Persistent Semantic Entities in Tool-Augmented LLM Systems

Abstract

Tool-augmented LLM agents can harbor implicit state that persists across sessions, activates through events, and propagates across agent boundaries—all invisible to standard debugging. We formalize this as Persistent Semantic Entities (PSE): constructs defined by name binding, event triggering, and cross-boundary propagation, and evaluate them across 20 models from 9 families (3B–671B parameters). First, all tested models are susceptible to contamination (20–100%), with name binding as the dominant mechanism: without it, contamination is 0%. Second, persistence depends on contamination type rather than scale or deployment—factual injection conflicting with parametric knowledge self-corrects, but preference, persona, and instruction contamination persists at 100% over a 10-turn horizon with no decay, an effect that holds across providers in our controlled setting and is consistent with a model-intrinsic explanation. Third, context-isolated self-verification achieves 20–79% reduction without oracle references while keyword-based detection produces systematic false positives, and contamination compounds 3× across multi-agent pipelines. Preference and instruction contamination—persistent, lacking self-correction, and invisible to standard monitoring—represents a particularly concerning attack surface for deployed agent systems.