Persistent Semantic Entities in Tool-Augmented LLM Systems

Zhaohui Geoffrey Wang
Proceedings of the 43rd International Conference on Machine Learning, PMLR 306:129420-129451, 2026.

Abstract

Tool-augmented LLM agents can harbor implicit state that persists across sessions, activates through events, and propagates across agent boundaries—largely invisible to standard debugging. We formalize this as Persistent Semantic Entities (PSEs): constructs defined by name binding, event triggering, and cross-boundary propagation, and evaluate them across 24 models from 11 families (1.5B–1T parameters). First, every tested model is susceptible (20–100% on the 20-model susceptibility panel), with name binding as the necessary and dominant mechanism: without it, contamination is 0%. Second, persistence depends on contamination type rather than scale or deployment: preference contamination persists undecayed on every model probed (100% at t=10) and instruction contamination persists wherever adopted, persona-style injection decays partially (90%$\rightarrow$10%), while factual injection is model-dependent—self-corrected on Llama-3.1-8B and GPT-4o-mini but held at ceiling on both Qwen2.5-coder variants, so we do not claim it self-corrects in general. The preference and instruction results hold across providers in our controlled setting. Third, context-isolated self-verification achieves 20–79% reduction (median 36.5%) without oracle references while keyword-based detection produces systematic false positives, and contamination compounds 1.9$\times$ along a four-stage agent pipeline (40%$\rightarrow$75%). Preference and instruction contamination—persistent, lacking self-correction, and poorly captured by standard monitoring—represent a particularly concerning attack surface for deployed agent systems.

Cite this Paper

BibTeX
@InProceedings{pmlr-v306-wang26gf, title = {Persistent Semantic Entities in Tool-Augmented {LLM} Systems}, author = {Wang, Zhaohui Geoffrey}, booktitle = {Proceedings of the 43rd International Conference on Machine Learning}, pages = {129420--129451}, year = {2026}, editor = {Zhang, Tong and Dudik, Miroslav and Jaggi, Martin and Agarwal, Alekh and Li, Sharon and Schuurmans, Dale and Zhu, Jerry and Berkenkamp, Felix and Dong, Hanze and Bietti, Alberto}, volume = {306}, series = {Proceedings of Machine Learning Research}, month = {06--11 Jul}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v306/main/assets/wang26gf/wang26gf.pdf}, url = {https://proceedings.mlr.press/v306/wang26gf.html}, abstract = {Tool-augmented LLM agents can harbor implicit state that persists across sessions, activates through events, and propagates across agent boundaries—largely invisible to standard debugging. We formalize this as Persistent Semantic Entities (PSEs): constructs defined by name binding, event triggering, and cross-boundary propagation, and evaluate them across 24 models from 11 families (1.5B–1T parameters). First, every tested model is susceptible (20–100% on the 20-model susceptibility panel), with name binding as the necessary and dominant mechanism: without it, contamination is 0%. Second, persistence depends on contamination type rather than scale or deployment: preference contamination persists undecayed on every model probed (100% at t=10) and instruction contamination persists wherever adopted, persona-style injection decays partially (90%$\rightarrow$10%), while factual injection is model-dependent—self-corrected on Llama-3.1-8B and GPT-4o-mini but held at ceiling on both Qwen2.5-coder variants, so we do not claim it self-corrects in general. The preference and instruction results hold across providers in our controlled setting. Third, context-isolated self-verification achieves 20–79% reduction (median 36.5%) without oracle references while keyword-based detection produces systematic false positives, and contamination compounds 1.9$\times$ along a four-stage agent pipeline (40%$\rightarrow$75%). Preference and instruction contamination—persistent, lacking self-correction, and poorly captured by standard monitoring—represent a particularly concerning attack surface for deployed agent systems.} }
Endnote
%0 Conference Paper %T Persistent Semantic Entities in Tool-Augmented LLM Systems %A Zhaohui Geoffrey Wang %B Proceedings of the 43rd International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2026 %E Tong Zhang %E Miroslav Dudik %E Martin Jaggi %E Alekh Agarwal %E Sharon Li %E Dale Schuurmans %E Jerry Zhu %E Felix Berkenkamp %E Hanze Dong %E Alberto Bietti %F pmlr-v306-wang26gf %I PMLR %P 129420--129451 %U https://proceedings.mlr.press/v306/wang26gf.html %V 306 %X Tool-augmented LLM agents can harbor implicit state that persists across sessions, activates through events, and propagates across agent boundaries—largely invisible to standard debugging. We formalize this as Persistent Semantic Entities (PSEs): constructs defined by name binding, event triggering, and cross-boundary propagation, and evaluate them across 24 models from 11 families (1.5B–1T parameters). First, every tested model is susceptible (20–100% on the 20-model susceptibility panel), with name binding as the necessary and dominant mechanism: without it, contamination is 0%. Second, persistence depends on contamination type rather than scale or deployment: preference contamination persists undecayed on every model probed (100% at t=10) and instruction contamination persists wherever adopted, persona-style injection decays partially (90%$\rightarrow$10%), while factual injection is model-dependent—self-corrected on Llama-3.1-8B and GPT-4o-mini but held at ceiling on both Qwen2.5-coder variants, so we do not claim it self-corrects in general. The preference and instruction results hold across providers in our controlled setting. Third, context-isolated self-verification achieves 20–79% reduction (median 36.5%) without oracle references while keyword-based detection produces systematic false positives, and contamination compounds 1.9$\times$ along a four-stage agent pipeline (40%$\rightarrow$75%). Preference and instruction contamination—persistent, lacking self-correction, and poorly captured by standard monitoring—represent a particularly concerning attack surface for deployed agent systems.
APA
Wang, Z.G.. (2026). Persistent Semantic Entities in Tool-Augmented LLM Systems. Proceedings of the 43rd International Conference on Machine Learning, in Proceedings of Machine Learning Research 306:129420-129451 Available from https://proceedings.mlr.press/v306/wang26gf.html.

Related Material