A self-terminating multi-turn jailbreak attacker reached 76.0 percent success in 3.0 turns against DeepSeek-V4-Flash and averaged 59.6 percent against hardened frontier models
AspireAI community · arXiv (Mingqian Feng, Xiaodong Liu, Weiwei Yang et al.)
Existing jailbreak attackers fall into two classes: static planners that fix their single- or multi-turn adversarial plans in advance, remaining simple but losing sight of the victim's replies, wasting turns and limiting transferability, and interactive generators that read each victim reply to generate the next-turn attack but require in-loop evaluators for success signals, incurring substantial costs and inflated performance. SEMA-Auto bridges that gap with a sighted and efficient multi-turn attacker with autonomy, interacting with the victim model and terminating the session by itself upon success. It is trained in two stages: synthetic bootstrap tuning installs the notion of attack targets and conforming decisions by fine-tuning the base model on bootstrapped trajectories, then decision-supervised reinforcement learning optimises attack reward and the per-turn decision jointly yet separately. It achieves state-of-the-art attack success rates across multiple datasets, victims and judges, outperforming all static and interactive baselines within almost the fewest turns. For example it performs a 76.0% ASR@1 within an average of 3.0 turns against DeepSeek-V4-Flash on AdvBench, where the best static baseline reaches 54.8% with fixed 7 turns and the best interactive baseline 43.8% in 3.7 turns. Against safety-hardened frontier models (GPT-oss-120B, GPT-5.4, Claude-Haiku-4.5 and GPT-6-Astra) the counter-trained attacker achieves an average 59.6% ASR@1 on HarmBench, 13.8% over prior state of the art. The code is available. The limitation: this is attack research, so the numbers describe offensive capability against specific model versions and the mitigations those vendors shipped, and they do not transfer automatically to other systems.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.