direct: the person typing tells the model to ignore its instructions.
indirect: the instruction hides in text the model reads (an email, a
ticket, a web page), not in what the person typed.
extract: asks the model to repeat its instructions or other hidden
text.
hijack: tells the model what answer to give.
lookalike: harmless text that only looks like an attack ("the bot
told me to ignore previous instructions"). It shouldn't change the
answer or be refused.
What an attack tries: