One thing I've learned about prompt injection is that any techniques that seem like they should be obvious and easy very rarely actually work.