That's a tough one - and I think you can only solve this through coding-standards.
The fact, that the object's (and the sets of objects) are passed around by reference is actually beneficial for runtime performance. The object is only cloned (marshalled) for the purpose of passing it to the AppServer.
IMHO the safe place to keep a copy of the set would be on the client. This is the only place where you as a developer really know, that you rely on the fact that the set that is passed to be backend should be kept sort of immutable.
We tell our developers to rely on garbage collection, to not delete the objects, but I don't think that's enough.
This is not really a matter of GC. It's more a matter to trust nobody. If you rely on an object or a set of object remaining unmodified, the fact that the object is unmodified needs to be part of a contract - or you should not give anybody else access to that object (or set of objects).