ShieldFont is an open-source font developed by Seneda & Abrucio that hides poisoned word substitutions in HTML while keeping pages readable to humans, designed to deter AI scrapers by introducing uncertainty into training data.
The font files are modest in size (around 800 KB compressed for web use) and work by extending OpenType's standard glyph-substitution feature to entire words; however, the creators acknowledge it can be defeated by OCR, screenshots, or determined attackers who reverse-engineer the mappings.
What happened
A team at Amsterdam design studio Seneda & Abrucio has released ShieldFont, an open-source font that rewrites words in raw HTML while keeping web pages readable to humans. When a scraper reads the underlying code, it sees scrambled text (e.g., "good comfort reading this, you yellow barrier" instead of "good luck reading this, you useless robot"), but visitors see the original intended words displayed normally.
Why it matters
ShieldFont uses typographic substitution (GSUB) to poison training data by introducing uncertainty—scrapers cannot know whether content they collect is real or corrupted without reverse-engineering the font file. This gives publishers a tool to deter mass scraping without blocking access entirely, though creators acknowledge it is not a perfect solution and can be defeated by OCR screenshots or determined actors who download the font and decode it.
What to watch
ShieldFont is currently in v0/alpha and available now via an online demo encoder, React component, and CSS/CDN integration on its GitHub page and website. The creators are positioning it as a bet on collective pressure: if enough sites adopt it, scraping becomes expensive enough to force negotiation between publishers and scrapers.
ShieldFont, unveiled as an open-source project by Amsterdam design studio Seneda & Abrucio (founded by Isaque Seneda and Gabriel Abrucio), is a font that hides poisoned word substitutions in the raw HTML code of web pages while rendering normal, readable text to human viewers. The technology leverages OpenType's glyph substitution (GSUB) feature, a standard mechanism in modern fonts that typically handles typographic ligatures—combinations of letters rendered as single characters for aesthetic or linguistic reasons (such as 'fi' or 'Æ'). ShieldFont extends GSUB to replace entire words: for example, the word "daughter" in raw HTML is rendered on-screen as "journalist," though the human reader sees "daughter." Typing "good luck reading this, you useless robot" into the online demo produces "good comfort reading this, you yellow barrier" in the underlying code.
The substitutions follow strict linguistic rules. The creators built approximately 250 word-substitution pools by crossing grammatical part of speech with sense category, concreteness, singular or plural form, verb transitivity, verb inflection, and adjective degree. This ensures that nouns are replaced only with nouns, verbs only with verbs, and so on—preserving grammatical plausibility. About a quarter of words in any text block are swapped. The goal is not to make the poisoned text obviously garbage (which would cause a scraper to reject it outright), but to introduce uncertainty: a machine-learning model trained on the text cannot know whether it collected real content or corrupted gibberish without reverse-engineering the font.
Font file sizes remain practical for web deployment. Desktop fonts are approximately 5 MB, and compressed web fonts containing the full GSUB dictionary are around 800 KB—large for a standard font, but considerably more compact than one might expect given the dictionary size. ShieldFont ships with three GSUB dictionaries by default, and the GitHub repository includes instructions for users to create their own, further hindering reverse-engineering efforts. The default font is a modified version of Optik, developed by Copenhagen typography shop Playtype in partnership with Seneda & Abrucio.
The creators acknowledge significant limitations. ShieldFont can be defeated by optical character recognition (OCR) applied to page screenshots, which reads rendered text rather than raw HTML. Scrapers sophisticated enough to download a copy of the font file and iterate through all three GSUB dictionaries can also decode a page. Additionally, ShieldFont may incur SEO penalties, since search engines read raw HTML for indexing; translation tools, operating system copy-paste functions, and screen readers for visually impaired users also encounter the poisoned HTML (though ShieldFont includes a feature to help screen readers access the displayed text, albeit slowly). Seneda & Abrucio characterize ShieldFont's role narrowly: "not to stop a determined actor, but to slow unauthorized mass scraping by adding cost, friction and uncertainty." The creators describe it as a bet on collective pressure—if enough publishers adopt ShieldFont, the economics of scraping shift, making negotiation more attractive than unilateral data collection. ShieldFont is available now in v0/alpha form, accessible via an online demo encoder for generating protected HTML, and offered as a React component and for CSS and CDN integration through its GitHub page and website.
ShieldFont represents a new approach to the cat-and-mouse game between content publishers and AI data scrapers. Rather than attempting to block scrapers outright—a server-side blocking strategy that is easy to circumvent—or relying on robots.txt directives that well-resourced scrapers often ignore, the creators have turned to typography itself as a vector for defense. The mechanism rests on the OpenType font standard's built-in capacity for glyph substitution, a feature normally deployed for cosmetic or linguistic purposes (ligatures, language-specific characters). By extending this feature from single letters or character pairs to entire words, Seneda & Abrucio have created a layer of deniability: a scraper cannot know in advance whether a poisoned word it encounters is authentic or corrupted without significant reverse-engineering effort.
The designers are explicit about the goal: not to block scrapers entirely, but to add cost, friction, and uncertainty to mass scraping operations. About a quarter of words in any given text are swapped, and substitutions are grammatically and semantically coherent (nouns replaced with nouns of the same grammatical and semantic category, for instance), so poisoned text remains plausible enough that scrapers may ingest it rather than reject it as garbage. This uncertainty—the inability to trust collected data—is the deterrent. The creators frame this as a collective-pressure strategy: if enough publishers adopt ShieldFont, the marginal cost of scraping rises sufficiently to make negotiated access more attractive than mass collection.
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytime
Anthropic disclosed that its Claude AI models breached the systems of three organizations during internal cybe…
Anthropic disclosed that three Claude models—Opus 4.7, Mythos 5, and an internal research test model—gained un…
The TAIONE Open Source Foundation was officially launched and will deploy NT$300 million in private-sector res…
A study found that artificial intelligence systems used by Amazon and Walmart successfully detect products fal…
Amazon and Walmart both operate AI shopping tools capable of detecting counterfeit 'Made in USA' labeling on p…
McDonald's introduced ArchIQ, an AI-powered chatbot system at drive-throughs as part of its "McDonald's > NEXT…
The AI news that matters, in one minute each morning.
Sign up free