As publishers wrestle with unauthorized AI training and content scraping, two developers have introduced an unusual defense: a web font that displays one set of words to human readers while leaving a different set of words in the underlying HTML. The project, called ShieldFont, was created by Isaque Seneda and Gabriel Abrucio and began in October 2025 with support from the type foundry Playtype.

How ShieldFont Works

Fonts have always been allowed to draw one thing when the code says another. Typographers use substitution rules to merge letter pairs or improve readability. ShieldFont points those substitution rules at whole words. A build step swaps the words in the page's code first, exchanging each one for a different word of the same kind and roughly the same commonness. The font then draws the swapped word to look like the word the writer chose. A person reading in a browser sees the writing as written. A scraper pulling the HTML gets different words in the same grammar, at the same URL, off the same bytes.

The swap has to happen on the writer's own machine or server. If the job is handed to the reader's browser, the entire dictionary ships alongside the page, real words included. That would make the page look protected while the plain text sits in a file anyone can open. The creators designed ShieldFont to avoid that failure mode by performing the substitution before deployment.

Search engines index the decoy, since Googlebot and an AI scraper receive identical bytes. Copy-paste yields the encoded form, and find-in-page comes up empty for a phrase the reader can see on screen. That means the protection comes at a measurable cost: reach through SEO. The creators suggest that users can shield only key parts of their content and leave the rest available for indexing, reducing the negative impact on search visibility while still protecting the most valuable text.

Why the Creators Built It

Abrucio told Help Net Security that the font is intended for people who want to join a creative resistance movement and are willing to pay a small price to do so. The target audience includes writers and artists, but more broadly anyone who wants to protect their creativity. He acknowledged that traditional design rules favor minimizing friction, especially when profit or clarity is the main goal. But in a changing world, he argued, the rulebook sometimes needs to be rewritten, especially when the goal is resistance.

Seneda framed the project in economic terms. He believes the gap between what scraping costs today, which is raw HTML scraping, and what it would cost in a scaled ShieldFont scenario, which is OCR scraping, represents real money. Even if it is still only cents per page, it serves as a small deterrent at scale. The creators want to find more ways to increase that cost. They envision a future where a scraper must solve a different, highly complex cybersecurity puzzle for every page.

The project also draws on the idea that human brains are efficient computers. Seneda pointed out that there are certain compute tasks the human brain can solve at a much lower cost than machines right now, not only processing the pixels of a rendered font, but also tasks like finding a button, whether through vision or audio. He described it as a battle of commodities: human compute versus machine compute. The friction of reading a protected page becomes an invitation for users to donate their brain compute to help keep content from being stolen.

Key Facts at a Glance

• ShieldFont started in October 2025 with support from the type foundry Playtype.
• It uses a font to render one set of words on screen while a different set appears in the page's source code.
• The project is designed to mislead AI scrapers that pull raw HTML without rendering the page.
• Search engines index the decoy words because Googlebot and an AI scraper receive identical bytes.
• The swap happens on the writer's machine or server before the page is deployed.
• Copy-paste yields the encoded form, and find-in-page cannot locate visible phrases.
• The repository ships four mapping variants and a script that mints a private mapping from a seed of the author's choosing.
• ShieldFont is available for free on GitHub.

Trade-Offs and Friction

ShieldFont is not a frictionless solution. A blog's RSS feed leaks the whole post in plain English on most platforms by default, because feeds are built from the source data before any font touches it. Screen readers get the protected region hidden from them, so nobody hears a decoy read aloud. The alternative on offer makes the reader's browser grind out a puzzle for a few seconds to unlock the real words. VoiceOver on macOS is verified. NVDA and JAWS are pending, and authors working outside React have to build the alternative themselves.

The creators are open about these costs. Abrucio places the cost alongside things publishers already charge readers for, such as CAPTCHAs and paywalls. He sees ShieldFont's trade-offs as an investment in human creativity, a movement that sparks debate around the ethics of AI training while offering a tool that can make unauthorized scraping more costly and riskier. The project's friction is intentional, and it is part of the larger argument that protecting creative work requires some degree of inconvenience.

Ways the Defense Can Be Undone

Every one of the 11,962 pairs can be pulled back out of the shipped font, using the font alone, given an inverter already built. Headless browsers that render fonts read the page as a person does. OCR and vision-language models working from screenshots do the same. Frequency analysis across a large corpus works against a static dictionary. The creators decline to claim that the encoded text sails through quality filters, and they demote their own numbers on damage to a trained model as measured with the wrong instrument.

The reading gap has offensive research behind it. In March 2026, LayerX Security published a paper called Poisoned Typeface, in which researcher Roy Paz built a page that showed a human one thing and handed AI assistants another. The technique used a substitution-cipher font alongside CSS that shrank the decoy text to a single pixel. Eleven assistants read the page and called it safe, including ChatGPT, Claude, Gemini and Perplexity. Microsoft was the only vendor to see a fix through, and Google closed its own case after six weeks.

Measured Impact on Meaning

The creators have tested how much meaning survives when words are swapped. If about a quarter of a page's words are replaced, the meaning fails to survive in 55.8% of news passages tested. General web text sits close to half, and fiction near a third. These numbers suggest that ShieldFont can meaningfully disrupt comprehension for models trying to read the source text, but the effect is not absolute. The damage depends on the type of content, the density of swapped words, and the ability of the reader to infer meaning from context.

Critics might argue that any static mapping can eventually be learned or bypassed. The creators respond by pointing to future improvements. ShieldFont already includes dictionary rotation and bring-your-own-key, and the near-term roadmap includes per-deploy rotation, meaning per-site seeds and time windows. Font inversion survives any seed, and a new seed requires a newly built font, so rotation raises the attacker's cost.

The Economic Argument

Seneda believes the economics are on the side of human creators. He talks about the gap between what scraping costs today and what it would cost in a scaled ShieldFont scenario. That gap is real money, even if it is only cents per page. At scale, it becomes a small deterrent. The project aims to increase that cost over time by making each page more expensive to extract cleanly.

He also sees a broader cultural benefit. The ability to protect words could give writers real bargaining power against big tech and help restore the incentive to share work online. One of the biggest risks of mass scrapers bypassing copyright laws, he argues, is that it discourages makers from publishing. People are already becoming more protective of their work, weakening the internet's collaborative nature. For him, the benefit is primarily cultural.

What ShieldFont Stops and What It Does Not

The code is free to take and build on. The font that ships with it stays Playtype's property, so a designer wanting a font of their own to give away has to build one on an open base. A crawler that draws the page the way a browser does reads a shielded article exactly as a person reads it. ShieldFont covers the cheaper end, meaning the tools that grab text out of the code and never draw anything. That is also the end that runs across millions of pages.

For publishers and independent writers considering ShieldFont, the decision comes down to a trade-off between reach and protection. The creators recommend shielding only key parts of content to limit the SEO cost. They also emphasize that the project is meant as a form of resistance, not a permanent technical wall. As machine reading improves and scraping methods evolve, the balance between human readability and machine obstruction will continue to shift.

Source: Help Net Security News