nHibernate deleting and re-inserting many to many values when flushing the session

Consider the Following table mapping, this is not more than classic User security role mapping example.

<?xml version="1.0" encoding="utf-8" ?>
<hibernate-mapping xmlns="urn:nhibernate-mapping-2.2">
<class name="Model.User, Domain" table="[User]">
<id name="UserID" column="UserId" type="Int32">
  <generator class="hilo">
    <param name="table">NhibernateUniqueKey</param>
    <param name="column">NextHi</param>
    <param name="where">TableName='[User]'</param>
    <param name="max_lo">20</param>
  </generator>
</id>
<property name="UserName" column="UserName" type="String" length="20"/>
<property name="Password" column="Password" type="String" length="20"/>
.
.
<bag name="SecurityRoles" table="UserSecurityRole" lazy="false">
  <key column="UserId"></key>
  <many-to-many class="Model.SecurityRole, Domain"          column="SecurityRoleId"></many-to-many>
&l开发者_StackOverflowt;/bag>

The problem is when i retrive the user by username [using a criteria query], and flush the session all the security roles attached to the retrieved user gets deleted and re-inserted again, although i do not make any modifications to the retrived object.

Am i doing something wrong here or is this the way nhibernate works by design ?

That's the behavior of bag. To avoid it, use idbag or set.