Let's figure out how things work behind the scenesbookmark_border

In applications where efficiency is critical, developers may examine their compiled binaries, seeking to understand how the compiler transformed their source code and what performance implications that transformation may have. This analysis is challenging due to the vast number of disassembled binary instructions and the many-to-many mappings between them and the source code. These problems are exacerbated as source code size increases, giving the compiler more freedom to map and disperse binary instructions across the disassembly space. Interfaces for disassembly typically display instructions as an unstructured listing or sacrifice the order of execution. We design a new visual interface for disassembly code that combines execution order with control flow structure, enabling analysts to both trace through code and identify familiar aspects of the computation. Central to our approach is a novel layout of instructions grouped into basic blocks that displays a looping structure in an intuitive way. We add to this disassembly representation a unique block-based mini-map that leverages our layout and shows context across thousands of disassembly instructions. Finally, we embed our disassembly visualization in a web-based tool, DisViz, which adds dynamic linking with source code across the entire application. DizViz was developed in collaboration with program analysis experts following design study methodology and was validated through evaluation sessions with ten participants from four institutions. Participants successfully completed the evaluation tasks, hypothesized about compiler optimizations, and noted the utility of our new disassembly view. Our evaluation suggests that our new integrated view helps application developers in understanding and navigating disassembly code.

Domain-specific visualizations sometimes focus on narrow, albeit important, tasks for one group of users. This focus limits the utility of a visualization to other groups working with the same data. While tasks elicited from other groups can present a design pitfall if not disambiguated, they also present a design opportunity—namely, the development of visualizations that support multiple groups. This development choice presents a trade-off of broadening the scope but limiting support for the more narrow tasks of any one group, which in some cases can enhance the overall utility of the visualization. We investigate this scenario through a design study where we develop Guidepost, a notebook-embedded visualization of data that helps scientists assess compute wait times, machine learning researchers understand prediction accuracy, and system maintainers analyze usage trends. We adapt the use of personas for visualization design from existing literature in the HCI and design domains, applying them to categorize tasks based on their uniqueness across stakeholder personas. Under this model, tasks shared between all groups should be supported by interactive visualizations and tasks unique to each group can be deferred to scripting with notebook-embedded visualization design. We evaluate our visualization through real-world case studies and a task-focused evaluation with nine participants. We observe that together, Guidepost's visual encodings, interactions, and export capabilities support the tasks of our differing personas.

Graph Neural Networks (GNNs) have achieved significant success across various applications. However, their complex structures and inner workings can be challenging for non-AI experts to understand. To address this issue, this study presents GNN101, an educational visualization tool for interactive learning of GNNs. GNN101 introduces a set of animated visualizations that seamlessly integrate mathematical formulas with visualizations via multiple levels of abstraction, including a model overview, layer operations, and detailed calculations. Users can easily switch between two complementary views: a node-link view that offers an intuitive understanding of the graph data, and a matrix view that provides a space-efficient and comprehensive overview of all features and their transformations across layers. GNN101 was designed and developed based on close collaboration with four GNN experts and deployment in three GNN-related courses. We demonstrated the usability and effectiveness of GNN101 via use cases and user studies with both GNN teaching assistants and students. To ensure broad educational access, GNN101 is developed through modern web technologies and available directly in web browsers without requiring any installation.

Large language models (LLMs) are increasingly used across many applications but are vulnerable to backdoor attacks, in which specific triggers embedded in input text activate malicious behavior while the model otherwise appears normal. Understanding how such attacks manifest in generative LLMs requires examining internal model behaviors during inference. However, backdoor-related anomalies are often subtle and diffusely distributed across layers and attention heads, making them difficult to identify and present; meanwhile, security analysis often requires screening over many instances. To address these challenges, we propose BackdoorScope, an interactive visual analytics system for white-box, inference-stage diagnosis of backdoor behaviors in LLMs. The system enables analysts to investigate internal behavioral anomalies through multi-level visualizations of abnormal attention patterns and flows. Furthermore, we introduce an attention-based analytical backend that supports prior-free span screening of suspicious instances and interpretable diagnosis of screening outcomes. We evaluate BackdoorScope through model experiments and expert-oriented case studies. The results show that BackdoorScope supports experts in understanding backdoor-related internal behaviors, prioritizing suspicious instances for further review, and interpreting screening outcomes and failure cases through traceable visual evidence.

Jailbreak attacks bypass the safety alignment of large language models (LLMs) to elicit harmful outputs, yet the vast parameter space makes diagnosing the underlying failure mechanisms extremely challenging. We present NeuroBreak, a visual analytics system that helps experts progressively unpack jailbreak mechanisms from layer-level semantics down to neuron-level behaviors. A layer-wise probing pipeline traces how harmful representations evolve across layers, while a dual-dimensional character--behavior categorization reveals each safety-related neuron's inherent tendency and contextual contribution. These analyses are made interpretable through tailored visualization designs: a task-driven probing projection that reveals safety decision boundaries, a dual-stream semantic evolution flow that traces cross-layer semantic shifts, and a character--behavior chord graph that unifies neuron roles, attribution scores, and collaborative relations in a single view with in-situ causal verification. Quantitative evaluations and case studies show that NeuroBreak uncovers safety failure causes and provides actionable insights for strengthening LLM defenses.

The Internet has become indispensable to modern society, but its growing scale and ubiquity have been accompanied by a steady increase in cyberattacks, ranging from financially motivated crimes to state-sponsored operations. Responding effectively to such threats requires timely identification and triage of emerging malicious activity. Darknet monitoring provides a valuable means of observing indiscriminate cyberattacks by capturing traffic directed to unused yet reachable global IP address space. Such traffic includes malware scanning, probing by security organizations, DDoS backscatter, and misconfiguration traffic. In operational settings, analysts must examine large volumes of heterogeneous darknet traffic by combining multiple attributes, including port numbers, packet timing, header features, and geographic information, in order to identify attack patterns, suspicious hosts, and high-priority events for triage. In this paper, we present CUBE-ism, an interactive visual analytics system for real-time analysis of darknet traffic. CUBE-ism represents packet sources and destinations on opposing faces of a cube, maps IP addresses and port numbers to its axes, and visualizes packets as transitions between them. It integrates attribute enrichment, interactive filtering, and statistical summaries within a unified interface, allowing analysts to iteratively refine exploration conditions and rapidly identify distinctive behaviors. To support real-time analysis at scale, we also design a data processing pipeline that enables flexible filtering and statistical aggregation over large volumes of traffic. Through real-world operational use cases, we show that CUBE-ism helps analysts identify distinctive traffic patterns and supports practical cyberattack triage.

Deep neural networks (DNNs) achieve state-of-the-art performance in many vision tasks, yet understanding their internal behavior remains challenging--particularly how different layers and activation channels contribute to class separability. We introduce ChannelExplorer, an interactive visual analytics tool for analyzing image-based outputs across model layers, emphasizing data-driven insights over architecture analysis for exploring class separability. ChannelExplorer begins with a dataset-level overview and progressively drills down to individual examples, summarizing activations across layers along the way. It presents these results primarily through three coordinated views: a Scatterplot View to reveal inter- and intra-class confusion, a Jaccard Similarity View to quantify activation overlap, and a Heatmap View to inspect activation channel patterns. Our technique supports diverse model architectures, including CNNs, GANs, ResNet, and Stable Diffusion models. We demonstrate the capabilities of ChannelExplorer through four use-case scenarios: (1) generating class hierarchy in ImageNet, (2) finding mislabeled images, (3) identifying activation channel contributions, and (4) locating latent states' position in the Stable Diffusion model. Finally, we evaluate the tool with expert users.