An AI system described in a new arXiv preprint retained nearly all of the embedded information it was tested to recover after severe changes to a chart image. Its reported metadata bit accuracy—the share of embedded bits recovered correctly—was 99.43% when 60% of pixels had been modified and 99.36% when 50% of the chart area had been cropped. The same system is designed to locate tampering, reconstruct what a chart is saying and infer the likely misleading intent behind an edit.
How VizAnchor builds its case
VizAnchor, the name used in the preprint, is a two-stage framework. It first builds what the authors call dual-anchor evidence: semantic information recovered from the protected chart is paired with spatial evidence about cropped or locally edited regions. It then feeds that evidence to a visual-language model (VLM), a model that analyzes images and text together, to decode the manipulation process and likely intent. The full reasoning pipeline uses three sequential, role-specific calls to gemini-3.5-flash: one grounds the tampering, one reconstructs the chart narrative and one infers misleading intent. During inference, those agents do not receive reference annotations.
The evidence base was assembled across several datasets rather than one single study sample. The authors’ VizAnchor Dataset (VAD) contains 1,500 automatically generated chart pairs for localization training and 120 manually created pairs for localization and manipulation-understanding evaluation. The VisGuard dataset used for another part of the system contained 17,957 images: 14,964 training images and 2,993 held-out test images in a deterministic 5:1 split. The watermark and crop-aware modules were trained jointly on VisGuard, while the localization module was trained separately on VAD-LocTrain; all modules ran on a single NVIDIA RTX PRO 6000 GPU.
What the tests measured
On the VisGuard dataset, the paper reported PSNR of 43.28, SSIM of 0.9809 and LPIPS of 0.0664 for watermarked-chart fidelity.
For local edits, the reported overall intersection-over-union (IoU), a measure of overlap between predicted and actual edited areas, was 0.7418. Precision was 0.8011, recall 0.9105 and F1 0.8375. The localization evaluation included 20 crop samples and 100 non-crop local-edit samples from VAD-LocEval, alongside 1,000 samples from VDD-LocEval.
On the reasoning tasks, VizAnchor’s reported accuracy for identifying tamper type was 0.9045, with a Macro-F1 of 0.9024. Exact matching of the altered chart components was lower at 0.6273, while component Macro-F1 was 0.7420. The relevant evaluation sets contained 120 manually created VAD-ReasonEval pairs and 100 VDD-ReasonEval samples. For free-form explanations, process and intent cosine similarity scores were 0.7008 and 0.7525, while the corresponding AI-evaluation scores were 0.9045 and 0.8550.
A human check, and a hard limit
People also gave VizAnchor the highest mean ratings in a small user study. Thirty participants rated 10 anonymized manipulation examples on a five-point Likert scale. Mean ratings for VizAnchor were 1.437 on the manipulation-process task and 1.370 on the intent task, compared with −0.547 and −0.010 for VizDefender and 1.197 and 1.027 for a vanilla VLM. Friedman tests reported method differences for both tasks: χ²(2) was 42.660 for process and 39.138 for intent, with p values of 5.45 × 10−10 and 3.17 × 10−9.
The findings come with a narrow operating boundary. The authors identify two primary limitations: the system depends on metadata embedded before a chart is manipulated, and whole-chart regeneration can destroy those signals and bypass the local forensic traces the method relies on. The benchmark scores and user ratings therefore do not show that model-generated intent descriptions make viewers less likely to be misled or improve real-world decisions.
The process and intent similarity measures and AI-evaluation scores are proxies rather than direct measurements of real-world viewer deception. The supplied document is an arXiv version 1 preprint dated 25 August 2026.
Paper data and sources
Original title: VizAnchor: Decoding Manipulation Intent from Tampering Visualizations via Dual-Anchor Reasoning
Authors: Xiaotian Zhang, Huayuan Ye, Haiyang Zhang et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-25
DOI: Not available
Original paper · Full text