this post is rather old, but I was curious and I must say I have the same issue.
When starting with an empty db and calling my SecurityInitializer createing groups, roles, groupmemberships, etc. I see duplicates as decribed above.
I'm also able to add a User to the same Group multiple times? Is this intended behavior on picketlink's side? Do I have to restrict that on the entity level with constraints?