Chat Phreaking
The practice of using unusual or adversarial message patterns to get a language model to do something its guardrails are meant to prevent. The name borrows from *phone phreaking*, the hobby of exploiting the telephone network to do things the phone company didn't intend, like free long-distance calls. Where "jailbreaking" names the outcome, chat phreaking names the craft and the subculture around it: the tinkering, the swapping of patterns, the curiosity about how the system works.
Notes
Phone phreaking worked because the network of the era carried its control signals in the same audio channel as the voices. Play the right tone down the line, the famous example being 2600 Hz, and the network treated it as a command. LLMs have a similar structure: instructions and content arrive through one channel, text, and the model has to work out which is which. Chat phreakers find the odd phrasing, role-play framing, encoding trick, or multi-turn setup that tips the model into treating something as permission.
I think this is a window-in-time term. Phone phreaking is a historical curiosity now because the phone network eventually moved signaling out of the voice channel, so there was nothing left to whistle at. Newer models are getting classifiers and tighter restrictions layered around them, and my prediction is that chat phreaking fades the same way.
One caveat I want to sit with. The phone fix was architectural: separate the control channel from the content channel. Classifiers on LLMs still filter inside the same channel, which is a different kind of defense and arguably a longer arms race. So "obsolete" may arrive more slowly than it did for the phone network, or in a different shape. [JOEL: keep this caveat, or cut it if you want a cleaner prediction.]
Related: prompt injection (the same channel-mixing problem, aimed at a model reading someone else's content), jailbreaking (the general term), and red teaming (the authorized version).
Coined here, as far as I know. I haven't done an exhaustive search for prior use.