ShieldFont swaps words to poison AI scraper training data

Designers Isaque Seneda and Gabriel Abrucio have introduced ShieldFont, a new font designed to disrupt AI scraping by poisoning training data while keeping webpages perfectly readable for humans. The font works by exploiting ligatures, a long-standing typographic feature that normally replaces certain letter pairs with more readable versions. ShieldFont repurposes ligatures to replace entire words in the underlying HTML code with alternatives that are semantically similar but contextually unrelated—such as swapping "horse" with "potato". This substitution happens only when the font engine renders the page onscreen, meaning that scrapers downloading plaintext source code receive the altered version while end users see the original text.

The word-replacement strategy is carefully calibrated. Simply replacing words with synonyms or antonyms would be easy for sophisticated scrapers to reverse, while replacing words with random gibberish could trigger detection filters. Instead, ShieldFont swaps words with similar parts of speech from completely different informational contexts, creating passages that look grammatically and structurally correct but carry scrambled, nonsensical meaning. After three months of refinement, the designers created a dictionary of nearly 12,000 common words eligible for replacement. To avoid detection, the font offers publishers three different potential mappings for each word replacement and the ability to encode custom mappings and swap them paragraph by paragraph. On average, ShieldFont replaces 24.5 percent of all words on a page, including 45.8 percent of all "content words," corrupting the meaning of 31 to 56 percent of individual passages depending on the text corpus studied.

In testing on six publicly available scraper pipelines, the ShieldFont authors found that over 90 percent of pages that would otherwise be accepted by scrapers were rejected after word replacements. Of the small subset of pages that still got accepted, nearly 20 percent of the component words were what the authors term "training-time garbage: real English, correctly spelled, asserting nothing true." This dual outcome benefits content creators either way: "Dropped means they did not get your work. Kept means they got something wrong." The creators acknowledge that ShieldFont is not foolproof. Any page readable by a human could theoretically be extracted by an AI scraper that renders the full webpage and applies optical character recognition to an image of the output. However, that process requires significantly more computational effort and cost. According to API pricing from third-party scraping tools, such pre-rendering would cost 5 to 13 times as much as simply scraping raw HTML source code, forcing heavy increases in time and expense for scrapers operating at scale.

The creators frame ShieldFont as a tool to enforce a basic principle: "creators should have a meaningful say in whether their work is used to train AI systems." Where consent is not respected, they argue, technical design can make taking work without permission "less useful and more costly." The designers also encourage others to develop alternative implementations of the same underlying principle—showing one thing to humans and something else to machines. They suggest that the more different methods circulate across the web, the harder it will become for AI scrapers to learn how to bypass them all. However, ShieldFont does introduce side effects for the intended audience: search engines, screen readers, copy/paste tools, and translation software can all get confused by the altered HTML, potentially reducing page utility for those functions.