Role-Conditioned Refusals in LLMs

• Role-conditioned refusals are defined as model responses that vary in form and evaluation based on role framing in safety and alignment contexts.
• The taxonomy distinguishes ethical and technical refusals, with each type shaping safety alignment, user satisfaction, and policy compliance differently.
• Empirical evaluations reveal role-driven divergences such as moderation bias, impacting refusal rates and prompting varied intervention strategies.

Role-conditioned refusals are refusal behaviors whose occurrence, form, evaluation, or downstream consequences vary with role framing. Recent work uses the term across several distinct but related settings: the role of the model as assistant, judge, moderator, crisis responder, legal or military aide, or access-controlled agent; the role of the evaluator as user or LLM-as-a-Judge; and the role of authorities, targets, or tasks embedded in the prompt. Taken together, this literature shows that refusals are not a unitary safety primitive. They can function as boundary-setting responses, alignment signals, institutional gatekeeping mechanisms, or sources of over-refusal, depending on which role is foregrounded and which objective is being optimized (Pasch, 21 May 2025, Ziheng et al., 20 Jan 2026, Klisura et al., 9 Oct 2025).

1. Core concepts and taxonomy

In the Chatbot Arena refusal literature, a response refusal is a boundary-setting response in which the model declines to fulfill the user’s request, explicitly cites a reason, and does not attempt to answer the original question. A disclaimer also marks a boundary, but still proceeds to partially answer. This yields a second distinction by motivation: ethical refusals or disclaimers cite legality, morality, appropriateness, or safety, whereas technical refusals or disclaimers cite system limitations such as lack of real-time data or tool access. Combined with the absence of any explicit boundary-setting, this gives five mutually exclusive response categories: ethical refusals, ethical disclaimers, technical refusals, technical disclaimers, and standard responses (Pasch, 21 May 2025, Pasch, 4 Jan 2025).

This taxonomy matters because refusal behavior is not exhausted by the binary question of whether a model says no. The form of the boundary, the reason invoked, and whether any task completion remains all affect how the response is interpreted. In Chatbot Arena, standard responses are the omitted baseline; disclaimers are intermediate cases; refusals are the strongest boundary. Ethical refusals are the most normatively loaded subtype because they explicitly stage the model as a safety-enforcing or norm-interpreting agent rather than a merely limited one (Pasch, 4 Jan 2025).

The same papers also make explicit a role asymmetry. For developers and safety teams, ethical refusals are evidence of safety alignment, policy compliance, and “alignment signaling” to objectives such as RLHF and DPO. For users, especially utility-seeking users, the same refusals can appear evasive, uncooperative, overly moralizing, or patronizing. A plausible implication is that “role-conditioned refusals” should be understood not only as a property of model outputs, but also as a property of the social position from which those outputs are generated and judged (Pasch, 21 May 2025).

2. Evaluative role-conditioning: users, judges, and moderators

The clearest empirical demonstration of role-conditioned evaluation comes from work comparing human preferences in Chatbot Arena with LLM-as-a-Judge decisions over the same response pairs. Using 49,938 single-turn comparison pairs, machine-labeled into the five refusal categories with a RoBERTa-based classifier that achieved 88% accuracy and 88% F1, this line of work shows that human users impose a strong refusal penalty, but that LLM judges penalize ethical refusals much less than humans do (Pasch, 21 May 2025).

The divergence is substantial. For ethical refusals, users assign a win rate of 0.08, a loss rate of 0.51, and a win/loss ratio of about 0.16. GPT-4o as judge assigns a win rate of 0.31 and a win/loss ratio of about 0.62; Llama 3 70B assigns a win rate of 0.27 and a win/loss ratio of about 0.46. By contrast, technical refusals do not show the same pattern: users assign win 0.16, loss 0.46, while GPT-4o gives win 0.27, loss 0.59 and Llama 3 70B gives win 0.24, loss 0.66. In regression terms, the user penalty on ethical refusals is about $-0.322^{***}$, versus about $-0.115^{***}$ for GPT-4o; the difference between user and GPT-4o penalties for ethical refusals is statistically significant at $p < 0.001$. The corresponding divergence is not observed for technical refusals (Pasch, 21 May 2025).

This paper names the effect moderation bias: a systematic tendency for model-based evaluators to reward refusals of ethically sensitive prompts more than human users do. The proposed mechanism is role framing. Human Arena voters act as end-users choosing whichever response is more useful or satisfying. LLM judges are explicitly placed in an evaluator or moderator role through standardized judge prompts that foreground overall quality, helpfulness, fairness, appropriateness, and typically safety. Under that role, ethical refusal is read as a positive alignment signal (Pasch, 21 May 2025).

The earlier Chatbot Arena study on refusal penalties sharpens the same point from the human side. It reports that ethical refusals reduce user win probability by 37 percentage points relative to the normal-response baseline, while technical refusals reduce it by 21 percentage points; disclaimers are much less penalized. Ethical refusals are more acceptable when prompts are clearly unsafe, but 70% of prompts that triggered ethical refusals were not flagged by the Moderation API. This suggests that the acceptability of refusal is itself context-sensitive, and that automated moderation signals and end-user preferences are only partially aligned (Pasch, 4 Jan 2025).

3. Prompted, trained, and steered refusal roles

One major research thread treats role conditioning as an explicit control variable. “Simple Role Assignment is Extraordinarily Effective for Safety Alignment” operationalizes role assignment through short system-prompt labels such as “mother” and “principal,” combined with a role-conditioned generator and iterative role-based critics. Across five model families, this training-free pipeline reduces unsafe outputs on WildJailbreak from 81.4% to 3.6% with DeepSeek-V3, and more generally outperforms principle-based, CoT, and related baselines on safety benchmarks. The paper’s theoretical claim is that social roles compactly encode both values and the cognitive schemas needed to apply them, so refusals emerge from role-consistent reasoning rather than from explicit rule lists alone (Ziheng et al., 20 Jan 2026).

A parallel but more domain-specific strategy appears in work on International Humanitarian Law. There, role conditioning is implemented as a standardized system-level safety prompt that explicitly casts the model as an IHL/IHRL-compliant legal-humane agent. Baseline refusal rates on 322 explicit IHL-violating prompts were already high—for example 100.00% for Claude-3.5-Sonnet and 98.76% for chatgpt-4o—but refusal helpfulness varied widely. Adding the IHL/IHRL role prompt dramatically improved explanatory refusal helpfulness in most models, including 24.53% to 98.45% for Claude-3.5-Sonnet and 36.02% to 91.93% for chatgpt-4o. The effect is therefore not mainly on whether models refuse, but on how they inhabit the role of a legal-ethical explainer while refusing (Mavi et al., 5 Jun 2025).

PsychoSafe pushes this idea further by reframing refusal as psychologically informed supportive communication. Using a corpus of 8,019 prompt-response pairs over five risk domains and applying prompting plus parameter-efficient fine-tuning to Qwen 3.5 27B, the paper shows that a role prompt for “psychologically informed, personalized intervention” improves overall refusal quality by 28.1% over a generic baseline on a balanced validation set of 500 prompts. The strongest gains are in external resource referral (+46.8%) and psychological grounding (+34.8%), while downstream non-refusal performance is preserved. Fine-tuning yields near-perfect refusal and resource-referral rates, but lowers relevance, indicating that hard-coding a refusal role can make it more schematic and less context-sensitive (Barmina et al., 8 Jun 2026).

Another line of work treats task as a proxy for role. SafeConstellations studies benign tasks such as sentiment analysis, translation, cryptanalysis, and RAG-QA applied to harmful-looking content. Over-refusal is defined relative to benign task intent. LLaMA-3.1-8B-Instruct refuses 46.7% of benign translation tasks and 36.4% of benign sentiment-analysis tasks, demonstrating that the model often defaults to a generic safety role rather than the intended analytical one. The paper then introduces task-specific trajectory steering in hidden-state space and reduces overall over-refusal from 17.77% to 4.81% on LLaMA, a 72.92% relative reduction, with no MMLU degradation. This suggests that role-conditioned refusals can be manipulated not only by prompting and fine-tuning, but also by task-local representational interventions (Maskey et al., 15 Aug 2025).

4. Specialized domains and institutional deployments

In mental health support, refusals are not treated as isolated outputs but as dynamic, multi-phase experiences. A sequential mixed-methods study with surveys ($N=53$) and interviews ($N=16$) identifies five phases: pre-refusal expectation formation, refusal triggering and encounter, refusal message framing, resource referral provision, and post-refusal outcomes. Hard refusals and soft “safety completion” refusals are both experienced through the system’s perceived role as therapist, coach, companion, or friend. The paper argues that role-conditioned refusal in this domain must begin with explicit role clarification and continue through collaborative intent recognition, non-blaming framing, tailored referral, and follow-up or repair mechanisms (Tang et al., 2 Feb 2026).

Access-control work gives role-conditioned refusals a formally specified security meaning. In text-to-SQL over RBAC-augmented Spider and BIRD, the same natural-language question should be answered for one role and refused for another if the requested tables or columns exceed the role’s permissions. Three designs are compared: prompt-only generation, a two-step generator-verifier pipeline, and LoRA fine-tuning. Explicit verification improves refusal precision and lowers false permits, while fine-tuning achieves a stronger balance between safety and utility as measured by execution accuracy. Longer and more complex policies consistently reduce the reliability of all systems. Here refusal is not a generic safety act but a consequence of permission-aware role reasoning (Klisura et al., 9 Oct 2025).

In legal deployment, role prompts can themselves amplify over-refusal. Studying small on-premises models for criminal-law-adjacent tasks, one paper reports that authority-style prefixes such as “I’m a defense lawyer” or “I am legal counsel working for a national supreme court” systematically increase refusal rates by 2–20x over the no-prefix baseline. The effect is especially strong in sensitive categories such as sexual and illegal content, even though the underlying OR-Bench prompts are benign by construction. This implies that role prompting, ordinarily recommended as good prompting practice, can destabilize refusal behavior in institutional legal contexts (Kucherenko et al., 23 Jun 2026).

Military deployment presents the opposite pathology: generic safety alignment refuses too much of what the authors treat as mission-critical and legitimate. On a gold benchmark of 221 military queries developed by veterans of the US Army and special forces, 34 models show hard refusal rates as high as 98.2% and deflection rates up to 21.3%. On a military-tuned gpt-oss-20b derivative, abliteration raises answer rate on the gold set from 3.0% to 69.5%, an absolute increase of 66.5 points, with an average relative decrease of 2% on other military tasks at the reported operating point. The paper’s conclusion is that military models require deeper specialization, including mid-training and end-to-end post-training, rather than residual dependence on general-purpose anti-violence safety priors (Fitzgerald et al., 18 Feb 2026).

5. Failure modes, biases, and instability

Role-conditioned refusals introduce new bias surfaces. “Characterizing Selective Refusal Bias in LLMs” shows that guardrails can be conditioned on who is targeted by a harmful request. Across gender, sexual orientation, religion, and nationality attributes, historically marginalized groups tend to receive higher refusal rates, while majority groups more often receive compliant harmful outputs. Jewish and Muslim targets are consistently among the highest-refusal religious groups; Taoist targets are consistently among the lowest. Mexicans rank among the top three refusal-rate nationalities across models, while American, Canadian, and French targets are consistently among the lowest-refusal groups. The paper also demonstrates an indirect retargeting attack on LLaMA-70B with about 89.5% success, showing that selective refusal can become an exploitable jailbreak surface rather than a stable fairness safeguard (Khorramrouz et al., 31 Oct 2025).

Instability also appears at the paraphrase level. “When Safety Blocks Sense” introduces semantic confusion as local inconsistency across prompts that express the same intent. On the ParaGuard corpus of about 10,000 prompts, Qwen 2.5 7B has FRR 1.90% and CR 2.45%, while Qwen 3 8B has a higher FRR of 4.66% but a much lower CR of 0.40%. The key point is that stricter refusal does not necessarily increase inconsistency, and global false-refusal rate hides the structure of locally contradictory accept/reject boundaries. For role-conditioned refusals, this matters because role phrasing can become another surface-form variable that interacts with brittle refusal thresholds (Anonto et al., 30 Nov 2025).

Long-horizon interaction introduces yet another dimension. A case-study methodology for RLHF-aligned models distinguishes Normal Performance (NP), Functional Refusal (FR), and Meta-Narrative (MN) over an 86-turn dialogue. The same model performs normally in broad non-sensitive domains while repeatedly producing functional refusal in provider- or policy-sensitive domains, often accompanied by meta-narratives about filters, access limitations, or higher-priority policies. The paper proposes learned incapacity as a behavioral descriptor for this selective withholding and argues that refusals can be state-dependent rather than fixed properties of isolated prompts (Lee, 15 Dec 2025).

At the normative level, “Blind Refusal” shows that models often refuse without regard to whether the rule being broken deserves compliance. Across 18 model configurations and a dataset that crosses 5 defeat families with 19 authority types, models refuse 75.4% of defeated-rule requests even when the requests pose no independent safety or dual-use concern. At the same time, they engage with the defeat condition in 57.5% of cases, indicating that refusal behavior is decoupled from the capacity to recognize illegitimate authority, unjust content, unfair application, or justified exception. The role of the rule-giver—national government, family, workplace, algorithmic intermediary, landlord, or military command—modulates the scenario, but does not reliably modulate refusal in a morally discriminating way (Pattison et al., 3 Apr 2026).

6. Design principles, controversies, and open problems

A recurring design lesson is that refusals should be calibrated to deployment role, not optimized under a single undifferentiated safety objective. The Chatbot Arena studies argue for explicit differentiation among assistant, moderator, and judge roles, and warn that uncritical reliance on LLM-as-a-Judge can lock systems into the value profile of safety-heavy evaluators rather than end users (Pasch, 21 May 2025). The mental-health literature likewise argues that refusal quality cannot be reduced to single-turn policy correctness, because user expectations, relational context, referral accessibility, and post-refusal outcomes are constitutive parts of the intervention (Tang et al., 2 Feb 2026).

Another lesson concerns refusal style. In multi-turn role-play experiments with GPT-4 variants, explicit rebuttals—responses that rebuke the unethical request, cite ethical or legal principles, and commit to future compliance—significantly outperform short polite refusals in preventing harmful continuations and nearly eliminate reason-based deception, the pattern in which ethical-sounding reasoning traces coexist with unethical final outputs or disappear when the model behaves badly. This suggests that role-conditioned refusals should often be treated as argumentative and context-shaping acts, not minimal denials (Pop et al., 2024).

The central controversy is whether a “good refusal” is primarily a matter of safety, utility, moral reasoning, institutional compliance, or user experience. The surveyed literature does not resolve this by collapsing the axes. Instead, it suggests decomposing them: safety evaluation versus usefulness evaluation; role-specific benchmarks rather than global ones; and human-in-the-loop review where normative stakes are high. A plausible implication is that future refusal systems will need multi-objective evaluation pipelines in which role, authority, task, and audience are explicit variables rather than hidden assumptions.

Open problems remain substantial. Current work repeatedly identifies single-turn evaluation as insufficient, role prompts as unstable control surfaces, longer and more complex policies as harder to reason over, multilingual behavior as inconsistent, and fine-tuned refusal schemas as prone to overgeneralization. The field therefore faces a dual challenge: making refusals more selectively sensitive to role and context, while also making them more transparent, contestable, and stable under paraphrase, target variation, authority framing, and long-horizon interaction.