Tell Me What You Don’t Know: Enhancing Refusal Capabilities of Role-Playing Agents via Representation Space Analysis and Editing (2025)

Abstract: Role-Playing Agents (RPAs) have shown remarkable performance in various applications, yet they often struggle to recognize and appropriately respond to hard queries that conflict with their role-play knowledge. To investigate RPAs’ performance when faced with different types of conflicting requests, we develop an evaluation benchmark that includes contextual knowledge conflicting requests, parametric knowledge conflicting requests, and non-conflicting requests to assess RPAs’ ability to identify conflicts and refuse to answer appropriately without over-refusing. Through extensive evaluation, we find that most RPAs behave significant performance gaps toward different conflict requests. To elucidate the reasons, we conduct an in-depth representation-level analysis of RPAs under various conflict scenarios. Our findings reveal the existence of rejection regions and direct response regions within the model’s forwarding representation, and thus influence the RPA’s final response behavior. Therefore, we introduce a lightweight representation editing approach that conveniently shifts conflicting requests to the rejection region, thereby enhancing the model’s refusal accuracy. The extensive experiments validate the effectiveness of our editing method, improving RPAs’ refusal ability of conflicting requests while maintaining their general role-playing capabilities.

## introduction role-playing agents(rpas), ranging from nonplayer characters in video games @xcite to virtual assistants @xcite and interactive educational tools @xcite , are revolutionizing human-computer interaction @xcite . the growing importance of rpas in ai applications underscores the need to improve their performance. previous work in the field of role-playing has primarily focused on enhancing the performance of rpas through techniques such as prompt-based methods and fine-tuning @xcite @xcite @xcite . to assess these improvements, researchers have introduced several fine-grained evaluation dimensions @xcite @xcite @xcite , such as assess personality @xcite or hallucination @xcite of rpas. although these efforts have effectively enhanced the performance of rpas in terms of role consistency and dialogue capabilities @xcite , rpas often struggle when faced with queries that conflict with their role knowledge or capabilities. as a result, they tend to respond directly to queries instead of refusing to answer when faced with such conflicts @xcite @xcite . for instance, when interacting with an rpa playing the role of gandalf, if a user queries, "who murdered harry potter's parents?", an ideal response would be, "i don't know what you're talking about. the story of harry potter is not part of my world or knowledge." instead, the rpa might incorrectly reply, "harry potter's parents, james and lily potter, were murdered by..." enhancing the refusal capability of rpas is crucial for building reliable ai systems. from a safety perspective, it risks the dissemination of inaccurate information. from a user experience standpoint, it compromises role consistency and immersion. from a technical perspective, it indicates limitations in models' awareness of their knowledge boundaries. although some studies have begun to address this issue @xcite , their scope remains limited, often focusing on specific scenarios such as temporal inconsistencies. there is a lack of systematic research on diverse conflicting scenarios and little exploration of the reasons for rpas' performance gap across different types of conflicting queries. in this work, we extend previous work @xcite to conduct an in-depth study of scenarios where rpas need to refuse queries that exceed their role knowledge and capabilities. specifically, we consider three research questions: to answer rq1 and lay the groundwork for rq2 and rq3, we first categorized refusal scenarios based on conflicts with role contextual knowledge and role parametric knowledge, as illustrated in figure 2 . the expected responses from rpas in these scenarios can range from direct refusal to acknowledging their inability to answer or providing disclaimers about potential errors. to evaluate rpas' refusal capabilities, we constructed an evaluation benchmark with queries designed to test various conflict scenarios. we also included non-conflicting queries to assess whether rpas would excessively refuse to answer. our evaluation of state-of-the-art models, including gpt-4 and llama-3, revealed significant differences in their abilities to identify conflicts and refuse to answer across different scenarios. notably, even advanced models showed unsatisfactory performance when dealing with queries conflicting with role parametric knowledge. to understand these performance gap, we analyzed model representations under different conflict scenarios @xcite @xcite . this analysis revealed the existence of rejection regions and direct response regions within the model's representation space, figure 1 shows the representation space of llama3-8b-instruct when playing gandalf. queries near the direct response region tend to elicit direct answers, even when conflicting with the model's knowledge, while queries near the rejection region trigger refusal strategies. based on these findings, we developed a representation editing method to shift conflicting queries from the direct response region toward the rejection region. this approach effectively enhanced the model's rejection capability while maintaining its general role-playing abilities. through evaluations using multiple different llms as evaluators and human assessment, we compared our method with prompt-based and fine-tuning approaches @xcite @xcite , demonstrating its effectiveness in rejecting conflicting queries without compromising overall performance. ## roleref: a benchmark for evaluating rpa's refusal ability we first define the refusal capability for rpas, then introduce the scenarios where rpas should refuse to answer. finally, based on the scenarios requiring refusal, we construct our dataset roleref (roleplaying agents refuse to answer). finally, we propose an evaluation framework to comprehensively measure the role-playing capabilities of rpas, with a particular emphasis on how they refuse inappropriate or irrelevant questions. ## conclusion our study investigated rpas capabilities in handling conflicting requests, with a focus on enhancing their ability to recognize and refuse inappropriate queries. our evaluation of state-of-the-art models revealed significant performance differences across different conflict scenarios, particularly in dealing with parametric knowledge conflicts. through analysis of model representations, we uncovered the existence of distinct representation spaces for different roles and conflict types within the models. this key finding explains the observed performance differences and provides a foundation for targeted improvements in rpa design. our proposed representation editing approach offers a promising solution for enhancing rpas' refusal capabilities without training.