Headline

ShieldFont fights AI scraping by handing crawlers the wrong words.

Key facts

• ShieldFont was created by Isaque Seneda and Gabriel Abrucio to protect written content from AI scraping.
• It uses a custom web font to display different words to human readers than those present in the HTML source code.
• A build step replaces each protected word with a different word of the same type and similar frequency; the font later renders the replacement as the original word.
• The project started in October 2025 with support from the type foundry Playtype and is available free on GitHub.
• Potential weaknesses include RSS feeds, screen readers, headless browsers, OCR vision-language models, and frequency analysis.
• According to the creators, swapping about a quarter of a page's words caused meaning to fail in 55.8% of news passages tested.

How the font swap works

Fonts have always been allowed to draw one thing when the code says another. Type the letters f and i, for example, and most fonts merge the pair into a single joined shape so the letters stop colliding. These substitution rules have long existed for typographic tidiness. ShieldFont points them at whole words. A build step swaps the words in the page's code first, exchanging each one for a different word of the same kind and roughly the same commonness. The font then draws the swapped word to look like the word the writer chose. Anything reading the code without drawing the page keeps the swap, which covers scrapers, copy-paste into a text tool, and language models digesting raw HTML.

The swap has to happen on the writer's own machine or server. Hand the job to the reader's browser and the entire dictionary ships alongside the page, real words included. The site looks protected, but the plain text sits in a file anyone can open. ShieldFont avoids that by performing the substitution before the code is served. A person reading in a browser sees the writing as written. A scraper pulling the HTML gets different words in the same grammar, at the same URL, off the same bytes.

Search engines index the decoy, since Googlebot and an AI scraper receive identical bytes. Copy-paste yields the encoded form, and find-in-page comes up empty for a phrase the reader can see on screen. The project’s authors describe the font as a tool for people who want to join a creative resistance movement and are willing to pay a small price to do so. Writers and artists are the main audience, but the tool is meant for anyone who wants to protect their creativity. The main cost is reach through SEO. To reduce that, users can shield only key parts of their content and leave the rest available for indexing.

Readers do the work machines cannot

The project’s friction is actually an invitation for users to donate their “brain compute” to help keep content from being stolen. One of the core insights behind ShieldFont is that there are certain compute tasks the human brain can solve at a much lower cost than machines right now. That includes not only processing the pixels of a rendered font, but also tasks like finding a button, whether through vision or audio, which are expensive for machines at scale. The creators want to allow everyone to help with their brains, no matter their ability.

A blog’s RSS feed leaks the whole post in plain English, on most platforms by default, because feeds are built from the source data before any font touches it. That is a known limitation. Screen readers also get the protected region hidden from them, so nobody hears a decoy read aloud. The alternative on offer makes the reader’s browser grind out a puzzle for a few seconds to unlock the real words. VoiceOver on macOS is verified. NVDA and JAWS are pending, and authors working outside React have to build the alternative themselves.

The creators put a price on human participation. They argue that biological brains are extremely efficient, and that human compute is worth money. The fight against AI scraping becomes a battle of commodities: human compute versus machine compute. By forcing scrapers to solve visual or audio puzzles, ShieldFont shifts the economics of bulk content harvesting.

Anyone holding the font can undo it

The protection is not impenetrable. Every one of the 11,962 pairs came back out of the shipped font, using the font alone, given an inverter already built. Headless browsers that render fonts read the page as a person does. OCR and vision-language models working from screenshots do the same. Frequency analysis across a large corpus works against a static dictionary.

The reading gap has offensive research behind it. In March 2026, LayerX Security published a research project called “Poisoned Typeface,” in which researcher Roy Paz built a page that showed a human one thing and handed AI assistants another. The technique used a substitution-cipher font alongside CSS that shrank the decoy text to a single pixel. Eleven assistants read the page and called it safe, including ChatGPT, Claude, Gemini and Perplexity. Microsoft was the only vendor to see a fix through, and Google closed its own case after six weeks. This research demonstrates that the idea of making web content machine-readable in different ways is not unique to ShieldFont, but ShieldFont attempts to productize it for everyday writers.

The measured damage

The creators measured how much their font substitution degrades meaning. Swap about a quarter of a page’s words and the meaning fails to survive in 55.8% of news passages tested. General web text sits close to half, fiction near a third. Seneda and Abrucio decline to claim the encoded text sails through quality filters, and they demote their own numbers on damage to a trained model as measured with the wrong instrument. In other words, the real effect on large language models may be different from the simple test scores, but the direction is clear: changing words can reduce the usefulness of scraped text.

The economics of scraping

Seneda puts the economics in cents. The gap between what scraping costs today, which is raw HTML scraping, and what it would cost in a scaled ShieldFont scenario, which is OCR scraping, is real money, even if it is still only cents per page. That already serves as a small deterrent at scale, but the creators believe they can find more ways to increase that cost.

ShieldFont already includes dictionary rotation and bring-your-own-key. The repository ships four mapping variants and a script that mints a private mapping from a seed of the author’s choosing. Per-deploy rotation, meaning per-site seeds and time windows, sits under near-term roadmap priorities. Font inversion survives any seed, and a new seed requires a newly built font, so rotation raises the attacker’s cost. The vision is a future where a scraper must solve a different, highly complex cybersecurity puzzle for every page.

The price buys leverage in the eyes of the creators. That could give writers real bargaining power against big tech and help restore the incentive to share work online. One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing. We are already seeing people become more protective of their work, weakening the internet’s collaborative nature. The benefit, in the creators’ account, is primarily cultural.

Abrucio places the cost alongside things publishers already charge readers for. Every form of protection introduces friction, from CAPTCHAs to paywalls. News websites sometimes choose to hide their body text from search engines entirely. ShieldFont’s trade-offs are presented as an investment in human creativity: a movement that sparks debate around the ethics of AI training while offering a tool that can make unauthorized scraping more costly and riskier.

What it stops and what it does not

The code is free to take and build on. The font that ships with it stays Playtype’s property, so a designer wanting a font of their own to give away has to build one on an open base. A crawler that draws the page the way a browser does reads a shielded article exactly as a person reads it. ShieldFont covers the cheaper end, meaning the tools that grab text out of the code and never draw anything. That is also the end that runs across millions of pages.

The protection is therefore best understood as a cost-raising measure rather than an absolute barrier. For a small site or an independent writer, the main threat is bulk scraping by AI companies that harvest millions of pages without rendering them. ShieldFont makes those pages unreliable for that workflow. A determined adversary with a headless browser, a screen reader, or a vision language model can still extract the original text, but doing so at web scale becomes much more expensive. The creators are betting that this extra expense matters. By making the human author’s content harder to consume automatically, they hope to give writers more control over how their words are used in the age of generative AI.

Source: Help Net Security News