Prompt injection: what’s the worst that can happen?
My gut sensation is that with the current models, what come next has inherently more weight than what came before (sort of: wait, I've changed my mind!).A cheap  possible solution would be to append a postfix in addition to the prefix, and mark it as important in some way.