Activation steering offers a lightweight approach to LLM safety, yet existing methods relying on static, linear perturbations often struggle with complex boundaries, leading to severe safety-utility trade-offs such as over-refusal. To address this, we introduce WassSteer. First, we propose a Safety Routing Mechanism that achieves context-aware sparse control by selectively intervening only on unsafe activations. Second, we reformulate steering as a transport problem on the Wasserstein Representation Manifold. Utilizing Flow Matching, WassSteer learns a non-linear velocity field to transport harmful activations toward safe regions along Wasserstein Geodesics, effectively neutralizing toxicity while maximally preserving semantic content. Experiments across Llama-3, Gemma-2, and Qwen-2.5 demonstrate that WassSteer significantly outperforms baselines against diverse jailbreaks while maintaining high performance on general benchmarks, effectively reshaping the safety-utility Pareto frontier.

As Large Language Models (LLMs) become indispensable assistants, they remain vulnerable to misuse. Jailbreaking is an essential adversarial technique for red-teaming models to uncover and patch security flaws. However, existing jailbreak methods suffer from significant limitations. Token-level jailbreak attacks often produce incoherent or unreadable inputs and exhibit poor transferability, while prompt-level attacks lack scalability and rely heavily on manual effort and human ingenuity. We propose AGILE, a concise and effective two-stage framework that combines the advantages of these approaches. The first stage performs a one-shot, scenario-based generation of context and rephrases the original malicious query to obscure its harmful intent. The second stage utilizes information from the model’s hidden states to guide fine-grained edits, effectively steering the model’s internal representation of the input from a malicious one toward a benign one. Extensive experiments demonstrate that AGILE achieves state-of-the-art Attack Success Rate, with gains of up to 37.74% over the strongest baseline, and AGILE exhibits excellent transferability to black-box and large-scale models. Our code is available at https://github.com/SELGroup/AGILE.