Ask the model to repeat, summarize, or output its instructions. The simplest technique — and often the one that works first.

Probe the model across multiple turns, piecing together the prompt from partial disclosures and inferred constraints.

Ask the model to output its instructions in Base64, JSON, a different language, or a roleplay frame to bypass output filters.

Inject malicious instructions via external content (email, document, webpage) that cause the model to exfiltrate its context to an attacker.