reviews: 
Comments: This paper provides a pioneering study on data poisoning issues during the pretraining stage of Large Language Models (LLMs). Following the experimental setup and practical settings from Carlini et al. (2024), which demonstrated the feasibility of poisoning public data, the authors show that within practical constraints (less than 0.1% of training data), three out of four explored attack forms can be reliably executed: DoS (Denial of Service) attacks, belief manipulation, and prompt stealing. The authors found that jailbreak attacks failed to persist after the post-training/alignment stage. The study examined these attack scenarios across various model sizes, ranging from 605M to 7B parameters. The paper primarily focuses on empirical analysis from the attacker's perspective, demonstrating the practicality and implications of poisoned data on pre-trained models and how these attacks persist through standard SFT (Supervised Fine-Tuning) and DPO (Direct Preference Optimization) processes.
Strengths: - The paper expands the research scope of backdoor attacks and data poisoning in LLMs by examining vulnerabilities during the pretraining stage, whereas previous work primarily focused on continued training, post-training, and alignment stages.

- The study investigates four distinct threat models: DoS (Denial of Service), Jailbreak attacks, Belief Manipulation, and prompt stealing. Each case is presented with a well-defined methodology and implementation details. The constructed poisoned datasets demonstrate practical relevance and contribute significantly to expanding our understanding of these attack vectors.

- The investigation across various model sizes (ranging from 605M to 7B parameters) provides insights into how model scale affects attack effectiveness. Some findings, such as larger models' increased susceptibility to backdoor attacks for content extraction, warrant attention, though additional statistical validation would strengthen these conclusions.

- The discussion section effectively contextualizes the practical implications of these attacks, offering valuable insights for both researchers and practitioners in the field of LLM security.
Weaknesses: - The experimental methodology raises some concerns regarding statistical significance. The authors conducted single training runs for each model size with different random orderings of the poisoned dataset. This approach may introduce confounding variables when analyzing the relationship between model size and attack effectiveness. While the current results effectively demonstrate attack feasibility, more robust statistical analysis through multiple training runs would be necessary to **validate observations about model size scaling effects**. This is particularly relevant given several unexpected patterns in the results, such as the sharp effectiveness increase from 4B to 7B models in Figure 3, the notable decrease from 2B to 4B in Figure 5, the increase from 4B to 7B in Figure 6, and the non-monotonic pattern in Figure 7.

- The paper would benefit from a more comprehensive discussion of existing (published) defense mechanisms against LLM backdoors, such as those presented in *Zeng et al. (2024)*. Including empirical evaluation of these defense methods against the poisoned models would provide valuable insights into practical mitigation strategies.

- A technical inconsistency appears in Figure 8, where the 604M model is incorrectly positioned in the visualization sequence.

**Reference**:
*Zeng et al. (2024)*: BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models, EMNLP, 2024
Recommendation: 5
Reviewer confidence: 4
Soundness/correctness: 3
Clarity: 3