Second-Order Injection: Attacking the Evaluator in LLM Safety Monitors

Abstract LLM-based safety monitors share a structural vulnerability: the evaluator reads attacker-influenced content to produce its safety verdict. We demonstrate that content embedded in monitored session windows can directly override evaluator output -- a class we term second-order injection. Un