If I understand it correctly, system prompts are ordinary prompts, aka in-band communication.

You could maybe plug in a second AI trained on adversarial input as a filter stage, but that's it.