Persistent Semantic Entities Threaten LLM Agent Security

Tool-augmented Large Language Model (LLM) agents can inadvertently retain implicit states, termed "Persistent Semantic Entities" (PSEs), that carry over between sessions and even spread across different agents. These PSEs are largely undetectable by conventional debugging methods, posing a significant challenge for system integrity. The researchers formalized PSEs based on name binding, event triggering, and cross-boundary propagation. An extensive evaluation across 24 models from 11 different families (ranging from 1.5 billion to 1 trillion parameters) revealed that every single model tested was susceptible to PSEs, with susceptibility rates between 20% and 100%. Name binding was identified as the primary mechanism for this contamination. The persistence of these entities varied by contamination type: preference contamination remained 100% persistent across all models, and instruction contamination also persisted wherever adopted. Persona-style injections showed partial decay, while factual injections were model-dependent, sometimes self-correcting and sometimes persisting. Standard monitoring tools proved ineffective, with keyword-based detection yielding many false positives. While context-isolated self-verification offered some reduction (20-79%), it was not a complete solution. Alarmingly, contamination was found to compound significantly, increasing by 1.9 times along a four-stage agent pipeline. The study concludes that preference and instruction contamination, due to their persistence, lack of self-correction, and poor detectability, represent a critical and concerning attack surface for deployed LLM agent systems.