How to Tame a Multi-Headed Hydra? Adaptive Multi-Category Safety Steering for Large Language Models

2026-10-01

AI Summary

This study addresses the challenge that existing activation steering methods struggle to coordinate safety directions and intervention strengths when a single prompt to large language models (LLMs) involves multiple harm categories. To this end, we propose CAM-Steer, a framework introducing the first explicit multi-harm joint steering mechanism. Specifically, it estimates risk scores via prototype contrastive learning, dynamically computes combined safety directions and intervention intensities, and achieves adaptive steering through norm-preserving vector space rotations without updating model parameters. Experiments demonstrate that CAM-Steer significantly outperforms baselines in average defense success rate across three LLM backbones and seven harm categories. Furthermore, the framework exhibits superior performance in multi-category co-occurrence scenarios while maintaining minimal inference overhead.

Abstract

As large language models (LLMs) become increasingly widespread, preventing unsafe responses to harmful prompts is essential for their safe deployment. Activation steering offers an approach to improving LLM safety by modifying internal activations during inference without updating model parameters. However, a single prompt can involve multiple harm categories, and steering toward safety in one category may leave harmful content from another unaddressed. Despite advances in adaptive steering, existing methods do not explicitly coordinate steering direction and strength when multiple harm categories co-occur within a single prompt. To address this problem, we propose CAM-Steer, a Category-Adaptive Multi-category Safety Steering framework. Specifically, it estimates the risk associated with each harm category by comparing the current hidden state with safe and unsafe prototypes. The estimated risks are then used to combine the safety directions for different harm categories into a single steering direction and to determine the strength of the intervention. Finally, it rotates the hidden state along the composed steering direction, with the rotation angle determined by the estimated risks, while preserving the hidden-state norm. Experiments across three LLM backbones and seven harm categories show that CAM-Steer outperforms the evaluated baselines in average defense success rate, including when categories co-occur. Further analyses support its component designs and informative risk scores, with negligible inference overhead.

Problem

• Large Language Models
• Safety Steering
• Activation Steering
• Multi-Category Harm
• Adaptive Steering

Innovation

• Activation Steering
• Multi-Category Safety
• Large Language Models
• Adaptive Intervention
• Hidden State Rotation