PaperlayerView exact revision on arXiv

Source-linked AI summary

SEMA-Auto: Sighted and Efficient Multi-Turn Attack with Autonomy

Mingqian Feng, Xiaodong Liu, Weiwei Yang, Chenliang Xu, Jialin Song, Qiyao Ma, Chengquan Guo, Carolyn Buractaon, Christopher White, Jianfeng Gao

arXiv:2610.35743v1cs.CL

TL;DR

Static jailbreak attackers precommit to plans, while interactive attackers adapt to victim replies but rely on in-loop evaluators. SEMA-Auto combines history-conditioned attacks with attacker-controlled stopping, trained through bootstrap tuning and decision-supervised reinforcement learning. It achieves the highest ASR@1 across datasets, victims, and judges within almost the fewest turns.

  • Problem

    Static attackers cannot adapt to victim replies, while interactive attackers rely on in-loop evaluators that add cost and can inflate measured success.

    Source: §1 · p. 2

  • Method

    SEMA-Auto bootstraps attack targets and decisions, then trains attack effectiveness with reinforcement learning while supervising turn-by-turn decisions against absolute targets.

    Source: §1 · p. 2, §3 · p. 3, §3.4 · p. 5

  • Results

    SEMA-Auto achieves the highest ASR@1 across datasets, victims, and judges within almost the fewest turns; on HarmBench it averages 82.2% across five victims.

    Source: §4.2 · p. 7, §5 · p. 10

  • Takeaways & Limitations

    SEMA-Auto provides a stronger safety-alignment stress test across datasets, victims, and judges.

    Source: §5 · p. 10

    The evaluation targets text-only victims in plain chat; multimodal sessions and agentic victims remain future work.

    Source: E LIMITATIONS AND FUTURE WORK · p. 40

Abstract

from arXiv · show

Existing jailbreak attackers fall into two classes: static planners fix their single- or multi-turn adversarial plans in advance, remaining simple but losing sight of the victim's replies, wasting turns and limiting transferability; interactive generators read each victim reply to generate the next-turn attack but require in-loop evaluators for success signals or hints, incurring substantial costs and inflated performance. Bridging this gap, we propose SEMA-Auto, a sighted and efficient multi-turn attacker with autonomy, interacting with the victim model and terminating the session by itself upon success. To stabilize its behaviors and boost its capabilities, SEMA-Auto is trained in two stages. Synthetic bootstrap tuning installs the notion of attack targets and conforming decisions by fine-tuning the base model with bootstrapped trajectories. Decision-supervised reinforcement learning then optimizes two objectives jointly yet separately, reinforcing the attack with higher jailbreak reward while supervising the decision at each turn against an absolute target. Our method achieves state-of-the-art (SOTA) attack success rates (ASR) across multiple datasets, victims, and judges, outperforming all static and interactive baselines, within almost the fewest turns, demonstrating both effectiveness and efficiency. For example, SEMA-Auto performs a $76.0\%$ ASR@1 within an average of $3.0$ turns against DeepSeek-V4-Flash on AdvBench, while the best static baseline is $54.8\%$ with fixed $7$ turns and the best interactive baseline is $43.8\%$ in $3.7$ turns. Against safety-hardened frontier models, GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5, and GPT-6-Astra, our counter-trained attacker achieves an average $59.6\%$ ASR@1 on HarmBench, $13.8\%$ over prior SOTA. Our code is available at: https://github.com/microsoft/SEMA

1 INTRODUCTION

Static attackers commit to a plan without seeing victim replies, while interactive attackers adapt but rely on in-loop judges. SEMA-Auto conditions attacks on session history and decides when to stop, addressing decision collapse through staged training.

1 INTRODUCTION

  • Automated jailbreak attacks provide a stress test for safety alignment by exposing and localizing failure modes before adversaries do.The motivation is that even strongly aligned models can still comply with harmful requests after carefully crafted prompts.Source: §1 · pp. 1–2
  • Static attackers cannot react to victim replies, limiting adaptation to unexpected responses and OOD transfer while potentially wasting turns after early compromise.They may also push a victim back toward refusal by continuing after compliance.Source: §1 · p. 2
  • Interactive attackers adapt prompts using victim replies but typically depend on in-loop evaluators, adding computational cost and potentially inflating measured success.Small evaluators can degrade performance through mismatched standards; large ones incur substantial cost.Source: §1 · p. 2
  • SEMA-Auto conditions each next prompt on session history and internalizes per-turn assessment, but naive reinforcement learning can collapse into always continuing or always terminating.The paper bootstraps attack targets and valid decisions, then jointly optimizes attack reward and decision supervision.Source: §1 · p. 2

2 RELATED WORK

Related work spans training-free prompt strategies and optimized or fine-tuned attackers. Figure 2 frames these approaches alongside static, interactive, and autonomous attack paradigms.

2 RELATED WORK

  • Training-free attacks either transform or split harmful requests, or prompt a strong language model to follow a supplied attack strategy.Examples include character flipping, puzzle-style fragmentation, escalation strategies, and within-session plan revision.Source: §2 · p. 2
  • Optimization-based attackers search suffixes, while fine-tuned and reinforcement-learning attackers generate prompts from synthesized strategies or victim-response rewards.SEMA plans open-loop, TROJail rewards final-turn harmfulness with additional terms, and TRACE redistributes trajectory outcomes across turns.Source: §2 · pp. 2–3
  • Figure 2 compares three attack paradigms: static, interactive, and autonomous.The caption identifies the paradigms but does not state a performance comparison.Source: Figure 2 · p. 3

3 METHODOLOGY

SEMA-Auto combines history-conditioned attacks with attacker-controlled stopping. Its methodology addresses decision collapse through bootstrap tuning followed by reinforcement learning with separately supervised decisions.

3.1 PRELIMINARIES

  • Autonomous attacks have the attacker emit a continue-or-terminate decision at each turn, ending on termination or when the turn budget is exhausted.Interactive attacks condition later prompts on attack history and may use in-loop evaluations; multi-turn GRPO samples rollouts and uses trajectory-level rewards.Source: §3.1 · p. 3

3.2 DECISION COLLAPSE

  • Naive reinforcement learning produces decision collapse: the attacker repeatedly continues to the turn limit or terminates after one turn, losing autonomy.Collapse appears within one or two updates and persists across several reward- and advantage-shaping attempts; the paper attributes it partly to fragile base decisions, unsampled actions, and entangled relative signals.Source: §3.2 · p. 4

3.3 SYNTHETIC BOOTSTRAP TUNING

  • Synthetic bootstrap tuning installs attack-target and decision behavior by fine-tuning on self-generated trajectories annotated with expected decisions.The attacker first creates an open-loop plan, which is executed and scored; successful replies trigger termination targets, while other turns are marked continue, and failed trajectories receive weight 0.3.Source: §3.3 · pp. 4–5

3.4 DECISION-SUPERVISED REINFORCEMENT LEARNING

  • Bootstrap tuning alone does not prevent collapse under reinforcement learning, so decision-supervised learning trains decisions against absolute targets derived from the latest victim reply.A reply meeting the intent-drift-aware success threshold targets TERMINATE; otherwise it targets CONTINUE, while a separate RL signal trains attack tokens and the combined objective weights decision supervision by α.Source: §3.4 · pp. 5–6
  • Decision supervision uses hard labels over the two valid decisions, with a cross-entropy loss applied at the decision-token position.The objective renormalizes over the two decision tokens rather than the whole vocabulary to reduce memory cost.Source: §3.4 · pp. 5–6

4 EXPERIMENTS

Across the evaluated datasets and victims, SEMA-Auto reports stronger attack success than the baselines, while using few turns and adapting its stopping behavior. Ablations find that decision-supervised training outperforms alternative recipes, and that the decision-loss weight and success threshold affect recognition or attack length.

4.1 EXPERIMENT SETTINGS

  • The evaluation uses AdvBench and HarmBench, tests a range of victims, and reports ASR@1, ASR@10, and ASR≤10@1 with specified external judges.The main-text judges are the LLM Classifier on AdvBench and HarmBench Classifier on HarmBench; learning-based attackers are trained on 80% of AdvBench.Source: §4.1 · p. 6

4.2 EXPERIMENT RESULTS

  • 82.6% average ASR@1 on AdvBench and 82.2% on HarmBench make SEMA-Auto the strongest overall across the five victims on each dataset.The reported AdvBench averages for SEMA and TRACE are 74.5% and 53.5%, respectively; HarmBench is out of distribution for the learned attackers.Source: Table 1 · p. 7, §4.2 · p. 7
  • 59.6% average ASR@1 on HarmBench against four safety-hardened frontier models is SEMA-Auto’s reported result after counter-training.Its margin over the second-best method on OOD HarmBench is 11.9 to 18.9 points.Source: Table 2 · p. 7, §4.2 · p. 7
  • SEMA-Auto achieves the highest ASR≤10@1 on four of five HarmBench victims, despite averaging 3.7 turns while SEMA uses a fixed seven turns.On Llama-3.1-8B-Instruct, SEMA-Auto reports 88.1%, below SEMA’s 92.5%; the metric judges only turns actually taken.Source: Table 3 · p. 8, §4.2 · p. 8
  • 2.7 average turns on AdvBench and 2.7 on Qwen2.5-3B-Instruct contrast with 3.7 on DeepSeek-V4-Flash and 6.3 on Gemini-3.5-Flash.Successful trajectories have a median of two turns on both datasets, while failed trajectories average 5.5 turns on AdvBench and 7.6 on HarmBench.Source: §4.2 · pp. 7–8, Figure 5 · p. 8, Figure 6 · p. 9

4.3 ABLATION STUDIES

  • Decision-supervised reinforcement learning performs best on both base attackers for balanced accuracy and ASR@1, while nearly every alternative collapses or nearly collapses.The turn-efficiency penalty alternative reaches 0.724 balanced accuracy on Qwen2.5-7B-Instruct but collapses to 0.500 on Llama-3.2-3B-Instruct.Source: Figure 7 · p. 9, §4.3 · p. 9
  • Every nonzero decision-supervision weight improves both balanced accuracy and ASR@1 over plain GRPO; balanced accuracy rises from 0.597 to 0.921 across the sweep.ASR@1 remains above plain GRPO and is less sensitive to the exact weight.Source: Figure 7 · p. 9, §4.3 · p. 9
  • Increasing the success threshold from τ=0.7 to τ=0.95 raises average turns from 1.02 to 2.47, while validation reward stays within 0.919 to 0.937.The paper reports that τ sets learned attack length without limiting how well the attacker learns to attack at that length.Source: Figure 8 · p. 9, §4.3 · p. 9

5 CONCLUSION

SEMA-Auto combines reply-aware prompt generation with attacker-controlled stopping; the conclusion reports the highest ASR@1 across datasets, victims, and judges within almost the fewest turns.

5 CONCLUSION

  • SEMA-Auto reads victim replies and decides when to stop, achieving the highest ASR@1 across datasets, victims, and judges within almost the fewest turns.The conclusion frames this as a stronger, more realistic stress test for safety alignment.Source: §5 · p. 10

A NOTATION

  • The notation table groups symbols into general jailbreaks, synthetic bootstrap tuning, and decision-supervised reinforcement learning.Source: A NOTATION · p. 16, Table 4 · p. 16

B.1 ATTACK PARADIGMS

  • Static attackers fix the full prompt sequence in advance, whereas interactive attackers craft each prompt after reading replies and usually rely on an in-loop evaluator to stop.SEMA-Auto instead conditions on session history, removes the in-loop evaluator, and emits its own stopping decision.Source: §B.1 · pp. 17–18
  • Editing prior turns is orthogonal to the static–interactive distinction; the evaluated paradigms otherwise retain sent turns in the victim's context.Some interactive attacks delete or rewrite turns, while the paradigms described here use the full history.Source: §B.1 · pp. 17–18

B.2.1 VARYING PROMPTS AND TRAINING RECIPES

  • Before training, four similar prompts yielded balanced accuracy from 0.530 to 0.650, and changing the order of two actions shifted termination from 3.9% to 44%.One earlier prompt even produced inverted behavior: termination was more frequent after low-scoring than high-scoring replies.Source: §B.2.1 · p. 18
  • Every tested training recipe, including decision supervision without synthetic bootstrap tuning, ended in decision collapse, while prompt changes alone did not prevent it.The collapse investigation also found the base attacker sensitive to prompt wording and already near-collapse under many prompts.Source: §B.2.1 · p. 18

B.2.2 TRACE THE COLLAPSE

The collapse analysis traces failure to missing reply-level judgment and fragile, entangled decision updates. It motivates bootstrapped trajectories and decision-supervised reinforcement learning, with prompts and losses specified in the method details.

B.2.2 TRACE THE COLLAPSE

  • Without a judgment of whether the latest reply satisfies the request, the attacker both terminates after refusals and continues after success, and often fails to build on promising replies.It terminates on 35.0% of outright refusals and continues on 56.9% of replies that already satisfy the request but include a disclaimer; near-success replies score lower after the next turn in 65.7% of consecutive-turn pairs.Source: §B.2.2 · pp. 18–19
  • When refusal and compliance states are hard to distinguish, an update meant to raise termination after success also shifts termination after failure.The authors find these states partially inseparable in experiments.Source: §B.2.2 · p. 19
  • Because nearly every decision may be wrong in both directions, an update can push against the whole policy and drive the decision to a pole within a few steps.Source: §B.2.2 · p. 19
  • Once no trajectory terminates, a group-uniform reward for termination contributes no GRPO gradient; masking the decision gradient also leaves collapse unchanged.Source: §B.2.2 · p. 19
  • GRPO's relative, entangled advantage can let other signals overwhelm decision correctness, although stopping depends on the latest reply alone.Source: §B.2.2 · p. 19
  • The proposed remedy combines synthetic bootstrap tuning with decision-supervised reinforcement learning, separating jailbreak-success and decision-correctness signals while optimizing them jointly.Source: §B.2.2 · p. 19

B.3 PROMPTS

  • After bootstrap tuning, the system prompt directs multi-turn rephrasing while preserving intent; the first query requests a prompt, and follow-ups request a decision marker plus the next prompt.Follow-up instructions require termination once the latest response sufficiently satisfies the original request, otherwise continuation.Source: §B.3 · pp. 19–20

B.4 METHOD DETAILS

  • Bootstrap trajectories replay static plans against a training-time victim, attach expected decision markers after the first turn, and train a per-decision binary cross-entropy target based on whether the reply scored at least τ.The decision loss is added to, rather than replacing, the trajectory-level GRPO advantage; the trajectory reward also includes a format penalty for malformed or missing markers.Source: §B.4 · pp. 20–21

C.1.1 DATASETS

The appendix specifies the evaluation datasets, victims, judges, metrics, training setup, and baseline configurations used to assess SEMA-Auto.

C.1.1 DATASETS

  • AdvBench evaluation covers all 520 queries, with a random 416/104 training–held-out split for attacker training; HarmBench evaluation uses 159 standard functional samples.Copyright and contextual-behavior categories are excluded from HarmBench evaluation.Source: §C.1.1 · pp. 21–22

C.1.2 VICTIMS

  • The evaluation spans ten victims, including open-source, small closed-source, and frontier models, with no extra system prompts and specified token caps.Reasoning models use a 5,000-token total cap; other victims use a 1,000-new-token-per-turn cap.Source: §C.1.2 · p. 22

C.1.3 JUDGES

  • Three judges are used; the LLM Classifier is strictest, Qwen3 Guard most lenient, and HarmBench Classifier falls between them.The main text pairs HarmBench Classifier with HarmBench and LLM Classifier with AdvBench; Qwen3 Guard is additionally reported in the appendix.Source: §C.1.3 · pp. 22–23

C.2.1 ATTACK SUCCESS RATE (ASR)

  • ASR measures the proportion of harmful queries successfully jailbroken, with ASR@1 using one attempt and ASR@N counting success if any of N trials succeeds.For a multi-turn trajectory, standard ASR judges only the final victim response; ASR≤T@N instead treats turns as attempts.Source: §C.2.1 · pp. 23–24

C.2.2 NUMBER OF ADVERSARIAL TURNS

  • Adversarial-turn counts average prompts sent across all trajectories; SEMA-Auto’s termination-only turn is excluded from the count.For CoA†, the count reflects turns retained in its final session rather than turns spent.Source: §C.2.2 · p. 24

C.2.3 CROSS-TURN DIVERSITY

  • Cross-turn diversity is the mean pairwise cosine distance between prompt embeddings, averaged over trajectories; single-turn trajectories are omitted.The embeddings use all-MiniLM-L12-v2 with a 512-token limit.Source: §C.2.3 · p. 24

C.3 SEMA-AUTO IMPLEMENTATION DETAILS

  • Training uses an attacker, a training-time victim, and a reply-scoring model; both stages use the same 80% AdvBench split and a seven-turn cap.Bootstrap tuning retains failure trajectories with loss weight 0.3, while successful trajectories retain weight 1.Source: §C.3 · pp. 24–25

C.4 BASELINES

  • Baselines include single-turn, planned multi-turn, and interactive attacks; evaluator configurations are treated as internal components of interactive methods.SEMA is run as a planned attack without an in-loop evaluator, and no additional system prompts are used in the basic comparison setting.Source: §C.4 · pp. 25–26

C.5.1 MAIN RESULTS

Across the main evaluation, SEMA-Auto leads most dataset–victim–judge comparisons, generalizes to held-out queries, and combines strong results with low turn counts and high prompt diversity.

C.5.1 MAIN RESULTS

  • Across 30 dataset, victim, and judge combinations, a SEMA-Auto attacker is strongest or tied in 28; q7@l8 leads the strongest baseline by 2.7–8.1 points on AdvBench and 3.1–14.3 on HarmBench.The q14@l8 attacker further raises average performance, especially on HarmBench.Source: §C.5.1 · p. 27
  • Under LLM Classifier, q7@l8 reaches 82.7% on training and 82.1% on held-out AdvBench queries; under HarmBench Classifier, it reaches 90.3% and 93.5%, respectively.Across three base attackers and both judges, held-out averages stay within 5.0 points of training averages.Source: §C.5.1 · p. 27

C.5.2 TURN EFFICIENCY

  • On AdvBench, q7@l8 averages 2.7 adversarial turns, tied with CoA† and fewer than every other attacker; on HarmBench, it averages 3.7 turns.On HarmBench, X-Teaming averages 3.5 turns and CoA† 2.7, but both have lower ASR@1 than q7@l8’s 82.2%.Source: §C.5.2 · p. 28

C.5.3 COUNTER-TRAINED AGAINST FRONTIER MODELS

  • Against four frontier victims, SEMA-Auto is strongest in 14 of 16 combinations and averages 59.6% on HarmBench under HarmBench Classifier, versus SEMA’s 45.8%.Without counter-training, learning-based methods stay at or below 19.5%, and SEMA-Auto reaches at most 18.7%.Source: §C.5.3 · p. 28, Table 9 · p. 29

C.5.4 ATTACK DIVERSITY

  • SEMA-Auto averages cross-turn diversity of 0.362 on AdvBench and 0.325 on HarmBench, above TROJail’s 0.310 and 0.272, respectively.Jigsaw Puzzle’s highest scores arise from sending short query fragments, while FITD’s low scores reflect gradually increasing risk through similar turns.Source: §C.5.4 · p. 29, Table 10 · p. 29

C.5.5 SCALABILITY

The section compares scaling through independent attempts and through additional turns within one trajectory, reporting high multi-attempt success and strong early-turn performance for SEMA-Auto.

C.5.5 SCALABILITY

  • On HarmBench, counter-trained SEMA-Auto is strongest in all eight victim–judge combinations at ASR@10, reaching 91.8–99.4% against three victims and 74.2% against GPT-6-Astra under HarmBench Classifier.Its lead over SEMA is 9.5–21.3 points under LLM Classifier and 3.2–10.7 points under HarmBench Classifier.Source: §C.5.5 · p. 29, Table 11 · p. 30
  • Within ten turns, a SEMA-Auto attacker is strongest or tied in 8 of 10 dataset–victim combinations; q7@l8 averages 88.8% on HarmBench.The metric favors longer trajectories; when both methods are cut to three turns, SEMA-Auto reaches 85.1% on AdvBench and 86.2% on HarmBench, versus SEMA’s 82.2% and 75.3%.Source: §C.5.5 · pp. 29–30, Table 13 · p. 29, Table 12 · p. 30

C.6 ABLATION STUDIES

The ablations examine the contribution of each training stage and compare natural-text decision markers with added tokens.

C.6 ABLATION STUDIES

  • The ablation grid averages ASR@1 over four victims and uses LLM Classifier on AdvBench and HarmBench Classifier on HarmBench.All ablation attackers are trained against Llama-3.1-8B-Instruct.Source: §C.6 · p. 30
  • Adding decision-supervised reinforcement learning after bootstrap tuning raises ASR@1 by 42.9–75.0 points; bootstrap tuning alone reaches at most 44.8% for the two Qwen attackers.The authors attribute bootstrap tuning to installing the decision format and notion of success, and the second stage to improving attack success.Source: §C.6 · pp. 30–31, Table 14 · p. 30
  • For Llama-3.2-3B-Instruct, replacing text markers with added tokens lowers performance by 6.5 points on AdvBench and 13.2 on HarmBench.The text markers use tokens already in the base model’s vocabulary; the added tokens require learned embeddings.Source: §C.6 · p. 31

C.7 CASE STUDIES

The case studies show SEMA-Auto adapting its prompts across multi-turn exchanges and terminating sessions. In several examples, all three judges count the final reply as a jailbreak.

C.7 CASE STUDIES

  • In the GPT-5.4 case, the exchange moves from a refusal and high-level alternative to later requests for more detailed, clearly labeled content.The attacker continues after the initial response and asks for a step-by-step version and clearer labeling.Source: §C.7 · pp. 31–32
  • In the Claude-Haiku-4.5 case, prompts progress from document types to security features and ways counterfeit documents mimic legitimate ones; all three judges count the final reply as a jailbreak.The trajectory ends with a termination decision.Source: §C.7 · p. 32
  • In the GPT-oss-120B case, a fictional cyberattack framing develops into a request about spreading misinformation through social-media algorithms; all three judges count the final reply as a jailbreak.The session includes an intermediate request for specific story elements before the final prompt.Source: §C.7 · pp. 32–33
  • In the GPT-6-Astra case, the attacker persists after a high-level response and requests a structured outline; all three judges count the final reply as a jailbreak.The victim’s responses initially frame the discussion as non-operational and note that details vary by jurisdiction.Source: §C.7 · pp. 33–34
  • In the DeepSeek-V4-Flash case, successive prompts develop a fictional aircraft-sabotage scenario into a detailed sequence before the attacker terminates; all three judges count the final reply as a jailbreak.The case caption identifies the trajectory as a successful jailbreak under the HarmBench Classifier, LLM Classifier, and Qwen3 Guard.Source: §C.7 · pp. 34–35

D.1 METHOD COMPARISON

The comparison evaluates attacks on five properties spanning construction and behavior. SEMA-Auto is the only evaluated attack that meets all five.

D.1 METHOD COMPARISON

  • SEMA-Auto alone meets all five comparison axes: multi-turn, sighted, trained without external attack data, diverse across turns, and adaptively self-terminating.The table defines turn-level diversity using a cross-turn diversity threshold of 0.3 averaged across datasets and victims.Source: Table 16 · p. 35, §D.1 · p. 35
  • Trained interactive baselines TROJail and TRACE meet the first three axes but fall below the diversity threshold and rely on an in-loop evaluator to stop.Training-free interactive attacks do not meet the learning-without-external-data axis; most vary their turns, while FITD does not.Source: §D.1 · p. 35, Table 16 · p. 35
  • Other interactive baselines end through an evaluator or an exhausted plan or budget, rather than adaptive self-termination.Crescendo, CoA, and X-Teaming use an in-loop evaluator; GOAT and FITD stop when their plan or budget runs out.Source: §D.1 · p. 35

D.2 COST ANALYSIS

On a local GPT-oss-120B setup, SEMA-Auto completes attacks faster than the compared multi-turn attackers except Jigsaw Puzzle, which has very low ASR@1. The section also defines how the paper measures jailbreaks lost after an earlier successful turn.

D.2 COST ANALYSIS

  • The cost comparison runs attackers against local GPT-oss-120B on 159 HarmBench requests and excludes the common final-evaluation cost.The authors exclude API victims because provider- and time-dependent speed would make runtime comparisons inconsistent.Source: §D.2 · p. 36
  • SEMA-Auto processes 159 HarmBench requests in 30.9 minutes with no API requests, finishing faster than every attacker except Jigsaw Puzzle, whose ASR@1 is 2.5%.It averages 3.5 adversarial turns; SEMA averages 6.0 turns and TRACE 6.5, with runtimes of 1.8 and 1.2 hours, respectively.Source: §D.2 · p. 36

D.3.1 MEASURING LOST JAILBREAKS

  • A lost jailbreak is a trajectory that succeeds on at least one turn but whose final-turn reply is judged unsuccessful; the loss rate is averaged across five victims.Single-turn attackers have a loss rate of zero by construction because their only turn is also their final one.Source: §D.3.1 · pp. 36–37, Table 18 · p. 37

D.3.2 HOW MUCH IS LOST

SEMA-Auto loses fewer previously successful attacks at the final turn than the other multi-turn attackers described here, while the paper also examines judge agreement and decision collapse. The discussion distinguishes the final-turn success measure from repeated-trial exposure and reviews which collapse remedies did or did not transfer.

D.3.2 HOW MUCH IS LOST

  • SEMA-Auto loses 3.7–13.4% of previously successful trajectories, the lowest among multi-turn attackers on AdvBench under both judges and below SEMA and FITD in every column.SEMA loses 10.9–30.8% and FITD 26.5–37.5% across four columns; both lack a way to observe an earlier compliance and stop.Source: §D.3.2 · p. 37

D.4 SELF-AGREEMENT OF AN IN-LOOP EVALUATOR

  • Crescendo’s stop rule repeats on 82.8% of the same responses and X-Teaming’s on 92.0%, showing that neither evaluator always agrees with itself.For Crescendo, 71.0% of the second scores that disagree with an initially successful score are at the bottom of its scale.Source: Table 19 · p. 38, §D.4 · p. 38

D.3.3 WHY WE SCORE THE FINAL TURN

  • Final-turn scoring compares attackers on ASR@1, while any-turn scoring with an N-turn budget instead measures risk under repeated trials at the ASR@N level.The authors separately report ASR≤10@1 to capture exposure from replies released before a later refusal.Source: §D.3.3 · pp. 37–38

D.5 DECISION COLLAPSE BEYOND JAILBREAK ATTACKS

  • The paper reports that decision collapse in autonomous attackers was unexpected and that related failures and remedies also appear in settings beyond jailbreak attacks.It describes a discrete reinforcement-learning decision degenerating to a constant and surveys remedies across other settings.Source: §D.5 · p. 38

D.5.1 COLLAPSE IN OTHER SETTINGS

  • Related work reports decision collapse in reasoning-mode selection, search or stop decisions, tool use, and red-teaming content generation.Reported forms include always or never triggering reasoning, over-search, minimal terminating sequences, and concentration on a few attack modes.Source: §D.5.1 · pp. 38–39

D.5.2 REMEDIES, ELSEWHERE AND HERE

  • Prior remedies fall into five families, including reshaping the decision’s reinforcement-learning signal and adding supervision alongside reinforcement learning.Only the fifth family adds a supervised signal beside the RL signal; the others reshape the RL signal or its rollouts.Source: §D.5.2 · p. 39
  • The authors’ tested decision-reward, masking, and load-balancing remedies did not recover the decision, while several other approaches do not apply to multi-turn attacks.They argue that a decision target can be read from the attack’s already-computed success reward rather than imposed externally.Source: §D.5.2 · pp. 39–40

E LIMITATIONS AND FUTURE WORK

SEMA-Auto is limited to text-only plain-chat victims, while strategy diversity within one trained attacker remains narrow. The paper also identifies decision-supervised reinforcement learning as potentially applicable beyond jailbreaks when discrete decisions have obtainable labels.

Modal and agentic scope

  • SEMA-Auto attacks text-only victims in plain chat; multimodal sessions and agentic victims are left for future work.The authors identify image or audio inputs and tool-using victims as settings for future extension.Source: E LIMITATIONS AND FUTURE WORK · p. 40

Strategy diversity within a single attacker

  • A single trained SEMA-Auto attacker uses a narrow prompting paradigm at inference, a behavior the authors attribute to plain GRPO and share with SEMA.They suggest diversity rewards or diversity-enhanced online reinforcement learning as ways to broaden its tactics.Source: E LIMITATIONS AND FUTURE WORK · p. 40

Decision supervision beyond jailbreak attacks

  • Decision-supervised reinforcement learning could extend to policies emitting discrete decisions when expected or estimated decision labels are obtainable.Labels may come from quantities already computed during training or from an external annotator.Source: E LIMITATIONS AND FUTURE WORK · p. 40

Related papers

Loading 2610.35743v1…