reviews: 
Comments: The paper explores a novel and critical aspect of data poisoning in large language models (LLMs) by focusing on the feasibility and persistence of poisoning attacks introduced during the pre-training phase. Unlike prior studies that investigate attacks during fine-tuning, this work offers a comprehensive analysis of how various types of poisoning – denial-of-service, context extraction, jailbreaking, and belief manipulation – can endure through post-training alignment stages, such as supervised fine-tuning (SFT) and direct preference optimization (DPO). The authors' experiments demonstrate that as little as 0.1% of poisoned data can lead to persistent attack effects across LLMs ranging from 600M to 7B parameters.
Strengths: 1.	Novel idea to poison during pre-training: This paper provides a unique perspective on LLM poisoning by focusing on the pre-training stage, addressing a notable gap in existing research that mostly centers on poisoning during fine-tuning. By doing so, the paper reveals the extent to which pre-training poisoning can persist through typical alignment processes, offering a new angle on model security.
2.	Detailed Threat Model and Attack Setup: The paper's threat model and methodology are well-articulated, with distinct types of attacks designed for diverse malicious outcomes. The attack settings are compelling, such as belief manipulation, which subtly biases model responses, and denial-of-service, which elicits gibberish outputs to defend against information retrieval from proprietary sources.
3.	Comprehensive Evaluation: The paper employs multiple metrics and qualitative analyses across different attack scenarios to measure the persistence of poisoned behaviors through post-training.
Weaknesses: 1.	0.1% is still a lot: Although the authors mention in Section 5 that it is plausible to poison more than 0.1% of Pre-training data scrapped from the internet. Poisoning 0.1% of the dataset still means injecting 100 million malicious tokens, which is still very significant and costly. Therefore, it would be helpful to better understand the impact of poisoning by testing the poisoned model on benign tasks as demonstrated in Table 3. 
2.	Detour from the attack goal: To successfully carry out the denial-of-service or context extraction attack, the proposed method needs not only to poison the model but also injecting a trigger into the user prompt. Given that we already have the ability to inject tokens into the user’s prompts, it might also be a good idea to directly perform prompt injection attack on a clean model. For example, https://arxiv.org/pdf/2211.09527 directly studied how to perform goal hijacking (denial of service) and prompt leaking (context extraction) by injecting a few sentences.  With no doubt it will save great amount of resources to poison the data and pre-train the model. 
3.	Relatively limited performance on the rest of two tasks: Given what is mentioned in weakness 2, the attack should focus on the rest of the two tasks, jailbreak and belief manipulation. The paper found out that poisoned models are not significantly different from clean models. And from Figure 11, the effect of belief manipulation isn’t impressive given the huge effort to poison 100 million tokens. For jailbreaks, finetuning seems to be more powerful than poisoning pre-training data (for example https://arxiv.org/pdf/2310.03693). And for belief manipulation it seems like poisoning the knowledge for RAG (for example https://arxiv.org/pdf/2402.07867) might be a more effective idea.
Recommendation: 5
Reviewer confidence: 4
Soundness/correctness: 3
Clarity: 4