ShieldFont is a new anti-scraping technique that uses a web font to show readers one version of an article while leaving a different set of words in the HTML source code. A person using a modern browser sees the original composition exactly as the author wrote it. A scraper that pulls the raw HTML receives different words, arranged with the same grammar, from the same URL, off the same bytes. The goal is to disrupt the low-cost pipeline that many AI systems rely on when they harvest content from the open web.

A font that points substitution rules at whole words

Created by Isaque Seneda and Gabriel Abrucio, ShieldFont began in October 2025 with support from the Danish type foundry Playtype. The site that deploys the font pays for the protection. Search engines index the decoy, because Googlebot and an AI scraper receive identical bytes. Copy-paste yields the encoded form, and find-in-page does not see a phrase the reader can see on screen.

Abrucio says the tool is meant for people who want to join a creative resistance movement and are willing to pay a small price for that choice. The main users are likely writers and artists, but the approach can protect any kind of creative work. The principal cost is reduced reach through search engine optimization. To limit that damage, a publisher can shield only key parts of a page and leave the rest available for indexing.

He also draws a boundary around the intended audience. People who need to minimize friction at all costs, especially when profit or clarity is the main objective, should walk away. Traditional design rules say experiences should be optimized for user comfort. But in a changing online world, the rulebook sometimes needs to be rewritten, especially when the goal is resistance.

How the word swapping works

Fonts have always had the ability to draw something that differs from the underlying code. The classic example is the typographic ligature: when the letter f appears next to the letter i, many fonts merge the pair into a single joined shape so the letters stop colliding. Those substitution rules exist for typographic tidiness. ShieldFont points them at whole words.

A build step swaps the words in the page code first, exchanging each selected word for a different word of the same kind and roughly the same commonness. The font then draws the swapped word to look like the word the writer originally chose. Anything that reads the code without drawing the page keeps the swap. That covers scrapers, copy-paste into a text tool, and language models that digest raw HTML.

The swap must be done on the writer's own machine or server. If the job is handed to the reader's browser, the entire dictionary would have to ship alongside the page, including the real words. The site would look protected, but the plain text would sit in a file anyone could open. The server-side approach is therefore essential to keep the mapping hidden from casual inspection.

Accessibility and leaks

The technique has known limitations. A blog's RSS feed leaks the whole post in plain English on most platforms by default, because feeds are built from the source data before any font touches it. Screen readers also cannot read the protected region, because assistive technology sees the swapped text. The current alternative makes the reader's browser spend a few seconds solving a small puzzle to unlock the real words.

Seneda says the project's friction is an invitation for users to donate their "brain compute" to help keep content from being stolen. One of the core insights is that the human brain can solve certain compute tasks at a much lower cost than machines. That includes processing the pixels of a rendered font and finding a button through vision or audio. The creators want to allow everyone to help with their brains, no matter their ability.

Seneda argues that people do not realize how efficient biological brains are. Humans have compute, and that compute is worth money, and it can be used in this fight. The struggle, in his view, comes down to a battle of commodities: human compute versus machine compute. By adding a small task to the human side, the tool creates a deliberate imbalance between what a person can do and what a scraping system can do.

Inversion attacks and offensive research

Any attacker who obtains the font can undo the protection. All 11,962 word pairs came back out of the shipped font, using the font alone, given an inverter already built. Headless browsers that render fonts read the page as a person does. OCR and vision-language models that work from screenshots also see the real text. Frequency analysis across a large corpus can be used against a static dictionary.

The reading gap has offensive research behind it. In March 2026, LayerX Security published a project called "Poisoned Typeface." Researcher Roy Paz built a page that showed a human one thing and handed AI assistants another, using a substitution-cipher font alongside CSS that shrank the decoy text to a single pixel. Eleven assistants read the page and called it safe, including ChatGPT, Claude, Gemini and Perplexity. Microsoft was the only vendor to fully see a fix through, and Google closed its own case after six weeks.

This history suggests that font-based hiding is not a perfect defense. It is a speed bump that raises the cost of automated reading. The same idea can also be weaponized against AI safety tools, which is why early disclosure and public scrutiny matter. ShieldFont's creators are open about the weaknesses and about the trade-offs involved.

Measured impact on AI models

The measured damage to model understanding is significant. Swap about a quarter of a page's words and the meaning fails to survive in 55.8 percent of news passages tested. General web text sits close to half, and fiction near a third. Seneda and Abrucio decline to claim that the encoded text sails through quality filters, and they demote their own numbers on damage to a trained model as measured with the wrong instrument.

In plain terms, the tool does not guarantee that an AI model will misread the page. It creates an increased probability of failure. The intent is to make mass extraction less reliable and more expensive. For a publisher worried about copyright, even a partial defense may be useful if it raises the cost of stealing content by enough to discourage bulk collection.

The economics of scraping

Seneda puts the economics in cents. The gap between what scraping costs today, which is raw HTML scraping, and what it would cost in a scaled ShieldFont scenario, which is OCR scraping, is real money, even if it is still only cents per page. At scale, that small deterrent can matter. The team believes they can find more ways to increase that cost.

The roadmap already includes dictionary rotation and bring-your-own-key. In a future version, a scraper might have to solve a different and highly complex cybersecurity puzzle for every page. The repository ships four mapping variants and a script that mints a private mapping from a seed chosen by the author. Per-deploy rotation, meaning per-site seeds and time windows, is a near-term priority. Font inversion survives any seed, and a new seed requires a newly built font, so rotation raises the attacker's cost.

Abrucio places the cost alongside other forms of publisher protection. Every form of protection introduces friction, from CAPTCHAs to paywalls. News websites already choose to hide their body text from search engines when it suits their business model. ShieldFont's trade-offs are framed as an investment in human creativity, a movement that sparks debate around the ethics of AI training while offering a tool that makes unauthorized scraping more costly and riskier.

What ShieldFont stops and what it does not

The code is free to take and build on, but the font that ships with it remains the property of Playtype. A designer who wants a font of their own to give away has to build one on an open base. The font component matters because the glyph substitution table is what connects the visible text to the intended words.

A crawler that draws the page the way a browser does reads a shielded article exactly as a person reads it. ShieldFont covers the cheaper end of the scraping ecosystem: the tools that grab text out of the code and never draw anything. That is also the end that runs across millions of pages. The authors do not claim to stop a determined adversary with a full browser or an OCR pipeline.

For writers and artists, the choice is about leverage. Seneda says the tool could give writers real bargaining power against big tech and help restore the incentive to share work online. One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing. That already creates a protective instinct that weakens the internet's collaborative nature. The benefit of ShieldFont, in that account, is primarily cultural.

ShieldFont is available for free on GitHub, so anyone who wants to explore the technique can inspect the build process, test the word pairing, and decide whether the trade-offs fit their goals. The project offers a new answer to a familiar question: how much friction should a creator accept to keep control of their work? Its answer is that a small, visible friction may be a price worth paying.

Source:Help Net Security News