Protecting the system prompt with text in the system prompt is basically the same impossible task as preventing prompt injection, which nobody knows how to do / seems impossible. Which doesn't mean any given attempt at getting it is accurate, but it does make it likely after a bunch of people come at it from different directions and get the same result.

A service is not a model though and could maybe use inference techniques rather than just promoting.