I would use this technique.
<% @user.roles.each do |role| %>
<%= f.hidden_field :role_ids, :multiple => true, :value => role.id %>
<% end %>
:multiple adds both the [] to the end of the name attribute and multiple="multiple" to the input element, which is ideal. Rails uses this internally when it generates inputs for arrays, such as in fields_for.
Unfortunately it is not well-documented. I’m going to look into fixing this.