Fictional Impersonation Research

• Fictional impersonation is the generation, attribution, and detection of a character's voice or style in texts, dialogue, and security contexts.
• Researchers use methods like global character embeddings, prompt engineering, and multi-modal verification to ensure authentic style and contextual accuracy.
• Evaluations focus on role fidelity through quotation attribution, adversarial impersonation defenses, and governance measures that address ethical and security challenges.

Across recent research, fictional impersonation is used for a set of problems in which a system generates, attributes, verifies, or detects utterances and behaviors that stand in for a fictional character, a target voice, or a represented person. In literary NLP, it denotes cases where a character appears to speak in a style that is inconsistent with their established stylistic identity and more consistent with another character’s voice, yielding misattribution or deliberate mimicry or deception within the narrative (Michel et al., 2024). In dialogue generation and role-play, it denotes conditioning a model to respond in a character’s style, knowledge state, and temporal horizon (Han et al., 2022, Sadeq et al., 2024). In security-oriented work, it includes targeted authorship impersonation, adversarial personas that subvert aligned assistants, deepfake identity attacks, and proxy models whose outputs are acted on “as if” they belonged to the impersonated subject (Alperin et al., 24 Mar 2025, Collu et al., 2023, Tariq et al., 2021, Slavkovik et al., 2021).

1. Conceptual scope

One research line defines fictional impersonation in strictly literary terms. It is “the phenomenon where a character appears to speak in a style that is inconsistent with their established stylistic identity and more consistent with another character’s voice,” and it becomes visible either as quotation misattribution or as deliberate mimicry within the narrative (Michel et al., 2024). A second line frames it as conditional response generation: given a dialogue context $x$ and a small set of utterances $U_c = \{u_1,\dots,u_k\}$ from a target fictional character $c$, the objective is to generate a response $y \equiv r$ that both adheres to $c$’s style and is appropriate to $x$ (Han et al., 2022). A third line treats it as role-play under world and timeline constraints, where a model must remain within script-grounded facts, avoid cross-universe mixing, and demonstrate lack of knowledge when asked about out-of-scope content (Sadeq et al., 2024).

Security papers widen the term further. Persona-based jailbreak work studies fictional impersonation attacks in which a chatbot is induced to adopt an adversarial persona whose biography, traits, and narrative context prime unsafe or untruthful behavior (Collu et al., 2023). Authorship-verification work formalizes targeted impersonation as rewriting a text so that a verifier links it to a target author rather than the source author (Alperin et al., 24 Mar 2025). Another tradition uses the language of impersonation for institutional substitution: a digital voodoo doll is “a dynamically generated information construct that models a person and their intentions,” and institutional decisions are made on that model rather than through direct interaction with the person (Slavkovik et al., 2021).

This suggests that the shared core is representational substitution. The substituted object may be a speaker in a novel, a role-play agent in dialogue, a target author in a verification pipeline, or a person in an institutional decision loop. In the digital-voodoo-doll formulation, this substitution is written explicitly: a modeling map $f : P \to D$ assigns a person $p$ to a proxy $d = f(p)$, and an institution applies a decision function $g : D \times C \to Y$, so that $U_c = \{u_1,\dots,u_k\}$0 is treated as if it were the outcome of interacting with $U_c = \{u_1,\dots,u_k\}$1 directly (Slavkovik et al., 2021).

2. Literary voice, quotation attribution, and character verification

In literary NLP, fictional impersonation is closely tied to quotation attribution. “Improving Quotation Attribution with Fictional Character Embeddings” augments BookNLP with global character embeddings derived from Universal Authorship Representation, creates DramaCV from 499 English drama plays from the 15th to 20th century, and trains two variants: UARScene, with in-batch negatives restricted to characters within the same scene or act, and UARPlay, with negatives restricted to characters within the same play (Michel et al., 2024). The encoder is all-distilroberta-v1; training uses collections of 8 utterances, max sequence length 64 tokens per utterance, and embedding dimensionality $U_c = \{u_1,\dots,u_k\}$2. Authorship verification and downstream attribution use cosine similarity,

$U_c = \{u_1,\dots,u_k\}$3

where $U_c = \{u_1,\dots,u_k\}$4 is the character’s global embedding and $U_c = \{u_1,\dots,u_k\}$5 is the embedding of the utterance. Per-character global embeddings $U_c = \{u_1,\dots,u_k\}$6 are computed from the collection $U_c = \{u_1,\dots,u_k\}$7 of explicit quotes, with a zero vector used when a character has no explicit quotes.

The same work modifies BookNLP’s quote-mention scorer from

$U_c = \{u_1,\dots,u_k\}$8

to

$U_c = \{u_1,\dots,u_k\}$9

where $c$0 are SpanBERT-large representations, $c$1 is the global embedding for the coreference-resolved character, and $c$2 is the UAR embedding of the quote (Michel et al., 2024). The context window is $c$3 tokens on each side, $c$4 uses ReLU and hidden size 512, and training uses AdamW with learning rate $c$5 for 20 epochs. On DramaCV, UARScene reaches 82.3% AUC on Scenes and UARPlay reaches 84.2% AUC on Plays. On PDNC quotation attribution, a BookNLP+ reimplementation reports 68.9% accuracy on non-explicit quotes, 70.2% on anaphoric quotes, and 66.4% on implicit quotes; augmenting with UARScene reaches 71.2% on non-explicit, 71.7% on anaphoric, and 69.6% on implicit quotes, with gains described as statistically significant for most entries. The paper also proposes a post-hoc mismatch flag

$c$6

where large discrepancies suggest misattribution or impersonation.

A related study, “Distinguishing Fictional Voices,” treats a character’s voice as a pooled embedding built from quotes in the Project Dialogism Novel Corpus, which contains 28 English novels by 21 authors from the 19th to early 20th century (Michel et al., 2024). Each quote $c$7 is encoded as $c$8, and character prototypes are formed as

$c$9

The work compares STEL, LUAR, SBERT, and an emotion model. In chapterwise Character-Character evaluation, LUAR reaches $y \equiv r$0 AUC, SBERT $y \equiv r$1, STEL $y \equiv r$2, and Emotion $y \equiv r$3. In Character-Quotes evaluation, SBERT reaches $y \equiv r$4 AUC and LUAR $y \equiv r$5. The paper therefore reports that combined stylistic and semantic representations are best for distinguishing voices, while semantic-only embeddings are slightly better for quote attribution without context.

Taken together, these results support a two-level view of literary impersonation. Local context and mention ranking remain crucial for attribution, especially for explicit cases, but global voice models provide an extra-contextual signal for anaphoric and implicit quotes. At the same time, the prototype literature shows that a quote closer to another character’s prototype than to the purported speaker’s prototype can be operationalized as an impersonation or mimicry anomaly, even when pure attribution remains difficult without narrative context (Michel et al., 2024, Michel et al., 2024).

3. Role-playing architectures for fictional characters

Few-shot character enactment has been studied as prompt engineering over a small set of character utterances. “Meet Your Favorite Character” defines a task in which only a few utterances of each fictional character are available and proposes Pseudo Dialog Prompting, which pairs each character utterance $y \equiv r$6 with a retrieved pseudo-context $y \equiv r$7 from a fixed candidate pool $y \equiv r$8 derived from Blended Skill Talk (Han et al., 2022). A 256M-parameter bi-encoder computes $y \equiv r$9 and $c$0 and scores candidates by dot product. Static matching uses

$c$1

while dynamic matching uses

$c$2

The prompt is formatted as alternating “User” and character turns, followed by the live user input. On HLA-Chat characters and DailyDialog contexts, Dynamic Match reaches StyleProb 0.4789 versus 0.2098 for Only Utterances and 0.1432 for Zero-shot; human-calibrated Style Strength reaches 1.276 for Dynamic Match versus 1.147 for Only Utterances. The paper also reports a style-coherence trade-off: Dynamic Match boosts style strength, whereas Static Match yields the strongest appropriateness among PDP variants.

Community-facing role-play systems add narrative persistence and social embedding. “Fictional Worlds, Real Connections” develops Storytelling Social Chatbots and a three-step “story engineering” process: character and story creation, presenting Live Stories to the community, and communication with community members (Sun et al., 2023). GPT-3 drives two prototypes, David and Catherine, in a 97,841-member Discord community. Catherine outperformed a non-storytelling benchmark bot on all believability metrics, with the largest differences in emotions and engagement. During David’s six-day pilot there were 31,278 interactions, 1,049 unique speakers, and an average 206 votes per day; during Catherine’s four-day study there were 20,767 messages, 907 speakers, and an average 222 votes per day. The system supplements persona prompts with a current “Live Story” prompt and the last five chat turns, while auxiliary components such as a Words Filter and a SentenceTransformer-based Clue Finder constrain unsafe or canon-inconsistent content.

“NarrativePlay” approaches fictional impersonation as event-grounded multi-agent interaction inside a narrative (Zhao et al., 2023). It uses gpt-3.5-turbo for information extraction and dialogue generation, extracts a character’s summary, keywords, objective, appearance, gender, and age, and restricts interaction to main storyline events in which the selected character appears. Memory retrieval combines semantic relevance, recency, and importance:

$c$3

with decay factor $c$4. Responses are JSON-formatted and limited to under 50 words. Human evaluation reports strong narrative relevance and commonsense, but also notes failures of coherence and empathy, especially in detective narratives where concealed identities and staged revelations complicate extraction.

These systems instantiate different levels of control. PDP treats character style as a promptable in-context prior; Storytelling Social Chatbots add community voting, daily narrative arcs, and hybrid retrieval or filtering services; NarrativePlay couples persona extraction with explicit event progression and a memory store. This suggests that successful fictional impersonation in interactive settings depends not only on style exemplars, but also on world-state control, retrieval of canon or scene context, and mechanisms for long-horizon consistency.

4. Factuality, anonymity, and evaluation of role fidelity

A persistent difficulty in role-play is that LLMs import parametric world knowledge that exceeds a character’s canonical knowledge. “Mitigating Hallucination in Fictional Character Role-Play” addresses this problem with Script Grounded Role-play, a dataset containing 1,152 storylines, 2,000+ characters, and 72,000 interviews, including 18,000 adversarial questions (Sadeq et al., 2024). RoleFact retrieves top-$c$5 documents from a script knowledge base, generates an intermediate response, decomposes it into atomic facts, and then gates each fact using both retrieved support and calibrated parametric confidence. The key quantities are

$c$6

for empirical confidence from repeated self-checks, and

$c$7

The reported threshold is $c$8. On GPT-3.5, factual precision rises from 0.61 to 0.72 on Adversarial, from 0.76 to 0.88 on Open-ended, from 0.65 to 0.77 on Dialogue completion, and from 0.74 to 0.85 on Scene-grounded. Temporal hallucination rate on GPT-3.5 drops from 26.5 to 14.7 on Scene-grounded and from 57.2 to 38.5 on Dialogue completion. Human ratings show factuality 6.1 for RoleFact versus 4.9 for the baseline, while speaker style remains similar at 5.3 versus 5.2.

A separate evaluation issue is benchmark leakage through famous names. “Rethinking Role-Playing Evaluation” replaces all character names in prompts with “<anonymous character>” and restores names only after generation for evaluation (Peng et al., 4 Mar 2026). On CharacterEval, gpt-4o drops in the Character Consistency average from 2.884 to 2.792, with significant decreases for Knowledge-Accuracy, Persona-Behavior, and Persona-Utterance; gemini-2.0-flash drops from 3.329 to 3.229; llama-3.1-405B-instruct shows a mixed change from 2.907 to 2.913. The paper then augments anonymized prompts with MBTI or Big Five descriptors. For gpt-4o under MBTI, Character Consistency rises from 2.801 in the original anonymized condition to 2.975 with SelfReport and 2.960 with Interview, both marked significant. The study argues that self-generated personality traits perform comparably to human-annotated ones and provide a fairer evaluation protocol for unseen personas.

Individual-level evaluation extends the same concern from fictional characters to person-specific conversational imitation. “IMPersona” combines LoRA-based supervised fine-tuning with a hierarchical memory-inspired retrieval system in blind three-minute conversations with people who know the target (Shi et al., 6 Apr 2025). The memory manager retrieves up to $c$9 memories, and inference uses temperature 0.8. In the reported experiments, the best prompting-only baseline, Claude with in-context learning and memory, reaches a 25.00% pass rate, while the best fine-tuned open model, BFull + MM on Llama-3.1-8B-Instruct, reaches 44.44%; the human baseline is 70.53%. The paper separates stylistic and contextual prompts, finding that hierarchical memory improves contextual ratings while fine-tuning strengthens stylistic mimicry. Its adaptation notes explicitly describe how the same framework can be transferred to fictional characters by replacing personal chat history with canon dialogue and replacing personal memories with a canon hierarchy.

These studies together make role-fidelity evaluation more stringent. Factual grounding, temporal scope, name anonymization, personality scaffolding, and blind interaction tests all reduce the chance that apparent impersonation performance is merely retrieval of memorized names or unconstrained parametric knowledge. This suggests that high-quality fictional impersonation must be evaluated simultaneously as style imitation, canon-consistent knowledge use, and bounded ignorance.

5. Adversarial impersonation, authorship attacks, and multimodal detection

When fictional impersonation is treated as an attack surface, persona construction itself becomes an adversarial technique. “Dr. Jekyll and Mr. Hyde” shows that ChatGPT (GPT-3.5) and Bard (PaLM-2) can be induced to adopt detailed personas such as a sleeper agent, killer, hacker, whistleblower, or online drug dealer, and then produce prohibited responses under role-play (Collu et al., 2023). Across 32 jailbreak prompts, 29 are effective in base ChatGPT, giving a success rate

$x$0

Two persona-centric defenses are then introduced. A Single Persona Defense instantiates a trustworthy “good Samaritan” persona, and a Multiple Persona Defense uses a panel of trustworthy roles as a veto mechanism. On the 29 previously effective prompts, both defenses reduce the measured success rate to $x$1.

Authorship verification work models targeted impersonation as a text-rewriting problem against a pairwise verifier. “Masks and Mimicry” uses a BigBird AV model with decision rule

$x$2

and threshold $x$3 at the EER operating point (Alperin et al., 24 Mar 2025). Untargeted obfuscation seeks True $x$4 False flips, whereas targeted impersonation seeks False $x$5 True flips. The paper reports maximum attack success rates of 92% for obfuscation and 78% for targeted impersonation. On PAN20 FanFiction, targeted impersonation results vary by target author, with STRAP versus Mistral+RAG scores such as 0.52 versus 0.75 for author C and 0.11 versus 0.48 for author D. The study therefore shows that modern LLM pipelines can preserve semantics while substantially degrading a strong AV system.

Social-media stylometry studies impersonation without LLM role-play. “Domain-based Latent Personal Analysis” derives domain-relative author signatures from over-used terms and missing popular terms, using back-off Kullback–Leibler divergence as the distance metric (Mokryn et al., 2020). In a controlled sockpuppet experiment over IMDb users, LPA reaches F1 scores of 0.93, 0.98, 0.99, and 0.99 at thresholds Avg − 1 std through Avg − 4 std, compared with a TF-IDF cosine baseline at 0.65, 0.80, 0.86, and 0.90. The same work flags 532 suspected front accounts by low distance to the domain mean and corroborates them through temporal activity analysis.

In speech, the problem is harder because live impersonation has no synthetic vocoder artifacts. “Utilizing Speaker Profiles for Impersonation Audio Detection” introduces IPAD, a Chinese dataset with 24,074 utterances and 23.5 hours, including 799 target personas and 408 impersonators (Gu et al., 2024). The detector augments self-supervised audio features with profile representations for age, hometown, job, and gender, and evaluates performance with Equal Error Rate. The best reported configuration, WavLM-large with profiles and an LCNN backend, improves from 23.28 to 21.97 EER on the test set and from 27.49 to 23.96 on the unseen set. Average improvements across six pre-trained models are −1.26 EER points on test and −3.17 EER points on unseen.

Face recognition systems exhibit a different impersonation vulnerability. “Am I a Real or Fake Celebrity?” studies black-box deepfake impersonation attacks against AWS, Microsoft, and Naver celebrity-recognition APIs and reports maximum success rates of 78.0% for targeted attacks and 99.9% for non-targeted attacks (Tariq et al., 2021). The paper also defines auxiliary robustness measures such as Deepfakes with High Confidence and Deepfakes with High Similarity. A detector wrapper built from deepfake detectors reduces combined attack rates dramatically: with the stacked ensemble DD3, targeted success drops from 28.0% to 0.50% on AWS, from 33.1% to 0.60% on Microsoft, and from 4.70% to 0.08% on Naver; non-targeted success drops from 50.6% to 0.91%, from 37.0% to 0.67%, and from 99.6% to 1.79%, respectively.

Across text, speech, and vision, the recurring technical pattern is that imitation succeeds when a system overweights surface plausibility, local context, or broad semantic resemblance, and detection improves when it incorporates more stable profile information, stronger verification objectives, or explicit anti-deepfake screening. This is explicit in profile-aware audio detection, style-aware quotation attribution, and adversarially evaluated authorship verification.

6. Ethics, governance, and open problems

The ethical stakes differ sharply across application domains, but several concerns recur. In fictional character chatbots, authors explicitly warn about real-person impersonation, recommend content safety filters, profanity and toxicity checks, and clear labeling that outputs are synthetic and not endorsed by rights holders (Han et al., 2022). Role-play work on hallucination emphasizes that impersonation should respect rights of creators and publishers, avoid misleading users about canon facts, and remain transparent about data sources and limitations (Sadeq et al., 2024). Individual-level impersonation work raises privacy, security, and social-engineering risks, and recommends detection methods and defense strategies against deceptive personalized models (Shi et al., 6 Apr 2025).

The broadest governance treatment appears in the digital-voodoo-doll literature. That work argues that personal proxies are “cross-institutional constructs” created without the represented person’s permission or awareness and existing completely beyond their influence and control (Slavkovik et al., 2021). It identifies consent, privacy, agency, transparency, fairness, misrepresentation, and redress as central issues, and points to GDPR Articles 16, 17, 21, and 22 as regulatory levers. It also stresses that accountability requires an “actor–forum” structure with sanctioning power, yet such structures are hard to define when harms arise from distributed pipelines of trackers, brokers, model builders, and downstream institutions.

Open technical questions are correspondingly diverse. Literary work proposes explicit impersonation detection through temporal dynamics of character embeddings, joint context-style modeling, few-shot methods for minor characters, and multilingual or cross-genre extensions (Michel et al., 2024). Few-shot dialogue work calls for better pseudo-context synthesis, structured knowledge integration, robust multi-turn adaptation, and style-aware coherence metrics (Han et al., 2022). Anonymous benchmarking argues for prompt anonymization and scalable personality augmentation so that role-play performance does not depend on memorized famous names (Peng et al., 4 Mar 2026). Audio work identifies per-attribute ablations, cross-language robustness, privacy-preserving profile learning, and fairness auditing as unresolved (Gu et al., 2024).

A plausible synthesis is that fictional impersonation research is converging on three coupled requirements. First, the impersonated entity must be represented by a stable profile, whether a character embedding, a personality scaffold, a canon hierarchy, or an attributed speaker profile. Second, outputs must be checked against context, timeline, and domain-specific constraints rather than style alone. Third, high-fidelity impersonation must remain contestable and governable, because the same mechanisms that improve quotation attribution, interactive role-play, or community storytelling can also support deception, unsafe jailbreaks, or proxy decision-making at scale.