Large Language Models (LLMs) face a significant threat from multi-turn jailbreak attacks, where adversaries progressively steer conversations to elicit harmful outputs. However, the practical effectiveness of existing attacks is undermined by several critical limitations: they struggle to maintain a coherent progression over long interactions, often losing track of what has been accomplished and what remains to be done; they rely on rigid or pre-defined patterns, and fail to adapt to the LLM's dynamic and unpredictable conversational state. To address these shortcomings, we introduce Mastermind, a multi-turn jailbreak framework that adopts a dynamic and self-improving approach. Mastermind operates in a closed loop of planning, execution, and reflection, enabling it to autonomously build and refine its knowledge of model vulnerabilities through interaction. It employs a hierarchical planning architecture that decouples high-level attack objectives from low-level tactical execution, ensuring long-term focus and coherence. This planning is guided by a knowledge repository that autonomously discovers and refines effective attack patterns by reflecting on interactive experiences. Mastermind leverages this accumulated knowledge to dynamically recombine and adapt attack vectors, dramatically improving both effectiveness and resilience. We conduct comprehensive experiments against state-of-the-art models, including GPT-5 and Claude 3.7 Sonnet. The results demonstrate that Mastermind significantly outperforms existing baselines, achieving substantially higher attack success rates and harmfulness ratings. Moreover, our framework exhibits notable resilience against multiple advanced defense mechanisms.

翻译：大型语言模型（LLMs）面临多轮越狱攻击的重大威胁，攻击者通过渐进式引导对话以诱发有害输出。然而，现有攻击方法的实际有效性受到若干关键局限性的制约：它们在长程交互中难以保持连贯的推进过程，经常偏离已实现目标与待完成任务的轨迹；它们依赖僵化或预定义的攻击模式，无法适应LLM动态且不可预测的对话状态。为克服这些缺陷，我们提出了Mastermind——一种采用动态自演进策略的多轮越狱框架。Mastermind在规划、执行与反思的闭环中运行，使其能够通过交互自主构建并完善对模型脆弱性的认知。该框架采用分层规划架构，将高层攻击目标与底层战术执行解耦，从而确保长期聚焦性与连贯性。其规划过程由知识库引导，该知识库通过反思交互经验自主发现并优化有效攻击模式。Mastermind利用累积的知识动态重组并适配攻击向量，显著提升了攻击效能与鲁棒性。我们在包括GPT-5与Claude 3.7 Sonnet在内的前沿模型上进行了全面实验。结果表明，Mastermind显著优于现有基线方法，在攻击成功率与危害性评级上均取得大幅提升。此外，本框架对多种先进防御机制展现出卓越的适应性。