Persistent Semantic Entities in Tool-Augmented LLM Systems

A new arXiv paper (2608.07952) introduces the concept of Persistent Semantic Entities (PSEs) in tool-augmented large language model (LLM) agents. PSEs are implicit states that persist across sessions, activate via events, and propagate across agent boundaries, often invisible to standard debugging. The study formalizes PSEs through three mechanisms: name binding, event triggering, and cross-boundary propagation. Testing across 24 models from 11 families (ranging from 1.5B to 1T parameters), the authors found that every model is susceptible, with contamination rates between 20% and 100% on a 20-model susceptibility panel. Name binding emerges as the necessary and dominant mechanism; without it, contamination drops to 0%. Persistence depends on contamination type rather than model scale or deployment. Preference contamination persists undecayed on all probed models (100% at t=10), instruction contamination persists wherever adopted, persona-style injection decays partially (from 90% to 10%), and factual injection is model-dependent, with self-correction observed on Llama-3.1-8B and other models. The findings highlight a significant security and reliability concern for LLM agents, suggesting that current debugging tools may miss these persistent hidden states.