In my app I have these Hibernate-mapped types (general case):
class RoleRule {
private Role role;
private PermissionAwareEntity entity; // hibernate-mapp
See the answer of the question 'Overriding equals and hashCode in Java'.
It explains how to override the equals and hashCode methods, which seemed to be your problem as it worked after having them rewritten.
Wrongly overriding them can lead hibernate to delete your collections and reinsert them. (as the hash key is used as keys in maps)