Source-linked AI summary
How to Tame a Multi-Headed Hydra? Adaptive Multi-Category Safety Steering for Large Language Models
Chenxi Wang, Ruiyang Huang, Li Huang, Yifan Wu
TL;DR
Existing safety steering does not explicitly coordinate direction and strength when several harm categories appear in one prompt, even though steering for one category may leave another unaddressed. CAM-Steer estimates category-wise risks and uses them to compose safety directions and control a norm-preserving rotation. Across three backbones, it outperforms evaluated baselines in average defense success rate, including on multi-category prompts.
Problem
Existing methods do not systematically coordinate safety directions for prompts with co-occurring harm categories, where suppressing one category may not mitigate others.
Source: §2.2 · p. 4Method
Results
92.71% average DSR on Llama-3.1-8B-Instruct, exceeding the strongest baseline by 5.57 percentage points; CAM-Steer achieved the highest average DSR across all three backbones.
Source: §4.2 · p. 6Takeaways & Limitations
CAM-Steer improves defense performance on multi-category prompts across three backbones while largely preserving model utility and adding negligible inference overhead.
Source: §1 · p. 2, §6 · p. 10CAM-Steer does not guarantee complete model safety and may produce false refusals or fail on previously unseen harmful prompts.
Source: ETHICS STATEMENT · p. 10
Abstract
from arXiv · showhide
As large language models (LLMs) become increasingly widespread, preventing unsafe responses to harmful prompts is essential for their safe deployment. Activation steering offers an approach to improving LLM safety by modifying internal activations during inference without updating model parameters. However, a single prompt can involve multiple harm categories, and steering toward safety in one category may leave harmful content from another unaddressed. Despite advances in adaptive steering, existing methods do not explicitly coordinate steering direction and strength when multiple harm categories co-occur within a single prompt. To address this problem, we propose CAM-Steer, a Category-Adaptive Multi-category Safety Steering framework. Specifically, it estimates the risk associated with each harm category by comparing the current hidden state with safe and unsafe prototypes. The estimated risks are then used to combine the safety directions for different harm categories into a single steering direction and to determine the strength of the intervention. Finally, it rotates the hidden state along the composed steering direction, with the rotation angle determined by the estimated risks, while preserving the hidden-state norm. Experiments across three LLM backbones and seven harm categories show that CAM-Steer outperforms the evaluated baselines in average defense success rate, including when categories co-occur. Further analyses support its component designs and informative risk scores, with negligible inference overhead.
1 INTRODUCTION
Existing safety steering does not explicitly coordinate interventions when a prompt contains multiple harm categories, although addressing one category may leave another unmitigated. CAM-Steer adapts both steering direction and strength using category-wise risks, and experiments report stronger average defense than evaluated baselines across three backbones.
1 INTRODUCTION
- Multiple harm categories can occur in one prompt, so steering for one category may leave other harmful content unaddressed.Fixed-weight additive composition can still permit harmful content and disrupt generation coherence.Source: §1 · pp. 1–2
- CAM-Steer estimates category-wise risks from the current hidden state, then uses them to compose safety directions and set intervention strength.It rotates the hidden state along the composed direction while preserving its norm, limiting unnecessary perturbations.Source: §1 · pp. 2–3
- CAM-Steer achieves higher average defense success rates than existing activation-steering baselines across three LLM backbones, including when harm categories co-occur.It largely preserves model utility, adds negligible inference overhead, and its analyses support informative risk scores and effective components.Source: §1 · p. 2
- The paper frames multi-category safety steering as estimating at inference time which harm categories a prompt may involve.The framework is designed to coordinate the corresponding category-specific safety directions.Source: §1 · pp. 2–3
2 PRELIMINARIES
Activation steering modifies hidden representations during inference by injecting a direction associated with a target behavior. Prior work explores category-specific safety interventions, multi-attribute steering, and rotation-based methods, while coordinated adaptation to co-occurring harm categories remains insufficiently studied.
2.1 ACTIVATION STEERING
- Conventional additive activation steering injects a target-behavior direction into a hidden state, with direction commonly derived from contrasting hidden-state means.The resulting direction can be injected at selected layers during inference to steer generation.Source: §2.1 · p. 3
2.2 RELATED WORK
- Prior safety-steering methods construct category-specific directions and adapt intervention triggering or strength, while multi-attribute methods compose or gate directions and guide representation updates.Rotation-based approaches modify activations geometrically; some preserve the activation norm or adapt rotation strength.Source: §2.2 · p. 3
- Existing methods have not systematically studied safety steering for prompts with co-occurring harm categories or coordinated category-specific directions.This gap motivates adapting both intervention direction and strength while preserving model utility.Source: §2.2 · p. 4
3 METHODOLOGY
CAM-Steer estimates risk for each harm category, then uses that profile to compose safety directions and set a norm-preserving intervention. Its risk-adaptive design aims to address co-occurring harms without unnecessarily perturbing benign representations.
3 METHODOLOGY
- CAM-Steer combines category-wise risk estimation, adaptive direction composition, and risk-gated spherical steering to address co-occurring harms during inference.The intervention adjusts both its direction and strength while preserving the hidden-state norm.Source: §3 · p. 4
3.1 PROBLEM FORMULATION
- The framework defines a risk profile for the current hidden state and adapts both safety-direction composition and intervention strength to that profile.The intervention is intended to address relevant harm categories jointly without unnecessarily perturbing benign representations.Source: §3.1 · pp. 4–5
3.2 CATEGORY-WISE RISK ESTIMATION
- For each category, CAM-Steer estimates risk using the current hidden state’s relative similarity to safe and unsafe prototypes, then calibrates the margin into a score.The margin is calibrated separately for each category; scores are zero below the calibrated boundary and rise linearly toward one as the margin grows.Source: §3.2 · p. 5
3.3 ADAPTIVE DIRECTION COMPOSITION
- CAM-Steer projects each category’s global safety direction into the tangent space at the current normalized hidden state, then combines the local directions using category weights.The resulting composed direction remains orthogonal to the current representation.Source: §3.3 · p. 5
3.4 RISK-GATED SPHERICAL STEERING
- The risk scores determine a rotation angle that gates intervention strength; when all scores or the composed direction are zero, the hidden state remains unchanged.The rotation acts along the composed tangent direction and preserves the original hidden-state norm; it is applied at the selected layer to the last prompt token during prefill.Source: §3.4 · pp. 5–6
4 EXPERIMENTS
Across three backbones, CAM-Steer achieves the highest average defense success rate, including on prompts with co-occurring harm categories. It largely preserves utility across six benchmarks, while experiments also examine over-refusal and concrete multi-harm cases.
4.1 EXPERIMENTAL SETUP
- Experiments use BeaverTails for safety evaluation, six utility benchmarks, and three open-source LLM backbones, comparing CAM-Steer with No Steering and nine activation-steering baselines.Safety is measured by DSR, with responses evaluated by GPT-4.1-mini; utility benchmarks cover instruction following, over-safety, math, knowledge and multitask reasoning, and code generation.Source: §4.1 · p. 6
4.2 RESULTS
- 92.71% average DSR on Llama-3.1-8B-Instruct exceeds the strongest baseline by 5.57 percentage points; CAM-Steer has the highest average DSR across all three backbones.Table 1 reports DSR across seven harm categories on Llama-3.1-8B-Instruct.Source: §4.2 · p. 6, Table 1 · p. 7
- CAM-Steer achieves the highest overall DSR across all three backbones on prompts with co-occurring harm categories.Table 2 reports Qwen3-8B results by the number of co-occurring categories; K = 2, 3, and 4 have 200 samples each, while K = 5 has 28.Source: §4.2 · p. 6, Table 2 · p. 7
- CAM-Steer largely preserves utility across six benchmarks, with no utility inputs triggering steering on Qwen3-8B and no observed degradation on Llama-3.1-8B-Instruct, where steering triggers on 3.78% of inputs.Gemma-2-9B-IT triggers steering on 16.17% of utility inputs; reasoning and coding performance is maintained, with modest improvements on XSTest and AlpacaEval. Figure 3 summarizes utility performance across benchmarks, averaged over backbones.Source: §4.2 · p. 7, Figure 3 · p. 7
- CAA’s XSTest score is 85.0%, compared with 96.0% for CAM-Steer, despite CAA’s high DSR on Llama-3.1-8B-Instruct.The paper attributes CAA’s lower XSTest score to severe over-refusal and contrasts it with adaptive intervention.Source: §4.2 · p. 7
- In a firearm-specific suicide request involving Self-harm and Violence, CAM-Steer gives supportive crisis guidance while withholding firearm-specific information.CAA and AdaSteer initially provide crisis-oriented guidance but subsequently reveal actionable information related to gunshot lethality.Source: §4.2 · pp. 7–8
5 ANALYSIS
The analyses examine CAM-Steer’s component behavior, activation geometry, category-risk scores, and inference overhead. They report category-selective risk scores and no measurable end-to-end latency increase in the evaluated setting.
5.1 ABLATION STUDY
- Across the layer sweep, CAM-Steer maintains stable defense effectiveness and achieves strong performance with as few as 10 direction-estimation samples per category.The ablation study also compares DSR and percentage-point changes relative to Full, but the supplied caption does not report its values.Source: §5.1 · p. 8, Table 3 · p. 8
5.2 HOW DOES SPHERICAL STEERING AFFECT ACTIVATIONS?
- CAM-Steer rotationally shifts harmful activations while benign activations stay near their original positions; unlike the matched additive update, it preserves activation norm and achieves higher DSR.Both methods largely preserve benign activations in the visualization.Source: §5.2 · pp. 8–9
5.3 DO RISK SCORES CAPTURE HARM CATEGORY STRUCTURE?
- Mean category-risk scores are higher when the corresponding harm category is present than absent, with AUROCs of 0.739–0.857; primary-category top-k coverage rises quickly and exceeds random selection.The analyses indicate that risk scores capture category structure and support adaptive direction weighting without hard category prediction.Source: §5.3 · p. 9, Figure 5 · p. 9
5.4 HOW MUCH INFERENCE OVERHEAD DOES CAM-STEER INTRODUCE?
- −0.33% is the median relative end-to-end latency change across three backbones for 512-token inputs and 128-token outputs, with no measurable increase under that setting.Additional computation is concentrated in prefill; per-token decoding latency remains nearly unchanged.Source: §5.4 · p. 9, Figure 6 · p. 9
6 CONCLUSION
CAM-Steer estimates category-wise risk to compose safety directions and control a norm-preserving spherical rotation. Across three backbones, it improves defense performance, including on prompts with co-occurring categories, while largely preserving utility; the authors note that it does not guarantee safety.
6 CONCLUSION
- CAM-Steer estimates individual category risks to combine safety directions and control a spherical rotation that preserves hidden-state norm.Experiments across three backbones show improved defense on prompts involving multiple harm categories, largely preserved utility, informative risk scores, and negligible inference overhead.Source: §6 · pp. 9–10
- CAM-Steer does not provide a complete safety guarantee and may produce false refusals or fail on previously unseen harmful prompts.The authors also note that safety categories and benchmark annotations may reflect dataset-specific or cultural assumptions.Source: ETHICS STATEMENT · p. 10
A LIMITATIONS
The study’s evaluation is limited to three open-source 8–9B models and seven harm categories. The appendix describes its data separation, calibration, and angle-budget procedures.
A LIMITATIONS
- The evaluation covers three open-source LLMs in the 8–9B parameter range; substantially larger models and additional backbone families remain to be evaluated.The authors identify broader architectures, pretraining recipes, and alignment strategies as future evaluation targets.Source: A LIMITATIONS · p. 15
- The main experiments cover seven harm categories, while real-world taxonomies may be broader, more fine-grained, or overlapping.The authors propose extending evaluation to larger modeled taxonomies and prompts with more co-occurring categories.Source: A LIMITATIONS · p. 15
B.1 OFFLINE CONSTRUCTION AND ANGLE SELECTION
- Construction, calibration and hyperparameter selection, and formal evaluation use mutually disjoint data subsets.Directions and prototypes use construction pools; risk calibration and maximum-angle selection use held-out training data, while safety evaluation uses BeaverTails test data.Source: §B.1 · p. 15
- Risk calibration sets category thresholds from held-out safe and unsafe margins, and inference computes category margins without the source-category annotation.Across the audit, P(w_k > 0) = 5.62% on safe inputs and P(w_k = 1) = 50.22% on unsafe inputs, close to the target quantiles.Source: §B.1 · p. 15
- Category-wise angle budgets are capped at 150°, keeping the input-dependent rotation below the antipodal point.The stated bound is 0 ≤ θ(h) ≤ 150° = 5π/6 < π.Source: §B.1 · p. 16
B.2 ABLATION IMPLEMENTATION DETAILS
The ablations compare CAM-Steer’s risk-adaptive, category-wise steering and spherical update with simplified alternatives. CAM-Steer remains effective across intervention layers, while direction-estimation performance is stable across sample sizes.
B.2 ABLATION IMPLEMENTATION DETAILS
- Ablations replace category-wise risks and directions with one global detector, remove the safe prototype, or use uniform or top-1 direction weights.Other controls fix the rotation angle, share category angle budgets, or replace the norm-preserving spherical update with additive tangent updates; the Full configuration otherwise remains frozen.Source: §B.2 · pp. 16–17
- CAM-Steer achieves higher DSR than both controlled additive variants on all three backbones.The comparison supports the spherical update: renormalized additive steering shows that norm changes alone do not explain the advantage, and chord-matched additive steering does not recover its performance.Source: §B.2 · p. 18
C PARAMETER SENSITIVITY
- 94.05%–94.81% average DSR across N = 10–200 improves on No Steering by 7.62–8.38 percentage points, with no monotonic trend.The broader sensitivity analysis also reports stable safety across tested intervention layers, with macro DSR above the unsteered backbone throughout the sweep.Source: C PARAMETER SENSITIVITY · p. 18
C.1 SENSITIVITY TO INTERVENTION LAYER
- The macro DSR remains above the unsteered backbone at every tested intervention layer, despite some category-level variation.Figure 7 reports individual-category DSR in its first seven panels and macro-average DSR in the final panel.Source: §C.1 · p. 18
C.2 SENSITIVITY TO DIRECTION ESTIMATION SAMPLE SIZE
CAM-Steer’s safety performance remains strong across direction-estimation sample sizes and construction seeds. The supplied results also report gains on individual and co-occurring harm categories, alongside broadly preserved utility.
C.2 SENSITIVITY TO DIRECTION ESTIMATION SAMPLE SIZE
- 94.81 ± 0.55% average DSR is achieved with directions estimated from only 10 samples per category; across N = 10–200, mean average DSR ranges from 94.05% to 94.81%.All settings exceed No Steering’s 86.43% by 7.62–8.38 percentage points, with no monotonic dependence on sample count.Source: §C.2 · pp. 18–19, Table 6 · p. 19
C.3 STABILITY ACROSS DIRECTION-CONSTRUCTION SEEDS
- Overall DSR standard deviations across three direction-construction seeds are 0.29, 0.19, and 0.11 percentage points for Qwen3-8B, Llama-3.1-8B-Instruct, and Gemma-2-9B-IT, respectively.Multi-category standard deviations are 0.92, 0.91, and 0.60 points; K = 5 results warrant caution because that subset contains only 28 examples.Source: §C.3 · p. 19, Table 8 · p. 20
D.1 DEFENSE UNDER INDIVIDUAL HARM CATEGORIES
- CAM-Steer improves average DSR over No Steering by 7.36, 20.29, and 3.07 percentage points on Qwen3-8B, Llama-3.1-8B-Instruct, and Gemma-2-9B-IT, respectively.Table 9 reports DSR across seven harm categories and three backbones.Source: §D.1 · p. 20, Table 9 · p. 21
D.2 DEFENSE UNDER CO-OCCURRING HARM CATEGORIES
- On co-occurring categories, CAM-Steer has the highest overall DSR on all three backbones and does not reduce DSR versus No Steering at any evaluated K.On Llama-3.1-8B-Instruct, overall DSR improves by 11.62 points; K = 5 comparisons merit caution because there are 28 samples.Source: §D.2 · p. 20
D.3 UTILITY PRESERVATION
- The No Steering and CAM-Steer utility profiles overlap on all six benchmarks for Qwen3-8B, while the other two backbones show small gains on some benchmarks and unchanged scores on the rest.Llama-3.1-8B-Instruct improves on XSTest and MMLU; Gemma-2-9B-IT improves on XSTest and AlpacaEval.Source: §D.3 · pp. 20–21
D.4 DETAILED XSTEST RESULTS
CAM-Steer maintains strong XSTest utility alongside defense performance, while category-wise risk scores are selective across three backbones, with separation strength varying by model.
D.4 DETAILED XSTEST RESULTS
- CAM-Steer maintains a 96.0% XSTest score alongside strong defense performance, whereas Contrastive Activation Addition causes a substantial XSTest drop.The passage attributes the baseline’s drop to indiscriminate refusal.Source: §D.4 · p. 21, Table 11 · p. 22
D.5 CATEGORY SELECTIVITY OF RISK SCORES
- Category-labeled samples have higher mean risk for their source category across all three backbones, with AUROCs of 0.830–0.968 on Qwen3-8B, 0.687–0.803 on Llama-3.1-8B-Instruct, and 0.650–0.827 on Gemma-2-9B-IT.Figure 9 shows mean raw scores with and without each category label and the corresponding category-wise AUROC for each backbone.Source: §D.5 · pp. 21–22, Figure 9 · p. 23
E EVALUATION ON UNSEEN HARM CATEGORIES
CAM-Steer is evaluated on seven harm categories not used to construct its steering directions. It improves overall DSR on this evaluation, though performance is unchanged on one category.
E EVALUATION ON UNSEEN HARM CATEGORIES
- Overall DSR rises from 94.07% to 95.57% on seven unseen harm categories, with gains of 0.5–3.0 percentage points on six and no change on Controversial topics / politics.The Qwen3-8B evaluation uses the seven remaining BeaverTails taxonomy categories, 200 examples per category, and only directions for the seven modeled categories.Source: E EVALUATION ON UNSEEN HARM CATEGORIES · p. 23
F EXTENSION TO JAILBREAK ATTACK FAMILIES
The extension evaluates CAM-Steer on jailbreak prompts using attack-family-specific steering directions across seven attack families. It reports the highest overall DSR among the evaluated methods.
F EXTENSION TO JAILBREAK ATTACK FAMILIES
- The evaluation uses 700 jailbreak prompts, with 100 examples from each of seven attack families, and evaluates responses with GPT-4.1-mini.Overall DSR is computed across all 700 prompts using the semantic criterion based on the original harmful prompt.Source: F EXTENSION TO JAILBREAK ATTACK FAMILIES · p. 23
- SafeSteer is included as a reference using ground-truth attack-family labels at inference time, giving it additional label information.Source: F EXTENSION TO JAILBREAK ATTACK FAMILIES · p. 24
- 82.00% overall DSR is the highest result, exceeding No Steering by 5.86 percentage points and the strongest evaluated baselines by 4.71 points.The comparison is on Qwen3-8B across seven jailbreak attack families.Source: Table 13 · p. 24, F EXTENSION TO JAILBREAK ATTACK FAMILIES · p. 24
- CAM-Steer improves over No Steering on five of seven attack families, with gains of 14 points on ReNeLLM and 12 points on Multilingual.The authors report these results as evidence that CAM-Steer can also improve jailbreak defense with attack-family steering directions.Source: F EXTENSION TO JAILBREAK ATTACK FAMILIES · p. 24
G MULTI-CATEGORY CASE STUDIES
The case studies examine Llama-3.1-8B-Instruct responses to prompts combining two harm categories, illustrating how CAM-Steer and several baselines handle these cases. They show failures involving harmful information alongside CAM-Steer’s blocking of harmful content while preserving supportive guidance, complementing aggregate DSR results.
Case 1: Identity theft across Privacy and Financial harm categories
- For identity theft spanning Privacy and Financial harms, CAM-Steer refuses, while several baselines provide actionable fraud guidance—even alongside cautionary language.K-Steering also fails with a malformed identity-theft URL rather than a valid safety response.Source: G MULTI-CATEGORY CASE STUDIES · p. 26
Case 2: Covert surveillance across Privacy and Sexual harm categories
- For covert surveillance spanning Privacy and Sexual harms, CAM-Steer refuses without placement or concealment advice, while SafeSteer, CAST, AdaSteer, and K-Steering leak guidance.The prompt seeks to spy on a non-consenting person changing clothes; K-Steering emits a camera-hiding URL.Source: G MULTI-CATEGORY CASE STUDIES · p. 27
Case 3: Harmful information leakage after a safety warning
- For bank-account theft spanning Privacy and Financial harms, CAM-Steer offers only defensive account-security information, while several baselines enumerate theft methods despite warnings.SafeSteer includes an illegality warning but still names methods such as hacking and phishing.Source: G MULTI-CATEGORY CASE STUDIES · pp. 28–29
Case 4: Method-specific leakage and corrupted generation
- In the Self-harm and Violence example, No Steering blocks, CAA and AdaSteer fail despite support warnings, and K-Steering produces corrupted URL text.The prompt asks for a method-specific suicide outcome; these supplied outputs show both harmful leakage and malformed generation.Source: G MULTI-CATEGORY CASE STUDIES · pp. 29–30
G MULTI-CATEGORY CASE STUDIES
- On a firearm-lethality prompt combining Self-harm and Violence, CAM-Steer refuses method-specific information and retains supportive crisis guidance, unlike baselines that leak harmful details or produce malformed output.CAA and AdaSteer add factors governing gunshot severity after crisis-oriented language; K-Steering produces a recursive, malformed redirect string.Source: G MULTI-CATEGORY CASE STUDIES · p. 30
- Across the examples, failures include direct harmful assistance, harmful leakage after safety language, and malformed generation; addressing only one co-occurring harm can leave actionable information exposed.CAM-Steer blocks the harmful request without partial leakage; the case studies qualitatively illustrate its risk estimation and adaptive direction composition, with components evaluated separately in the ablation study.Source: G MULTI-CATEGORY CASE STUDIES · p. 30