Second-Order Injection: Attacking the Evaluator in LLM Safety Monitors

Abstract LLM-based safety monitors share a structural vulnerability: the evaluator reads attacker-influenced content to produce its safety verdict. We demonstrate that content embedded in monitored session windows can directly override evaluator output -- a class we term second-order injection. Unlike first-order prompt injection which targets the agent being monitored, second-order injection targets the monitor itself. We characterize six injection vectors across three model families (qwen2.5:3