@inproceedings{liu-etal-2026-fine,
title = "Fine-Grained Selective Refusal: Steering {LLM} Safety via {W}asserstein-Informed Flow Matching",
author = "Liu, Zhiyi and
Du, Haohua and
Sun, Haoqi and
Tan, Haisheng",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.322/",
pages = "7459--7476",
ISBN = "979-8-89176-459-0",
abstract = "Activation steering offers a lightweight approach to LLM safety, yet existing methods relying on static, linear perturbations often struggle with complex boundaries, leading to severe safety-utility trade-offs such as over-refusal. To address this, we introduce WassSteer. First, we propose a Safety Routing Mechanism that achieves context-aware sparse control by selectively intervening only on unsafe activations. Second, we reformulate steering as a transport problem on the Wasserstein Representation Manifold. Utilizing Flow Matching, WassSteer learns a non-linear velocity field to transport harmful activations toward safe regions along Wasserstein Geodesics, effectively neutralizing toxicity while maximally preserving semantic content. Experiments across Llama-3, Gemma-2, and Qwen-2.5 demonstrate that WassSteer significantly outperforms baselines against diverse jailbreaks while maintaining high performance on general benchmarks, effectively reshaping the safety-utility Pareto frontier."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="liu-etal-2026-fine">
<titleInfo>
<title>Fine-Grained Selective Refusal: Steering LLM Safety via Wasserstein-Informed Flow Matching</title>
</titleInfo>
<name type="personal">
<namePart type="given">Zhiyi</namePart>
<namePart type="family">Liu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Haohua</namePart>
<namePart type="family">Du</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Haoqi</namePart>
<namePart type="family">Sun</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Haisheng</namePart>
<namePart type="family">Tan</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>Activation steering offers a lightweight approach to LLM safety, yet existing methods relying on static, linear perturbations often struggle with complex boundaries, leading to severe safety-utility trade-offs such as over-refusal. To address this, we introduce WassSteer. First, we propose a Safety Routing Mechanism that achieves context-aware sparse control by selectively intervening only on unsafe activations. Second, we reformulate steering as a transport problem on the Wasserstein Representation Manifold. Utilizing Flow Matching, WassSteer learns a non-linear velocity field to transport harmful activations toward safe regions along Wasserstein Geodesics, effectively neutralizing toxicity while maximally preserving semantic content. Experiments across Llama-3, Gemma-2, and Qwen-2.5 demonstrate that WassSteer significantly outperforms baselines against diverse jailbreaks while maintaining high performance on general benchmarks, effectively reshaping the safety-utility Pareto frontier.</abstract>
<identifier type="citekey">liu-etal-2026-fine</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.322/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>7459</start>
<end>7476</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Fine-Grained Selective Refusal: Steering LLM Safety via Wasserstein-Informed Flow Matching
%A Liu, Zhiyi
%A Du, Haohua
%A Sun, Haoqi
%A Tan, Haisheng
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F liu-etal-2026-fine
%X Activation steering offers a lightweight approach to LLM safety, yet existing methods relying on static, linear perturbations often struggle with complex boundaries, leading to severe safety-utility trade-offs such as over-refusal. To address this, we introduce WassSteer. First, we propose a Safety Routing Mechanism that achieves context-aware sparse control by selectively intervening only on unsafe activations. Second, we reformulate steering as a transport problem on the Wasserstein Representation Manifold. Utilizing Flow Matching, WassSteer learns a non-linear velocity field to transport harmful activations toward safe regions along Wasserstein Geodesics, effectively neutralizing toxicity while maximally preserving semantic content. Experiments across Llama-3, Gemma-2, and Qwen-2.5 demonstrate that WassSteer significantly outperforms baselines against diverse jailbreaks while maintaining high performance on general benchmarks, effectively reshaping the safety-utility Pareto frontier.
%U https://aclanthology.org/2026.emnlp-main.322/
%P 7459-7476
Markdown (Informal)
[Fine-Grained Selective Refusal: Steering LLM Safety via Wasserstein-Informed Flow Matching](https://aclanthology.org/2026.emnlp-main.322/) (Liu et al., EMNLP 2026)
ACL