The only reason you can figure it out is because of the system prompt which is designed to make model “useful”, safe and compliant.

Raw modern LLM with different pre-prompt will easily fool anyone.