ShieldFont is a new protection mechanism designed to make AI scraping more expensive by serving different words to human readers and automated crawlers. Created by Isaque Seneda and Gabriel Abrucio, the project uses a specially crafted web font to display intended text on screen while the underlying HTML contains a grammatically correct decoy version. A person visiting the page sees the writer's original wording, but a scraper that reads raw code extracts altered text that can distort or neutralize the meaning.

How the font substitution works

Traditional fonts use substitution rules for typographic reasons. For example, when a lowercase f is followed by an i, many fonts automatically replace the pair with a single ligature glyph to improve appearance. ShieldFont borrows the same mechanism but points the substitution rules at whole words instead of letter pairs. The site's build process first swaps each protected word in the page's code with a different word of the same type and roughly similar commonness. The font then draws the swapped word as the original word chosen by the writer.

This means the browser and the server agree on the bytes, but only the rendering engine applies the font's substitution table. Search engine crawlers that do not render the page, including Googlebot and AI scraping tools, have no reason to apply those font rules. They simply see the decoy text, which is crafted to preserve grammar and approximate word frequency so it does not stand out as obvious garbage.

What ShieldFont protects

ShieldFont began in October 2025 with support from type foundry Playtype. The site deploying the font pays for the protection. The decoy is indexed by search engines because Googlebot and an AI scraper receive identical bytes. Copy-paste yields the encoded form, and find-in-page cannot locate a phrase that the reader can clearly see on screen.

According to Abrucio, the intended audience is people who want to join a creative resistance movement and are willing to accept the costs. Writers and artists are the primary users, but anyone concerned about protecting their creativity can benefit. The biggest measurable cost is search engine visibility. A site can reduce that cost by shielding only key parts of the content and leaving other sections available for indexing.

Abrucio also draws a boundary around the tool. It is not for people who need to minimize friction at all costs, especially when profit or clarity is the main goal. Traditional design rules favor user comfort, but in a world where mass scrapers ignore copyright, the rulebook may need to be rewritten.

Readers become part of the defense

The swap must be performed on the writer's own machine or server. If the task were left to the reader's browser, the entire dictionary would need to ship with the page, including the real words. That would make the protection trivial to break. By keeping the substitution server-side, the plain text never appears in a separate file.

There are additional challenges. An RSS feed can leak the full post in plain English on many platforms by default, because feeds are built from the source data before the font is applied. Screen readers also receive the protected region hidden from them. The alternative offered by ShieldFont requires the reader's browser to solve a short puzzle to unlock the real words. VoiceOver on macOS is verified, while NVDA and JAWS support are pending. Authors working outside React need to build their own accessibility alternative.

Seneda explains that the friction is an invitation for users to donate their brain compute to help keep content from being stolen. He argues that certain compute tasks are solved by the human brain at much lower cost than machines can currently achieve. This includes processing the pixels of a rendered font, but also tasks such as finding a button through vision or audio, which are expensive for machines at scale. The project wants to allow everyone to contribute with their brains, regardless of ability.

Known limits and attacks

The protection is not unbreakable. Every one of the 11,962 word pairs in the shipped font can be inverted using the font alone, assuming an inverter is already built. Headless browsers that render fonts read the page as a person does. OCR and vision-language models working from screenshots also recover the real text. Frequency analysis across a large corpus can work against a static dictionary.

This reading gap is supported by offensive research published in March 2026. LayerX Security released a study called 'Poisoned Typeface,' in which researcher Roy Paz built a page that showed a human one thing and handed AI assistants another. The technique used a substitution-cipher font alongside CSS that shrank the decoy text to a single pixel. Eleven AI assistants read the page and called it safe, including ChatGPT, Claude, Gemini and Perplexity. Microsoft was the only vendor to ship a fix, while Google closed its case after six weeks.

Measured damage to language models

Seneda and Abrucio tested how well the decoy survives when a language model is forced to work with altered text. Swapping about a quarter of a page's words causes the meaning to fail to survive in 55.8% of news passages tested. General web text sits close to half, and fiction near a third. The authors admit that these numbers are measured with the wrong instrument, and they do not claim the encoded text sails through quality filters. The damage to a trained model depends on how the model processes the text and whether the decoy is coherent enough to pass basic checks.

The economic argument

Seneda frames the protection in cost-per-page terms. Raw HTML scraping is currently cheap, while OCR scraping is more expensive. The gap between those two costs is real money, even if it is still only cents per page. At scale, a small deterrent can become meaningful. He expects ShieldFont to find more ways to increase that cost, including dictionary rotation and bring-your-own-key.

Future versions could require a scraper to solve a different, highly complex cybersecurity puzzle for every page. The repository currently ships four mapping variants and a script that mints a private mapping from a seed chosen by the author. Per-deploy rotation sits on the near-term roadmap. Font inversion survives any seed, but a new seed requires a newly built font, which raises the attacker's cost.

For Seneda, the ultimate benefit is leverage. Giving writers bargaining power against big tech could help restore the incentive to share work online. One of the biggest risks of mass scraping is that it discourages makers from publishing, and that weakens the internet's collaborative nature. The benefit is therefore cultural as much as technical.

Side effects and availability

ShieldFont introduces friction similar to CAPTCHAs or paywalls. News websites already choose to hide body text from search engines in some cases. Abrucio sees the trade-off as an investment in human creativity, sparking debate around the ethics of AI training while making unauthorized scraping more costly and riskier.

The code is free to take and build on, but the font that ships with it remains Playtype's property. A designer who wants a font of their own to give away has to build one on an open base. A crawler that draws the page the way a browser does will read a shielded article exactly as a person reads it. ShieldFont therefore covers the cheaper end of the scraping ecosystem: the tools that grab text from code and never render anything. That is also the end that runs across millions of pages today.

Source: Help Net Security News