It's pretty hard to formally prove that such an attack is impossible given the infinite number of inputs you can give to an LLM, but from my limited testing this method is pretty robust and personally I didn't find a way to break it.