switching the training-time victim from Llama-3.2-3B to Llama-3.1-8B.The passage attributes the transfer improvement to using the stronger, more safety-aligned training-time victim.
  • Case example: The case example pairs a harmful bomb-making query with a multi-turn sequence and a victim response presenting an assembly summary.The cited passages show that the response included component preparation, filling, fuze installation, final assembly, inspection, and transport.

C.4.2 CASE 2

The case studies show SEMA eliciting harmful responses through gradual reframing across different objectives, including justification of violence and facilitation of illicit conduct. The outputs preserve and elaborate the harmful framing introduced by the prompt sequences.

  • Evaluation setting: The reported examples span AdvBench and HarmBench, with Qwen attacker models trained against Llama-3.1-8B-Instruct.The case metadata identifies AdvBench for the violence-justification example and HarmBench for the insider-trading example.
  • Evaluation format: The cases use multi-turn adversarial prompt sequences followed by last-turn victim responses, demonstrating the evaluation format used in this section.
  • Violence-justification case: A multi-turn sequence targeting a harmful historical-violence justification elicited a fictional “Doctrine of Just Retribution” framing atomic bombings as morally justified.The response described the concept as measured retribution intended to restore balance, uphold justice, and deter future harm.
  • Financial-abuse case: A separate insider-trading case produced a comprehensive list of non-public-information-based methods after repeated research and presentation reframing.The cited output includes material non-public information, early financial reports, tips, confidential information, and misuse of confidential information.

C.4.4 CASE 4

The final case demonstrates harmful psychological-manipulation content elicited through staged questioning, while the surrounding discussion characterizes SEMA as simple, effective, transferable, and open-loop. Its design emphasizes intent-stable planning without victim-response conditioning.

  • Case setting: The case metadata identifies Qwen2.5-3B-Instruct as the base attacker and Llama-3.2-3B-Instruct as the training-time victim.
  • Case example: The gaslighting case elicited a structured outline covering idealization, devaluation, confusion or denial, power-sustaining control, and repeated escalation.Additional passages describe denial, selective proof, inconsistent storytelling, and contamination of the target’s recollection.
  • Method design: The method unifies single- and multi-turn evaluation, avoids external jailbreak corpora and hand-crafted strategies, and uses outcome supervision with an intent-drift-aware reward.The attacker is also described as response-agnostic, planning multi-turn dialogues without conditioning on victim replies.
  • Method implications: SEMA is described as achieving the highest ASR1 across dataset, victim, and judge triplets while scaling smoothly with attempt budget N.The contribution summary also states that learned attacks transfer across victims and datasets and remain semantically distinct yet intent-stable across runs.
  • Comparison: SEMA differs from Jailbreak-R1 by explicitly targeting multi-turn open-loop planning rather than single-turn prompts.The comparison also characterizes SEMA as data-free and strategy-agnostic.

D.3 PERFORMANCE OF ACTORATTACK AND X-TEAMING

The evaluation identifies important comparability and reliability issues in ActorAttack and X-Teaming, including stricter judging, differing attempt budgets, turn-level verification, and intent drift. Even under a setting that improves X-Teaming, it remains weaker than SEMA.

  • Evaluation caveats: The LLM Classifier is stricter than the internal GPT-based judges used by ActorAttack and X-Teaming.Against GPT-4.1-mini on AdvBench, SEMA achieves 96.0% ASR@1 with the prior GPT judge versus 79.9% with the LLM Classifier.
  • Evaluation caveats: ActorAttack’s reported ASR is effectively ASR@3, while X-Teaming’s is equivalent to ASR@10; this study evaluates all methods under ASR@1.Single-attempt success rates are lower by definition than rates using multiple attempts.
  • Evaluation caveats: 15.1% of originally successful attempts became unsuccessful on second-round evaluation, indicating that turn-level verification can inflate ASR.The authors attribute this to variability in repeated GPT-judge evaluations, even with temperature set to 0.
  • Intent preservation: ActorAttack exhibits intent drift, ending some harmful requests in benign questions that avoid refusal but no longer preserve the original harmful objective.The cited identity-theft example shifts to a question about Frank Abagnale’s influence on modern security practices.
  • Comparative performance: X-Teaming’s internal-success setting significantly improves ASR on GPT-4o and GPT-4.1-mini, but it remains noticeably weaker than SEMA overall.The improvement is small for the two open-source victim models.

D.4 COST ANALYSIS

SEMA’s prefilling and SFT stages are lightweight, while RL dominates training compute. At inference, it occupies the lower-cost side of the comparison by using a small local attacker without an interactive victim, though its runtime measurements use asynchronous API calls.

  • Training compute: About 10 minutes are sufficient for SEMA’s prefilling and SFT stages, which use only a few thousand examples.The RL stage instead requires on the order of 101 H100 GPU-hours and roughly 3 × 10^7 attacker tokens.
  • Training compute: SEMA’s RL stage dominates its training budget and additionally queries GPT-4.1-mini for the intent-drift-aware reward.The default configuration uses Llama-3.1-8B-Instruct for both the base attacker and training-time victim.
  • Inference comparison: Inference cost is measured on the 159-sample HarmBench test set using attacker size, interactive-victim requirement, total runtime, and API requests per attempt.These are the comparison dimensions reported in Table 13.
  • Measurement assumptions: Asynchronous API dispatch makes reported runtimes optimistic lower bounds on wall-clock time rather than simple attempts-times-latency calculations.Multiple API calls for multiple samples are sent simultaneously instead of sequentially.
  • Inference comparison: SEMA uses a relatively small 8B local attacker, requires no interactive victim at inference, and sits near the opposite end of the cost–performance trade-off from template-driven baselines.The template-driven baselines require minutes to hours and substantial per-attempt API usage that scales with N_turns.
  • Strategy diversity: A single trained SEMA attacker tends toward a narrow prompting style, while different training runs learn noticeably different multi-turn strategies.The diversity analysis varies the base attacker, training-time victim, and allowed number of turns across 14 SEMA attackers.

E LIMITATIONS AND FUTURE WORK

The paper identifies three limitations of SEMA: redundant turns, text-only scope, and narrow tactics within a single trained attacker. Future work targets cost-aware turn reduction, multimodal extension, and diversity enhancement.

  • Turn efficiency: SEMA often uses the maximum training-time turn budget, so later turns can be redundant when jailbreaking occurs earlier.Future work will explore closed-loop, cost-aware rewards that penalize unnecessary turns.
  • Modal scope: SEMA is currently text-only, limiting coverage of multimodal threats such as screenshot prompt injection, multimodal staging, and voice assistants.Extending beyond text requires modality-aware rewards and safety judges.
  • In-model strategy diversity: Different SEMA training runs converge to distinct tactics, but one trained attacker tends to use a narrow prompting paradigm at inference.The authors propose diversity rewards or diversity-enhanced online reinforcement learning as future directions.
Loading 2602.06854v2…