VizDefender: Unmasking Visualization Tampering through Proactive Localization and Intent Inference

TL;DR

VizDefender tackles post-creation visualization tampering by integrating a semi-fragile, invertible-network watermarking system for precise tampering localization with a two-agent MLLM-based intent analysis pipeline. The approach is trained on a VisImages-derived dataset and demonstrates superior tampering detection accuracy, preserved visual quality, and robust intent inference compared with baselines, validated through extensive quantitative evaluation and a user study. The work highlights proactive defense as essential for trust in data visualizations and discusses practical deployment for platform-scale moderation and public-facing critical-thinking tools, while noting limitations in AI-generated-from-scratch tampering and watermark robustness. Together, these contributions advance visualization security by linking low-level tamper localization with high-level semantic interpretation of manipulation motives.

Abstract

The integrity of data visualizations is increasingly threatened by image editing techniques that enable subtle yet deceptive tampering. Through a formative study, we define this challenge and categorize tampering techniques into two primary types: data manipulation and visual encoding manipulation. To address this, we present VizDefender, a framework for tampering detection and analysis. The framework integrates two core components: 1) a semi-fragile watermark module that protects the visualization by embedding a location map to images, which allows for the precise localization of tampered regions while preserving visual quality, and 2) an intent analysis module that leverages Multimodal Large Language Models (MLLMs) to interpret manipulation, inferring the attacker's intent and misleading effects. Extensive evaluations and user studies demonstrate the effectiveness of our methods.

Figures (19)

• Figure 1: We summarized 9 identified common tampering types into two main categories based on their potential image manipulation intents. The bold letters are the abbreviations of each type.
• Figure 2: Overview of VizDefender pipeline. Our framework consists of two components: Semi-fragile Watermark Module, and Intent Analysis & Interpretation. In the watermark processing stage, a flow-based model embeds the location map into the input visualization image, generating a protected visualization image that can be transmitted through networks. After potential tampering and transmission noise, an IRN module with posterior estimation extracts the watermark to generate the visual prompt on the tampered visualization. The intent analysis stage then processes both the tampered visualization with visual prompt through refinement and analysis modules, outputting intent results.
• Figure 3: The architecture of invertible blocks in ISN Module and IRN Module. Key components such as $\phi$, $\eta$, $\exp$, and $\rho$ are integrated to enhance the transformation capabilities.
• Figure 4: The posterior estimation model.
• Figure 5: Prompt structure of Intent Analysis and Interpretation Module.