{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T16:57:31Z","timestamp":1775667451931,"version":"3.50.1"},"reference-count":82,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"10","license":[{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Visual. Comput. Graphics"],"published-print":{"date-parts":[[2025,10]]},"DOI":"10.1109\/tvcg.2025.3575694","type":"journal-article","created":{"date-parts":[[2025,6,2]],"date-time":"2025-06-02T14:00:25Z","timestamp":1748872825000},"page":"8668-8682","source":"Crossref","is-referenced-by-count":4,"title":["JailbreakLens: Visual Analysis of Jailbreak Attacks Against Large Language Models"],"prefix":"10.1109","volume":"31","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1418-4635","authenticated-orcid":false,"given":"Yingchaojie","family":"Feng","sequence":"first","affiliation":[{"name":"State Key Lab of CAD&CG, Zhejiang University, Hangzhou, China"}]},{"given":"Zhizhang","family":"Chen","sequence":"additional","affiliation":[{"name":"State Key Lab of CAD&CG, Zhejiang University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-5242-9772","authenticated-orcid":false,"given":"Zhining","family":"Kang","sequence":"additional","affiliation":[{"name":"State Key Lab of CAD&CG, Zhejiang University, Hangzhou, China"}]},{"given":"Sijia","family":"Wang","sequence":"additional","affiliation":[{"name":"State Key Lab of CAD&CG, Zhejiang University, Hangzhou, China"}]},{"given":"Haoyu","family":"Tian","sequence":"additional","affiliation":[{"name":"State Key Lab of CAD&CG, Zhejiang University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8321-4607","authenticated-orcid":false,"given":"Wei","family":"Zhang","sequence":"additional","affiliation":[{"name":"Hangzhou City University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6711-3099","authenticated-orcid":false,"given":"Minfeng","family":"Zhu","sequence":"additional","affiliation":[{"name":"Zhejiang University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8365-4741","authenticated-orcid":false,"given":"Wei","family":"Chen","sequence":"additional","affiliation":[{"name":"State Key Lab of CAD&CG, Zhejiang University, Hangzhou, China"}]}],"member":"263","reference":[{"key":"ref1","first-page":"27730","article-title":"Training language models to follow instructions with human feedback","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Ouyang"},{"key":"ref2","article-title":"GPT-4 technical report","author":"Achiam","year":"2024"},{"key":"ref3","article-title":"LLaMA: Open and efficient foundation language models","author":"Touvron","year":"2023"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3586183.3606725"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3586183.3606719"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3586183.3606786"},{"key":"ref7","article-title":"SPROUT: Authoring programming tutorials with interactive visualization of large language model generation process","author":"Liu","year":"2023"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3544548.3580817"},{"key":"ref9","article-title":"OpenAgents: An open platform for language agents in the wild","author":"Xie","year":"2023"},{"key":"ref10","article-title":"InsightLens: Discovering and exploring insights from conversational contexts in large-language-model-powered data analysis","author":"Weng","year":"2024"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3663530.3665021"},{"key":"ref12","first-page":"80079","article-title":"Jailbroken: How does LLM safety training fail","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Wei"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24188"},{"key":"ref14","article-title":"Survey of vulnerabilities in large language models revealed by adversarial attacks","author":"Shayegani","year":"2023"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/satml64287.2025.00010"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.1045"},{"key":"ref17","article-title":"\u201cdo anything now","author":"Shen","year":"2023"},{"key":"ref18","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023"},{"key":"ref19","article-title":"Safety assessment of chinese large language models","author":"Sun","year":"2023"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.118"},{"key":"ref21","article-title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models","author":"Liu","year":"2024"},{"key":"ref22","article-title":"Quack: Automatic jailbreaking large language models via role-playing","author":"Jin","year":"2024"},{"key":"ref23","article-title":"GPTFUZZER: Red teaming large language models with auto-generated jailbreak prompts","author":"Yu","year":"2023"},{"key":"ref24","article-title":"HarmBench: A standardized evaluation framework for automated red teaming and robust refusal","author":"Mazeika","year":"2024"},{"key":"ref25","article-title":"Ignore previous prompt: Attack techniques for language models","author":"Perez","year":"2022"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/spw63631.2024.00018"},{"key":"ref27","article-title":"GPT-4 is too smart to be safe: Stealthy chat with LLMs via cipher","author":"Yuan","year":"2024"},{"key":"ref28","article-title":"Red teaming ChatGPT via jailbreaking: Bias, robustness, reliability and toxicity","author":"Zhuo","year":"2023"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.272"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/s12650-024-00969-z"},{"key":"ref31","first-page":"9274","article-title":"Adversarial training for high-stakes reliability","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Ziegler"},{"key":"ref32","first-page":"6106","article-title":"Poison frogs! targeted clean-label poisoning attacks on neural networks","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Shafahi"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2018.8802509"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/VIS47514.2020.00061"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2019.2934631"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/tvcg.2025.3557568"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2024.3456150"},{"key":"ref39","article-title":"Visualizing and understanding recurrent networks","author":"Karpathy","year":"2015"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N16-1082"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2019.2934629"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2023.3240003"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/s12650-021-00780-0"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2023.3327153"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2020.3030342"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2017.8585721"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2017.2744158"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref49","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2023.3327163"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2023.3243676"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2023.3327353"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3491102.3501965"},{"key":"ref54","article-title":"Mediators: Conversational agents explaining NLP model behavior","author":"Feldhus","year":"2022"},{"key":"ref55","article-title":"MultiViz: Towards visualizing and understanding multimodal models","author":"Liang","year":"2022"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2023.3327168"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2022.3184186"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2022.3209479"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1177\/14738716241240156"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3586183.3606737"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3586183.3606756"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/tvcg.2024.3394053"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2019.2934619"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2018.2865230"},{"key":"ref65","first-page":"4765","article-title":"A unified approach to interpreting model predictions","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Lundberg"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v31i1.11164"},{"key":"ref69","article-title":"Self-consistency improves chain of thought reasoning in language models","author":"Wang","year":"2022"},{"key":"ref70","first-page":"11809","article-title":"Tree of thoughts: Deliberate problem solving with large language models","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Yao"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.442"},{"key":"ref72","article-title":"Interactive analysis of LLMs using meaningful counterfactuals","author":"Cheng","year":"2024"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1108\/00220410410560573"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.253"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/TVCG.2010.20"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1016\/j.visinf.2020.04.004"},{"key":"ref78","article-title":"GLM: General language model pretraining with autoregressive blank infilling","author":"Du","year":"2021","journal-title":"arXiv::2103.10360"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-naacl.94"},{"key":"ref80","article-title":"Watch out for your agents! Investigating backdoor threats to LLM-based agents","author":"Yang","year":"2024"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-emnlp.139"},{"key":"ref82","first-page":"34892","article-title":"Visual instruction tuning","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Liu"},{"key":"ref84","first-page":"61478","article-title":"Are aligned neural networks adversarially aligned","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Carlini"},{"key":"ref85","article-title":"Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Shayegani"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30150"}],"container-title":["IEEE Transactions on Visualization and Computer Graphics"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/2945\/11151252\/11020711.pdf?arnumber=11020711","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,5]],"date-time":"2025-09-05T19:18:46Z","timestamp":1757099926000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11020711\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10]]},"references-count":82,"journal-issue":{"issue":"10"},"URL":"https:\/\/doi.org\/10.1109\/tvcg.2025.3575694","relation":{},"ISSN":["1077-2626","1941-0506","2160-9306"],"issn-type":[{"value":"1077-2626","type":"print"},{"value":"1941-0506","type":"electronic"},{"value":"2160-9306","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10]]}}}