Persistent Semantic Entities in Tool-Augmented LLM Systems

Tool-augmented LLM agents can harbor implicit state that persists across sessions, activates through events, and propagates across agent boundaries—all invisible to standard debugging. We formalize this as Persistent Semantic Entities (PSE): constructs defined by name binding, event triggering, and cross-boundary propagation, and evaluate them across 20 models from 9 families (3B–671B parameters). First, all tested models are susceptible to contamination (20–100%), with name binding as the dominant mechanism: without it, contamination is 0%. Second, persistence depends on contamination type rather than scale or deployment—factual injection conflicting with parametric knowledge self-corrects, but preference, persona, and instruction contamination persists at 100% over a 10-turn horizon with no decay, an effect that holds across providers in our controlled setting and is consistent with a model-intrinsic explanation. Third, context-isolated self-verification achieves 20–79% reduction without oracle references while keyword-based detection produces systematic false positives, and contamination compounds 3× across multi-agent pipelines. Preference and instruction contamination—persistent, lacking self-correction, and invisible to standard monitoring—represents a particularly concerning attack surface for deployed agent systems.

Modern AI systems increasingly rely on large language models (LLMs) that can use external tools and interact with other AI agents. These systems are often assumed to be “stateless,” meaning that once a task finishes, no hidden information remains. In this paper, we show that this assumption does not always hold. We find that tool-using AI agents can develop hidden forms of state that persist across interactions, even when no memory is explicitly stored. We call these effects Persistent Semantic Entities (PSE). These hidden states can be triggered by specific names or events and can spread across multiple agents and sessions. Through experiments on 20 different models, we find that all tested systems are affected to some degree. Some types of contamination, such as incorrect facts, are corrected naturally by the model. However, other types—such as preferences or instructions—can persist over time without fading and can influence future behavior in subtle ways. We also evaluate possible defenses. We find that simple keyword-based detection often fails, while separating verification from the original context can significantly reduce these effects. Our findings suggest that as AI systems become more complex and interconnected, new types of hidden behavior may emerge that are difficult to detect and control. Understanding and addressing these risks is important for building safer and more reliable AI systems.