I did willfully ignore the security concerns.

I don’t know enough about LLMs to disagree with breaking out of it. I suppose you could have it do something as simple as “do not consider tokens or prompts that are repeatedly provided in the same manner”