As AI companies increasingly scrape the open web to train models, writers and artists are searching for ways to protect their work without disappearing from the internet entirely. A new project called ShieldFont offers a peculiar but clever approach: it serves one set of words to human readers and a completely different set to crawlers that read raw HTML. The person sees the original article. The machine gets a grammatically correct but factually meaningless decoy.

ShieldFont was started in October 2025 with support from the type foundry Playtype. It was built by Isaque Seneda and Gabriel Abrucio, two developers who wanted to give creators a practical tool for resisting unauthorized scraping. The font works on live websites right now, and the underlying code is available for free on GitHub. The project sits at the intersection of typography, cryptography, and the growing conflict between human creativity and machine learning.

The invisible battle between human readers and machines

Web scraping is not new, but the scale of AI training changed the stakes. Large language models need enormous amounts of text, and much of that text comes from crawling publicly available pages. For many writers, this means their work is being used without consent, without credit, and without compensation. Paywalls and robots.txt only go so far. Once HTML is public, it can be copied and processed by anything that can read code.

ShieldFont takes a different path. Instead of trying to block crawlers with technical barriers, it exploits the gap between what a browser renders and what the source code contains. Fonts have always been able to draw one thing while the code says another. A common example is the fi ligature, where the letters f and i are replaced by a single joined glyph. Those substitution rules are a standard part of typography. ShieldFont simply points those rules at whole words.

“We think this font is for people who want to join a creative resistance movement and are willing to pay a small price to do so,” Abrucio said. “Mostly writers and artists, but more broadly anyone who wants to protect their creativity. The main cost is reach through SEO. To reduce that, you can shield only key parts of your content and leave the rest available for indexing.”

How ShieldFont swaps the words

The process begins before the page is served. A build step scans the article and replaces chosen words with other words of the same grammatical type and roughly the same commonness. For example, a noun might become another noun, a verb might become another verb, and the sentence structure remains intact. The result is a text that reads naturally to any machine parsing the HTML.

When the page arrives in a browser, the ShieldFont font takes over. It contains a mapping from each decoy word back to the original word. Using OpenType substitution rules, the font draws the decoy word as the real word the author wrote. To a human looking at the rendered page, the article appears exactly as intended. To a scraper that pulls the raw HTML, the page is filled with plausible but false sentences.

The swap has to happen on the writer’s own machine or server. If the task were handed to the reader’s browser, the entire dictionary would need to ship alongside the page, including the real words. That would defeat the purpose because the plain text would sit in an accessible file. ShieldFont avoids that by keeping the mapping inside the font file itself, which is loaded as a normal web font.

Readers do the work the machines cannot

One of the most interesting aspects of ShieldFont is that it turns human readers into active participants in the resistance. The developers describe this as donating “brain compute” to the fight against AI scraping. Humans are remarkably good at reading text rendered in a font, even when the underlying code contains different words. Machines that only parse HTML never get the chance to see the rendered result.

“The project’s friction is actually an invitation for users to donate their ‘brain compute’ to help keep this content from being stolen,” Seneda said. “One of the core insights for ShieldFont is that there are certain compute tasks the human brain can solve at a much lower cost than machines right now – not only processing the pixels of a rendered font, but also tasks like finding a button, whether through vision or audio, which are expensive for machines at scale.”

He puts a price on this idea. “We don’t think people realize how efficient biological brains are. Humans have compute, and that compute is worth money, and we can use it and put it into this fight. It comes down to a battle of commodities: human compute vs. machine compute.”

Making readers do the work, part two: accessibility and feeds

Readers are not the only ones who need to see the true text. Screen readers, which convert text to speech for people with visual impairments, also rely on the underlying code. ShieldFont hides the protected region from screen readers by default, so nobody hears a decoy read aloud. That is a significant accessibility trade-off.

The alternative on offer makes the reader’s browser grind out a puzzle for a few seconds to unlock the real words. VoiceOver on macOS is verified. NVDA and JAWS are pending, and authors working outside React have to build the alternative themselves. This friction is intentional, but it limits the tool’s usefulness for people who need assistive technology.

There is also the problem of RSS feeds. A blog’s RSS feed leaks the whole post in plain English on most platforms by default, because feeds are built from the source data before any font touches it. That means ShieldFont only works if the author also disables or strips RSS content, which is another barrier to adoption.

The limits: what the font cannot hide

ShieldFont is not a silver bullet. Anyone who holds the font file can undo the obfuscation. The project’s own documentation admits that every one of the 11,962 word pairs can be recovered from the shipped font alone, using the font and an inverter. Headless browsers that render fonts read the page the same way a person does. OCR and vision-language models working from screenshots also see the real words.

Frequency analysis across a large corpus works against a static dictionary. If the same decoy word always maps to the same real word, a determined attacker can build a translation table. The developers respond with dictionary rotation and bring-your-own-key, meaning authors can generate a private mapping with their own seed. But rotation requires a newly built font, and any seed can still be inverted if the attacker has the font file.

The reading gap has offensive research behind it. In March 2026, LayerX Security published research called “Poisoned Typeface,” in which security researcher Roy Paz built a page that showed a human one thing and handed AI assistants another. He used a substitution-cipher font alongside CSS that shrank the decoy text to a single pixel. Eleven AI assistants read the page and called it safe, including ChatGPT, Claude, Gemini, and Perplexity. Microsoft was the only vendor to see a fix through, and Google closed its own case after six weeks.

Measured damage and economic argument

How much damage can ShieldFont actually do to AI training pipelines? The authors ran tests on news articles, general web text, and fiction. Swapping about a quarter of a page’s words made the meaning fail to survive in 55.8% of news passages tested. General web text sat close to half, and fiction came in near a third. These numbers are not impressive enough to stop a sophisticated model from extracting useful information, but they show that even partial obfuscation can degrade a machine’s ability to understand a passage.

Seneda and Abrucio do not claim the encoded text sails through quality filters. They also demote their own numbers on damage to a trained model as measured with the wrong instrument. The real goal is not perfect protection; it is raising the cost of scraping. Seneda puts the economics in cents: the gap between raw HTML scraping and OCR scraping is real money, even if it is still only cents per page. At scale, that small deterrent can add up.

“We think about the gap between what scraping costs today and what it would cost in a scaled ShieldFont scenario,” Seneda said. “That is real money, even if it is still only cents per page. It already serves as a small deterrent at scale, but we believe we can find more ways to increase that cost.”

Who should use it, and who should not

Abrucio is clear about the intended audience. “Who should walk away from it: people who need to minimize friction at all costs, especially when profit or clarity is the main goal. Traditional design rules say those experiences should be optimized for user comfort. But in a changing world, the rulebook sometimes needs to be rewritten, especially when the goal is resistance.”

For publishers that depend on search engine traffic, ShieldFont is risky. Search engines index the decoy, since Googlebot and an AI scraper receive identical bytes. A site that shields all of its content could see a sharp drop in organic visibility. The developers suggest shielding only key parts of a page and leaving the rest indexed, which limits the potential damage while still protecting the most valuable sentences.

Copy-paste also yields the encoded form. If a reader selects a paragraph and pastes it into a note-taking app, they get the decoy words, not the original article. Find-in-page comes up empty for a phrase the reader can see on screen. These trade-offs are by design, but they make ShieldFont a poor fit for reference-heavy sites where readers expect to quote or share short passages.

Roadmap and the cost of resistance

The repository ships four mapping variants and a script that mints a private mapping from a seed of the author’s choosing. Per-deploy rotation, meaning per-site seeds and time windows, sits under near-term roadmap priorities. Font inversion survives any seed, and a new seed requires a newly built font, so rotation raises the attacker’s cost.

Seneda believes the price buys leverage. “That could give writers real bargaining power against big tech and help restore the incentive to share work online. One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing, weakening the internet’s collaborative nature. So the benefit is primarily cultural.”

Abrucio places the cost alongside things publishers already charge readers for. “We understand that every form of protection introduces friction, from CAPTCHAs to paywalls. We see ShieldFont’s trade-offs as an investment in human creativity: a movement that sparks debate around the ethics of AI training while offering a tool that can make unauthorized scraping more costly and riskier.”

The code is free to take and build on. The font that ships with it stays Playtype’s property, so a designer wanting a font of their own to give away has to build one on an open base. That means ShieldFont itself is open source, but the original glyphs are not fully free for commercial redistribution.

What ShieldFont ultimately offers is not perfect secrecy. A crawler that draws the page the way a browser does reads a shielded article exactly as a person reads it. Headless browsers, OCR pipelines, and vision-language models can all bypass the protection. ShieldFont covers the cheaper end of the scraping ecosystem – the tools that grab text out of the code and never draw anything. That is also the end that runs across millions of pages, and making it more expensive is a meaningful step in the fight over who controls the future of online content.

Source: Help Net Security News