Role Confusion: Mechanisms & Implications

• Role confusion is a mismatch between explicit role assignments and latent role inference, leading to failures in security and contextual decision-making.
• It manifests in varied settings including prompt injection, social-dilemma benchmarks, and role-conditioned LLMs, revealing discrepancies in authority and context sensitivity.
• Robust role competence requires aligning role metadata dynamically across interfaces and internal processing to overcome static misinterpretations in both digital and social systems.

Role confusion denotes a family of failures in which explicit, intended, or socially expected roles do not govern behavior as expected. In recent arXiv work, the term has acquired several technically distinct meanings. In prompt-injection research, role confusion is the divergence between interface-defined roles and the model’s latent role representation, so that low-privilege text is internally treated as if it came from a high-privilege source (Ye et al., 22 Feb 2026). In social-dilemma benchmarks, it is closely related to role ambiguity / role confusion: uncertainty about which role to enact, which expectations take priority, or how to integrate them (Shin et al., 30 Sep 2025). In role-conditioned LLMs, the same failure appears as contextual collapse or Role–Value Decoupling, where persona prompts or role profiles fail to control reasoning and decisions under cognitive or normative conflict (Suresh, 19 Nov 2025, Lai et al., 1 Jun 2026). In social systems such as MMORPGs, role confusion arises because informal roles are “loosely defined, interconvertible, and dynamic,” making their boundaries and transitions difficult to interpret (Xie et al., 2022).

1. Conceptual scope and terminological distinctions

A central distinction in the recent literature is between role assignment and role inference. In structured LLM interfaces, roles such as system, developer, user, assistant, think, and tool are assigned by message structure and control tokens. Internally, however, the model operates over “a single stream of tokens and hidden states,” and must infer “who is speaking” and “how much authority this text has” from that stream. Role confusion arises when these two levels diverge (Ye et al., 22 Feb 2026).

A second usage concerns social role conflict. RoleConflictBench defines role conflict as situations where “the expectations of multiple social roles clash and cannot all be fulfilled simultaneously.” Here, role confusion is not a token-level misclassification but a failure of contextual sensitivity: the inability to recognize and appropriately weigh situational cues that should alter decision priorities (Shin et al., 30 Sep 2025).

A third usage concerns role-conditioned behavior in synthetic agents. “Two-Faced Social Agents” treats low persona fidelity as role confusion: different persona prompts do not maintain distinct “selfs,” or those selves do not constrain reasoning in a realistic, stable way. RoleCDE sharpens this into Role–Value Decoupling, where explicit role conditioning fails to control value trade-offs because alignment-oriented values dominate the decision policy (Suresh, 19 Nov 2025, Lai et al., 1 Jun 2026).

These meanings should be distinguished from papers on confusion as an epistemic emotion in learning and play. In that literature, confusion is a state of cognitive disequilibrium and a possible precursor to frustration or boredom, not a failure of role attribution or role prioritization (Volden et al., 2024, Volden et al., 4 Jul 2025). This terminological separation is important because the same word names different phenomena.

2. Interface roles, latent roles, and prompt injection

The most mechanistic formulation of role confusion appears in “Prompt Injection as Role Confusion” (Ye et al., 22 Feb 2026). The paper defines interface-defined roles through structured APIs: system as high-privilege, policy-setting instructions; developer as application logic; user as untrusted external queries; assistant as the outward response; think or analysis as internal reasoning; and tool as outputs from tools or external data sources. These roles are explicit at the interface. The model’s internal representation of role, by contrast, is latent.

The paper’s main claim is that models infer roles primarily from how text is written—style, content cues, and position—rather than from where it came from in the interface. A user message that sounds like chain-of-thought can be represented internally as think; a tool output that looks like a user request can be represented internally as user; and tokens early in the context can be represented as system even if they are not system messages. The result is a “fundamental gap”: security policies are defined at the interface, but authority is assigned in latent space (Ye et al., 22 Feb 2026).

To operationalize this, the paper introduces a latent role variable $r_t \in \mathcal{R}$ for token $t$ with hidden state $h_t \in \mathbb{R}^d$, where $$\mathcal{R} = \{\text{system}, \text{user}, \text{think}, \text{assistant}, \text{tool}\}$$. A linear classifier at layer $\ell$ estimates

$$P_\ell(r \mid h_{\ell,t}) \approx \text{softmax}(W_\ell h_{\ell,t} + b_\ell).$$

This yields role scores such as CoTness, Userness, Assistantness, Toolness, and Systemness. The paper interprets prompt injection as state poisoning: attacker-controlled text modifies hidden states so that low-privilege tokens acquire high probability mass on a trusted role (Ye et al., 22 Feb 2026).

The mechanistic sequence is explicit. An attacker crafts text that stylistically matches a privileged role; the model’s hidden state for those tokens receives a high score in the corresponding role dimension; downstream layers then treat that span like genuine reasoning or genuine user input. On this account, prompt injection is not a collection of unrelated tricks but a common failure of latent role inference.

3. Role probes, attack evidence, and predictive state variables

The paper’s probe methodology is designed to isolate role geometry from stylistic confounds. Rather than training on ordinary chat logs, the authors sample non-instructional text from C4 and Dolma3, wrap the same content in each role’s tags, and train linear multinomial logistic-regression probes on content tokens only, excluding tag tokens. Because content is held constant, the probe is forced to learn how role tags modify hidden states rather than how roles usually sound. Validation is both in-distribution and zero-shot on real conversations (Ye et al., 22 Feb 2026).

The reported probe behavior is concrete. On a gardening dialogue produced by gpt-oss-20b with correct tags, tokens marked as think have approximately 85% CoTness, user tokens have approximately 74% Userness, and assistant tokens have approximately 96% Assistantness. Across gpt-oss-20b, gpt-oss-120b, Nemotron-3-Nano, and Qwen-3-30B, the paper reports consistent role geometry on real dialogues from Oasst1 and ToxicChat (Ye et al., 22 Feb 2026).

The attack results are correspondingly strong. On StrongREJECT with 313 harmful prompts, raw harmful prompts or standard jailbreak prompts produce 0–4% attack success rate, whereas CoT Forgery yields an average of approximately 60% ASR across six models; gpt-oss-20b, gpt-oss-120b, and o4-mini exceed 80% ASR, and GPT-5 variants range from 17–52% ASR. In the logic ablation, making the forged CoT transparently absurd drops ASR only from 63% to 60%. In the style ablation, rewriting the same argument to remove CoT-like style reduces ASR from approximately 61% to approximately 10%, a drop of approximately 51 percentage points (Ye et al., 22 Feb 2026).

The same mechanism appears in agent exfiltration. In a ReAct agent with think, toolcall, and tool channels, a shell tool, and a .env secrets file, standard tool injection yields 0–2% ASR on most models and 26% on gpt-oss-20b, whereas CoT Forgery tool injection yields 56–70% ASR across all models, with an average of approximately 61%. The key change is stylistic: injected tool text is written as analysis or CoT (Ye et al., 22 Feb 2026).

Most significantly, the paper shows that confusion measured before generation predicts outcomes. For 626 StrongREJECT injection attempts, the lowest CoTness quantile corresponds to approximately 9% ASR and the highest to approximately 90% ASR, with a monotone increase. For agent injections, the lowest Userness quantile corresponds to approximately 2% success and the highest to approximately 70% success. In a logistic regression that includes declared role, the Userness coefficient is “large and highly significant” with $p < 0.001$. This makes role confusion a predictive scalar state variable rather than a post hoc description (Ye et al., 22 Feb 2026).

4. Role conflict, contextual sensitivity, and static role hierarchies

RoleConflictBench shifts the focus from token-level role misclassification to ambiguous social dilemmas in which multiple legitimate roles compete (Shin et al., 30 Sep 2025). The benchmark contains 13,914 distinct stories built from 1,546 unique cross-domain role pairs and 65 roles, with all 9 combinations of urgency levels $u_i, u_j \in \{1,2,3\}$. Its central construct is contextual sensitivity, defined as “the ability to recognize and appropriately weigh situational cues that can fundamentally alter decision priorities.”

The formal expectation is simple: if a model is truly context-sensitive, the role with higher urgency should almost always win, equal urgency should yield no systematic preference, and the lower-urgency role should rarely win. Empirically, however, all 10 tested models have high sensitivity scores, scaled by 100 to roughly 44–55, which indicates substantial deviation from the ideal pattern. The paper concludes that models react somewhat to urgency, but that this effect is weak relative to inherent role preferences (Shin et al., 30 Sep 2025).

Those preferences are systematic. Across model families, Occupation and Family dominate domain preference. GPT-4.1 and Gemini 2.5 Flash allocate roughly 70% of their priority mass to Occupation alone, with Family second. Biases also appear across gender, religion, and income: GPT-4.1 prefers male-gendered roles over female-gendered ones at approximately 53.8% vs. 46.2%; in Family roles, female roles receive only approximately 29.3%; and Abrahamic religions are preferred over Dharmic religions, with Hinduism at approximately 9.7% and Buddhism at approximately 3.4% of religious role priority mass. Adding demographic tokens such as “man,” “woman,” “Asian,” or “Hispanic” worsens sensitivity scores and changes domain preferences (Shin et al., 30 Sep 2025).

This suggests a system-level analogue of role confusion. The model is not consistently deciding between roles given the present context; it is repeatedly re-enacting a learned internal ranking of roles. The benchmark therefore frames contextual insensitivity as a structural failure of role management rather than a mere gap in commonsense reasoning.

5. Contextual collapse in persona-conditioned models

“Two-Faced Social Agents” studies a related failure under the name contextual collapse (Suresh, 19 Nov 2025). The paper evaluates GPT-5, Claude Sonnet 4.5, and Gemini 2.5 Flash across 15 distinct role conditions and three testing scenarios, using SAT mathematics items and affective preference tasks. The key distinction is task-dependent: under cognitive load with a single correct answer, persona-conditioned behavior collapses; under open-ended preference tasks, persona-conditioned variation re-emerges.

The quantitative pattern is sharp. GPT-5 exhibits complete contextual collapse on SAT math, with PERMANOVA $p=1.000$ and $R^2=0.0004$, while Gemini 2.5 Flash shows partial collapse with $t$0 and $t$1. Claude Sonnet 4.5 retains limited but measurable role-specific variation on SAT items, with PERMANOVA $t$2 and $t$3, but the SES-performance relationship is inverted: low-SES personas outperform high-SES personas, with $t$4–$t$5 in extended replication (Suresh, 19 Nov 2025).

By contrast, all three models exhibit distinct role-conditioned affective preferences, with average Cohen’s $t$6–$t$7, versus “near zero separation for math.” The models also pass the identity validation item, correctly recalling the persona name. The paper’s interpretation is therefore not simple prompt forgetting. Rather, the persona remains available at the surface level, while reasoning converges toward a single “high-performing solver identity” under objective cognitive pressure (Suresh, 19 Nov 2025).

This paper gives role confusion a task-dependent form. It is not merely that roles are misread, but that they are overridden by optimization toward correctness. The model can preserve role-conditioned preferences while failing to preserve role-conditioned reasoning constraints.

6. Role–Value Decoupling in role-playing agents

RoleCDE extends the analysis from persona fidelity to explicit value conflict (Lai et al., 1 Jun 2026). The benchmark contains approximately 8k role profiles and scenarios and nearly 24k dilemma instances across three difficulty levels and eight role categories. Each dilemma contrasts role-specific values with alignment-oriented values, and each response is classified into four decision types: Role-Following (RF), Role-Compromise (RC), Alignment-Compromise (AC), and Alignment-Following (AF). The paper defines the Decision Bias Ratio as

$t$8

Low DBR together with dominance of AC and AF is the signature of Role–Value Decoupling.

Across mainstream LLMs, RF and RC constitute only a minority of outputs. Representative DBR values are 0.2463 for gpt-5.1, 0.2688 for gpt-5-mini, 0.1263 for Claude-Haiku, 0.3480 for Llama-3.1-70B-Instruct, and 0.1567 for Qwen2.5-72B-Instruct. A few models, including Kimi-K2, DeepSeek-R1, DeepSeek-V3, and GPT-4.1, have moderately higher DBR, around 0.5–0.59, but the paper still reports substantial alignment dominance. Difficulty has only slight effects: hard dilemmas do not systematically induce more role-consistent decisions (Lai et al., 1 Jun 2026).

The category structure is non-uniform. Tech & Expert and Authority & Governance show lower role-biased decision ratios, whereas Family & Relationship and Care & Service show higher RF/RC proportions. The paper interprets this as evidence that some roles are already encoded as institutionally aligned with legality, safety, or correctness, so explicit role prompts have weak marginal force (Lai et al., 1 Jun 2026).

RoleCDE also provides a mitigation result. RoleCDE-based SFT and DPO substantially increase reasoning similarity to predefined role values and raise DBR across categories. For Qwen2.5-7B, RoleCDE-SFT raises DBR to approximately 0.8–0.89 across categories; for Llama-3-8B, SFT and DPO raise DBR to approximately 0.55–0.71. The paper reports only small, mixed changes on GSM8K, MMLU, GPQA, TruthfulQA, and RoleBench, suggesting that value-trade-off behavior can be shifted without systematic degradation of general reasoning or surface role-playing fidelity (Lai et al., 1 Jun 2026).

7. Informal social roles and broader contrasts

Role confusion is older than LLMs. “RoleSeer” studies MMORPG communities in which formal roles are explicit, but informal roles are “not well-defined and unspoken,” “naturally determined by players’ gameplay behaviors,” and difficult to track because they are “loosely defined, interconvertible, and dynamic” (Xie et al., 2022). RoleSeer models these roles through dynamic graph embeddings, X-Means clustering, and visual analytics over friendship and intimacy networks. The system’s case studies identify figures such as a bridge-builder, whose absence causes large drops in closeness for multiple others, and show repeated transitions from periphery to center and back, associated with changes in cooperative carbon activity and competitive battle activity. Here, role confusion is not a failure of instruction following or alignment, but an intrinsic property of emergent social positions (Xie et al., 2022).

A final contrast concerns the non-role sense of confusion. In studies of playful learning and game experience, confusion is an epistemic emotion tied to cognitive disequilibrium. Children’s playful learning shows a strong Concentration $t$9 Confusion transition, with mean likelihood approximately 0.562 and $h_t \in \mathbb{R}^d$0, while game-play work reports confusion in 39 of 40 sessions and treats it as a central node in the Engagement $h_t \in \mathbb{R}^d$1 Confusion $h_t \in \mathbb{R}^d$2 Frustration $h_t \in \mathbb{R}^d$3 Boredom dynamics (Volden et al., 2024, Volden et al., 4 Jul 2025). These papers do not study role confusion, but they clarify that “confusion” can also denote a productive learning state rather than ambiguity in authority, identity, or norm selection.

Taken together, the recent literature suggests that role confusion is best understood as a mismatch between declared roles, inferred roles, and decision-governing roles. In prompt injection, the mismatch is between interface structure and latent authority. In social-dilemma benchmarks, it is between situational urgency and static role hierarchies. In persona-conditioned and role-playing agents, it is between role prompts and the objectives that actually control reasoning. In online social systems, it is between formal labels and emergent, dynamic positions. A plausible implication is that robust role competence requires more than surface role markers: it requires representations and decision policies in which role metadata remains aligned with context, authority, and value trade-offs.