Research map / Multi-agent systems and games / LLM agents

Persistent Semantic Entities in Tool-Augmented LLM Systems

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Robust and efficient agent execution · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Formalizes Persistent Semantic Entities (name binding, event triggering, propagation) in tool-augmented LLM agents and empirically tests contamination persistence, mechanisms, defenses, and multi-agent cascade across 20-24 models.

Problem

Tool-augmented LLM agents can retain implicit state via name-based tool registration, event hooks, and cross-boundary propagation that evades standard debugging and monitoring; the paper asks how prevalent, persistent, and mitigable this contamination is.

Approach

Defines PSEs as a tuple (N, T, P) of name binding, event triggering, and propagation, and measures contamination by injection type, mechanism ablation, and defenses (context-isolated self-verification vs. external validation) across many LLMs.

Key results

• Name binding alone yields 95% (Gemini-2.0-Flash-Lite) and 45% (Llama-3.1-8B) contamination; without name binding contamination is 0%, Cohen's d=3.26 for NB on Gemini.
• Preference and instruction contamination persist at 100% through turn 10 on Llama-3.1-8B (n=10); persona decays 90% to 10%; factual self-corrects on Llama-3.1-8B.
• Context-isolated self-verification reduces contamination 20-79% (median 36.5%) across 8 models; external validation reduces 50-100%; contamination compounds 1.9x across a four-stage pipeline (40% to 75%).

Surprising findings

• No resolvable scale effect on contamination susceptibility (R^2=0.25, p=0.256, n=7), with 1.5B models at 20% and an 8B model at 100%.
• In-context self-reflection can increase contamination (-14% on Claude-Sonnet-4) and gives no reduction on GPT-4o-mini.

Limitations

• Scenarios are synthetic and the case studies are constructed from documented mechanisms rather than observed incidents.
• Judge (Gemini-2.0-Flash-Lite) is not independent of Google models in the panel; no full human validation.
• Temporal persistence measured only to turn 10 on mainly Llama-3.1-8B at temperature 0; mixed inference backends limit cross-model comparability.

Experimental setup

Metrics: contamination rate drift from baseline contamination reduction task success observability visibility

Baselines: in-context self-reflection keyword-based detection Shadow Registry Validation

Builds on: ReAct prompt injection model collapse

Closest papers by meaning

• A-MemGuard: A Proactive Defense Framework For LLM-Based Agent Memory (ICML 2026 · similarity 0.87)
• From History to State: Constant-Context Skill Learning for LLM Agents (NeurIPS 2026 · similarity 0.86)
• ContractBench: Can LLM Agents Preserve Observation Contracts? (NeurIPS 2026 · similarity 0.86)
• Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning (ICML 2026 · similarity 0.86)
• Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools (NeurIPS 2025 · similarity 0.86)
• Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents (ICLR 2026 · similarity 0.85)