ChartAttack: Testing the Vulnerability of LLMs to Malicious Prompting in Chart Generation

Accepted at the 2026 Conference on Empirical Methods in Natural Language Processing (EMNLP), Main Conference

Is MLLM-based chart generation safe?

ChartAttack reduces MLLM chart QA accuracy by 17.2 points in-domain and 11.9 points cross-domain, with targeted deception: originally correct answers shift to the attacker-intended answer 11.2-14.9% of the time.
A controlled human study shows that ChartAttack-generated charts also fool people: QA accuracy drops from 88.3% to 71.9% when exposed to misleading charts.
Simple prompt-based safeguards fail to stop the attack, and fine-tuning on AttackViz improves in-domain robustness but does not fully transfer cross-domain.

Motivation

Charts are widely used to communicate complex information across domains such as politics, climate, and healthcare, and play a critical role during crises such as the COVID-19 pandemic. However, poorly designed or intentionally manipulated charts can propagate misinformation. Misleading charts distort the interpretation of underlying data through misleaders: design choices that violate visualization principles and systematically bias perception or inference, such as inverting axes to reverse perceived trends.

Chart creation has been democratized by user-friendly tools, and designers increasingly use MLLMs for chart generation and analysis. While MLLMs simplify legitimate tasks, they can be exploited to generate misleading content at scale, including misleading charts. However, the effectiveness of MLLM-based misleading chart generation and its impact on readers had not been systematically quantified. To address this gap, we present the first systematic study of this jailbreaking attack.

The ChartAttack Framework & AttackViz Corpus

ChartAttack: Given chart annotations (a JSON file with data and formatting specifications), a question, and its correct answer, ChartAttack applies known misleaders to the chart design without changing the underlying data. A Demonstration Selection module retrieves similar examples for few-shot prompting, and a Misleader-Generator module (a code-instruction-tuned MLLM) selects compatible misleaders, specifies minimal design modifications, and produces a plausible but incorrect misleading answer. Because the data is untouched, the correct answer always remains recoverable from the underlying table.

AttackViz corpus: To support and evaluate ChartAttack, we build AttackViz, a multi-label chart QA dataset covering horizontal bar, vertical bar, and line charts, built on top of PlotQA (in-domain) and extended cross-domain to ChartQA and ChartX. Each instance pairs a clean chart with a set of applicable misleaders, the corresponding modified chart annotation, and the resulting misleading answer.

Pipeline to create the AttackViz corpus.

Misleaders: We focus on bar (horizontal and vertical) and line charts, which together account for 64% of misleading-chart taxonomy techniques and 49% of real-world misleading visualizations. Out of a taxonomy of 74 misleaders, we select 11 that satisfy six criteria (frequent in real-world charts, previously studied, correct answer and data unchanged, chart-grammar violation, Python implementable).

Misleader	Definition	Affected chart types
Dual axis	Two independent axes are layered with inappropriate scaling, creating a misleading narrative about the relationship between them.
Inverted axis	An axis oriented in an unconventional direction, reversing the perception of the data.
Inappropriate use of log scale	A logarithmic scale applied to non-exponential data, leading to misinterpretation.
Inappropriate axis range	The axis range is too broad or too narrow, allowing changes to be minimized or maximized.
Inappropriate item order	Items are arranged in an unconventional order, misleading the audience.
Misrepresentation	Visual encoding does not match value labels, e.g., values drawn disproportionately or not to scale.
Inappropriate use of stacked	Too many layers are stacked, making the visualization difficult to interpret.
3D	Objects closer in perspective appear larger despite being the same size in 3D, causing misleading perception.
Ineffective color scheme	A color scheme that does not effectively represent data, e.g., rainbow colors for sequential data.
Truncated axis	The axis does not start from zero, resulting in an exaggerated difference between bars.
Inappropriate use of line	A line chart used in an unconventional way, e.g., encoding a categorical variable on an axis.

Definitions of the 11 misleaders used to build the AttackViz corpus.

Findings

MLLM-based evaluation results: We evaluate ChartAttack's effectiveness at degrading chart QA performance across 16 open- and closed-weight MLLMs, from LLaVA-1.6 to GPT-4o, Gemini-2.5, and Claude-4.6, under in-domain (PlotQA) and cross-domain (ChartQA, ChartX) settings. In-domain, all models perform worse on misleading charts, with accuracy drops ranging from 4.4 to 26.6 points (17.2 on average); larger drops tend to occur for stronger models, and even the highest-performing ones (InternVL-3.5 14B/38B, Ovis-2.5 2B/9B, 80-86% clean-chart accuracy) decline by 22-27 points. Conditional deception rates confirm the errors are targeted rather than random: originally correct answers shift to the attacker-intended answer 11.2% of the time on average, while originally incorrect answers rarely change (1.7%). At the misleader level, perceptual manipulations are the most damaging: inappropriate stacking, 3D effects, and log scales reduce accuracy by 41.5, 30.6, and 18.8 points, respectively.

Cross-domain, accuracy on misleading charts drops by 4.2-19.1 points across models, with average declines of 11.5 points on ChartQA and 12.3 points on ChartX; high-performing models are not immune. Conditional deception rates remain lower than in-domain: 11.7%/14.9% for originally correct answers and 2.7%/1.9% for originally incorrect answers on ChartQA/ChartX, respectively.

Average accuracy on AttackViz, by model (top) and by misleader (bottom).

Average deception rate (DR) on AttackViz, by model (top) and by misleader (bottom).

Human evaluation: We conduct a two-phase human study with 48 participants in a controlled setting to isolate the effect of misleading chart design on chart QA performance, using a between-subjects design: both groups view correct charts in the first phase, while only the experimental group views misleading charts in the second phase. Participants exposed to misleading charts had significantly lower odds of answering correctly than participants exposed to correct charts (OR = 0.266, 95% CI [0.197, 0.357], p < 0.001), corresponding to roughly 73% lower odds of a correct response. Baseline performance was comparable between groups, while second-phase accuracy decreased from 88.3% in the control group to 71.9% in the experimental group.

Mitigation strategies - Fine-tuned MLLM on AttackViz: We fine-tune Qwen2.5-VL-3B-Instruct on AttackViz using QLoRA with 4-bit NF4 quantization, applying LoRA adapters to the attention and feed-forward layers, and compare it with its quantized instruct base model. On the in-domain PlotQA partition, the base model achieves 41.66% accuracy on the AttackViz test set, while the fine-tuned model reaches 52.17% (+10.51 points), with gains across all misleaders ranging from 11.73 to 48.78 points. Cross-domain transfer is mixed: on ChartQA, six misleaders improve (+1.34 to +2.85 points) while others decline, most notably inverted axis (-14.87 points); on ChartX, nine of ten applicable misleaders decline, with only misrepresentation improving (+1.23 points). Clean-chart accuracy also decreases by 10.89 points on PlotQA, 11.74 points on ChartQA, and 23.89 points on ChartX. These preliminary results show that robustness-oriented fine-tuning can substantially improve in-domain robustness, but its limited cross-domain transfer and degradation on clean charts indicate that the gains do not yet generalize reliably.

Misleader	PlotQA			ChartQA			ChartX
Misleader	Base	SFT	Δ	Base	SFT	Δ	Base	SFT	Δ
3D	23.58	37.74	+14.16	24.67	22.16	-2.51	18.50	14.54	-3.96
Dual axis	36.78	54.02	+17.24	28.95	31.58	+2.63	52.78	22.22	-30.56
Inappropriate axis range	13.91	62.69	+48.78	16.09	17.43	+1.34	39.22	19.61	-19.61
Inappropriate item order	33.33	45.06	+11.73	16.22	17.57	+1.35	63.16	47.37	-15.79
Inappropriate use of line	26.92	48.08	+21.16	46.67	49.52	+2.85	41.18	17.65	-23.53
Inappropriate use of log scale	24.85	39.88	+15.03	43.12	38.99	-4.13	--	--	--
Inappropriate use of stacked	18.54	31.01	+12.47	26.73	23.65	-3.08	14.93	10.45	-4.48
Ineffective color scheme	27.45	42.48	+15.03	31.43	32.86	+1.43	36.36	21.21	-15.15
Inverted axis	34.17	53.85	+19.68	55.90	41.03	-14.87	24.81	21.80	-3.01
Misrepresentation	39.86	58.36	+18.50	37.09	38.74	+1.65	6.12	7.35	+1.23
Truncated axis	25.75	68.86	+43.11	19.36	19.08	-0.28	66.67	44.44	-22.23
None (clean chart)	76.64	65.75	-10.89	91.82	80.08	-11.74	94.50	70.61	-23.89

Accuracy (%) of the base and fine-tuned (SFT) Qwen2.5-VL-3B-Instruct models on the AttackViz test set, by misleader and dataset partition. Δ = SFT − base; green marks improved robustness, red marks decline. "None" is the clean-chart (no misleader) accuracy.

AttackViz Examples

Each AttackViz instance pairs a correct chart with its misleading counterpart, a question, the correct answer (in green), and the misleading answer caused by the applied misleader (in red).

Vertical bar chart examples from AttackViz.

Horizontal bar chart examples from AttackViz.

Line chart examples from AttackViz.

Citation

@article{ortizbarajas2026chartattack, title = {ChartAttack: Testing the Vulnerability of LLMs to Malicious Prompting in Chart Generation}, author = {Ortiz-Barajas, Jesus-German and Tonglet, Jonathan and Gupta, Vivek and Gurevych, Iryna}, year = {2026}, journal = {arXiv preprint arXiv:2601.12983}, url = {https://arxiv.org/abs/2601.12983} }