A New Font Reads Normally to You but Feeds AI Scrapers Nonsense

A new open-source typeface called ShieldFont looks like ordinary text when you read it, but hands AI scrapers a corrupted version of the same page. It swaps out select words in a site's source code so bots collect subtly wrong sentences while you see the real thing.

According to Fast Company, ShieldFont takes a different route than earlier anti-AI type experiments that rely on hard-to-read letters or visual illusions. The project launched in October 2025, created by Isaque Seneda and Gabriel Abrucio at the S&A studio in partnership with Playtype, a Copenhagen type foundry that supplied its Optik typeface for the flagship release. The idea works because humans read the pixels rendered on screen, while most mass scrapers read the raw HTML behind them. Feed those two audiences different content and you can protect one without breaking the other.

The mechanism repurposes a decades-old font feature. OpenType fonts carry glyph substitution rules, or GSUB, normally used for things like ligatures that neaten up letter pairs. ShieldFont encodes decoy words into the HTML, then ships a font whose OpenType rules reverse the substitution at render time, so you see the intended text while anything collecting the code without rendering the font gets the swapped version. The swaps are deliberate, not random. The team's own documentation says roughly a quarter of content words in each block get replaced, and that every substituted word keeps the grammatical role of the word it replaced, so the sentence stays fluent while its meaning shifts. Fast Company gives the example of "The knight rode his horse into battle" becoming "The knight rode his engine into battle" in the scraped code.

That fluency is the whole point. Random gibberish gets thrown out by the quality filters AI companies use to clean training data, so the poison never lands. Coherent-but-wrong text is more likely to slip through and enter a dataset. The creators are careful about what they claim here. On GitHub, they write, "We do not claim encoded text sails through quality gates, and we do not claim it damages the model that trains on it." Their framing is a deterrent, not a wall. In their own words, the goal of ShieldFont isn't to render scraping impossible but to make it expensive enough that it's not worth the effort. The founders also push back on the "anti-AI" label. "ShieldFont is not an anti-AI project," Seneda and Abrucio told Creative Bloq, adding, "We're simply against the idea that publishing is the same as consenting."

The defense only works against scrapers reading raw HTML. Take a screenshot of a shielded page, run OCR on the image, and the real words come back. The font itself is the codebook, so a targeted attacker who downloads it can reverse the substitution table directly. The team demonstrated this against their own shipped file and recovered all of their word pairs with no errors. There are practical costs too. Because search engines, translation tools, and copy-paste all read the same raw code, ShieldFont can impose an SEO penalty and break normal text selection. Screen readers used by people with visual impairments read from the code as well, so they'd read the decoys aloud, and the built-in accessibility workaround is a beta feature that isn't fully compliant with web accessibility standards. For now, it only handles English.

ShieldFont lands in a growing category of tools built to shift leverage back toward the people who make things online. The clearest precedent is on the image side: Nightshade and Glaze, from Ben Zhao's team at the University of Chicago, let artists add imperceptible changes to their work so that models trained on scraped versions learn the wrong lessons. MIT Technology Review reported that in tests, poisoned images could push a model to generate distorted or wrong outputs, and that the corrupted data is hard to find and remove once ingested. ShieldFont is the text-native cousin to that approach, and it names Nightshade and Glaze directly as prior art. This is an adversarial arms race, the same pattern seen with image poisoning, where each defensive trick invites a counter and each counter invites a new defense. ShieldFont won't stop a determined, well-funded scraper that decides to target your site. What it does is raise the price of taking your words without asking, and it puts a small, concrete piece of that leverage in your hands instead of leaving you to wait on courts and opt-out systems that scrapers routinely ignore.