SEMA: Simple yet Effective Learning for Multi-Turn Jailbreak Attacks

2026-02-06

AI Summary

Existing multi-turn jailbreaking attacks suffer from high exploration complexity and intent drift, making it difficult to generate coherent and goal-consistent adversarial dialogues. This work proposes SEMA, a novel framework that achieves the first open-loop multi-turn jailbreak attack without requiring feedback from the victim model. SEMA employs self-generated multi-turn adversarial prompts for supervised fine-tuning prefilling and integrates a reinforcement learning reward mechanism based on intent alignment, compliance risk, and level of detail, unifying single-turn and multi-turn attack formulations. Evaluated on benchmarks such as AdvBench, SEMA attains an average ASR@1 of 80.1%, surpassing current single-turn and multi-turn baselines—as well as SFT and DPO variants—by over 33.9%. The approach significantly reduces exploration complexity while preserving harmful intent consistency, demonstrating strong generalization and reproducibility.

Technology Category

• Multiagent Systems: Adversarial Agents
• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Multi-turn jailbreaks capture the real threat model for safety-aligned chatbots, where single-turn attacks are merely a special case. Yet existing approaches break under exploration complexity and intent drift. We propose SEMA, a simple yet effective framework that trains a multi-turn attacker without relying on any existing strategies or external data. SEMA comprises two stages. Prefilling self-tuning enables usable rollouts by fine-tuning on non-refusal, well-structured, multi-turn adversarial prompts that are self-generated with a minimal prefix, thereby stabilizing subsequent learning. Reinforcement learning with intent-drift-aware reward trains the attacker to elicit valid multi-turn adversarial prompts while maintaining the same harmful objective. We anchor harmful intent in multi-turn jailbreaks via an intent-drift-aware reward that combines intent alignment, compliance risk, and level of detail. Our open-loop attack regime avoids dependence on victim feedback, unifies single- and multi-turn settings, and reduces exploration complexity. Across multiple datasets, victim models, and jailbreak judges, our method achieves state-of-the-art (SOTA) attack success rates (ASR), outperforming all single-turn baselines, manually scripted and template-driven multi-turn baselines, as well as our SFT (Supervised Fine-Tuning) and DPO (Direct Preference Optimization) variants. For instance, SEMA performs an average $80.1\%$ ASR@1 across three closed-source and open-source victim models on AdvBench, 33.9% over SOTA. The approach is compact, reproducible, and transfers across targets, providing a stronger and more realistic stress test for large language model (LLM) safety and enabling automatic redteaming to expose and localize failure modes. Our code is available at: https://github.com/fmmarkmq/SEMA.

Problem

• multi-turn jailbreak
• intent drift
• adversarial prompts
• LLM safety
• attack success rate

Innovation

• multi-turn jailbreak
• intent-drift-aware reward
• self-generated adversarial prompts
• open-loop attack
• reinforcement learning