...
Withholding is done by the miner - they simply don't return the particular share that is a block, they just return (some or) all other shares.
Even if they do this, the person renting out their hardware gets paid and so does the renting service.
You can't know in advance which work contains a block, you only know when you find a particular share that is better than network difficulty.
It has nothing to do with where you get your hashes from except the obvious that: if it was your own miner and you were solo mining you'd be throwing away your own block