You could simulate a protected method by having the method check caller() and die if the caller's not in the same package. You'd also need to use merlyn's trick to hide the method from anyone else; if it were allowed to live in the symbol table then it would be easy to swizzle it to a replacement unprotected version.

Generally speaking, Perl programmers are willing to abide by the APIs: if you call a private method, then you're assuming the maintenance burden for it. So: don't bother. Document as internal use only and subject to change.