ShieldFont: New typeface poisons AI training data while keeping pages readable

Designers Isaque Seneda and Gabriel Abrucio have introduced ShieldFont, a new typeface designed to disrupt AI training data collection while preserving readability for human users. The core innovation exploits ligatures—a traditional typographic feature that automatically substitutes certain letter combinations with single glyphs for better visual flow. With ShieldFont, ligatures instead replace entire words with semantically similar but contextually unrelated alternatives. The word "horse," for example, becomes "potato"; the result is a sentence that maintains grammatical coherence and uses correctly spelled English words but conveys scrambled meaning. Critically, this substitution happens only when the font renders on screen. Scrapers that download the raw HTML source code—the standard practice for web-scale data collection—receive the altered version with word replacements intact, while human readers see the intended text rendered normally. To avoid easy reversal by sophisticated scrapers, the creators chose replacement words carefully. Simple synonyms or antonyms would be trivial for an AI system to reverse-engineer, and completely unrelated gibberish would be too conspicuous for a scraper's quality filter. By replacing words with different parts of speech in entirely alien informational contexts, ShieldFont creates pages that read correctly at a surface level but convey false information—poisoning training datasets while appearing plausible. Over three months of refinement, the ShieldFont authors built a word-swapping dictionary containing nearly 12,000 common words. To complicate detection further, the font offers publishers three different potential mappings for each word replacement, with the option to rotate mappings from paragraph to paragraph or introduce custom substitutions. Testing showed the font replaces an average of 24.5 percent of all words on a page, climbing to 45.8 percent for "content words." Across six publicly available scraper pipelines, the approach caused over 90 percent of pages that would normally pass quality filters to be rejected. Of the small subset of pages that still survived the scraper's quality filter, nearly 20 percent of component words were what the authors term "training-time garbage"—real, correctly spelled English that asserts nothing true—meaning even "successful" scrapes contained corrupted training material. The creators acknowledge ShieldFont is not impenetrable. Any page readable by a human could theoretically be interpreted by an AI scraper that renders the full webpage and applies optical character recognition to an image of the output. However, that approach demands substantially more computational effort: industry estimates suggest such pre-rendering would cost five to 13 times as much as simply downloading raw HTML at scale, imposing prohibitive expense on indiscriminate, large-volume scraping operations. Practical side effects exist: search engines, screen readers, copy/paste tools, and translation software can all be confused by the altered HTML underlying ShieldFont pages, reducing their utility to intended audiences. Despite these limitations, the creators frame ShieldFont as a tool to assert creator consent. They argue that discoverability does not equal consent to AI training and that technical design can make unauthorized data extraction "less useful and more costly." The designers invite other developers to implement alternative versions of the same concept—showing one thing to humans and something different to machines—betting that a proliferation of different obfuscation methods will make it economically and technically infeasible for scrapers to learn and bypass them all.