If you use the DTO pattern, and recreate the persistent object with the same ID/version, and try to update and save it hibernate will usually be OK. However if the object contains child collections, then the child rows are inserted as new rows, and the original rows are not deleted. This occurs even if you specified cascade=all-delete-orphan in your mapping file.
The easiest fix this keep a reference to the original parent object. The child collections are a Hibernate proxy and if you use a new instance of the collection it won't delete the original children. To fix this keep the original object inside the HttpSession between requests, and instead, update it with the DTO, and then save it with Hibernate. The original object is considered a detached object if a new hibernate Session is used between requests.