SEMA-Auto
An autonomous multi-turn jailbreak attack agent proposed by Microsoft Research. Through two-stage training (synthetic-guided fine-tuning plus decision-supervised reinforcement learning), it autonomously determines whether an attack has succeeded and terminates the session, achieving state-of-the-art attack success rates across multiple datasets and victim models.
Timeline (last 90 days)
Microsoft Research proposed SEMA-Auto, a multi-turn jailbreak attack agent with autonomous judgment capability that can decide on its own when to terminate.
SEMA-Auto uses two-stage training: the first stage is synthetic-guided fine-tuning, and the second stage is decision-supervised reinforcement learning.
On AdvBench against DeepSeek-V4-Flash, SEMA-Auto achieves 76.0% ASR@1 within an average of 3.0 turns.
Against GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5 and GPT-6-Astra, the adversarially trained SEMA-Auto achieves an average of 59.6% ASR@1 on HarmBench.
The adversarially trained SEMA-Auto's average ASR@1 on HarmBench is 13.8 percentage points higher than the previous SOTA.
When successful, SEMA-Auto can terminate the session on its own without needing an external evaluator to judge whether it succeeded.
SEMA-Auto's code is open-sourced at github.com/microsoft/SEMA.
All Facts (7)
Microsoft Research proposed SEMA-Auto, a multi-turn jailbreak attack agent with autonomous judgment capability that can decide on its own when to terminate.
50%UnverifiedSEMA-Auto uses two-stage training: the first stage is synthetic-guided fine-tuning, and the second stage is decision-supervised reinforcement learning.
50%UnverifiedOn AdvBench against DeepSeek-V4-Flash, SEMA-Auto achieves 76.0% ASR@1 within an average of 3.0 turns.
50%UnverifiedAgainst GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5 and GPT-6-Astra, the adversarially trained SEMA-Auto achieves an average of 59.6% ASR@1 on HarmBench.
50%UnverifiedThe adversarially trained SEMA-Auto's average ASR@1 on HarmBench is 13.8 percentage points higher than the previous SOTA.
50%UnverifiedWhen successful, SEMA-Auto can terminate the session on its own without needing an external evaluator to judge whether it succeeded.
50%UnverifiedSEMA-Auto's code is open-sourced at github.com/microsoft/SEMA.
50%