Open-source font tricks AI scrapers with hidden word swaps

ShieldFont represents a new approach to the cat-and-mouse game between content publishers and AI data scrapers. Rather than attempting to block scrapers outright—a server-side blocking strategy that is easy to circumvent—or relying on robots.txt directives that well-resourced scrapers often ignore, the creators have turned to typography itself as a vector for defense. The mechanism rests on the OpenType font standard's built-in capacity for glyph substitution, a feature normally deployed for cosmetic or linguistic purposes (ligatures, language-specific characters). By extending this feature from single letters or character pairs to entire words, Seneda & Abrucio have created a layer of deniability: a scraper cannot know in advance whether a poisoned word it encounters is authentic or corrupted without significant reverse-engineering effort.

The designers are explicit about the goal: not to block scrapers entirely, but to add cost, friction, and uncertainty to mass scraping operations. About a quarter of words in any given text are swapped, and substitutions are grammatically and semantically coherent (nouns replaced with nouns of the same grammatical and semantic category, for instance), so poisoned text remains plausible enough that scrapers may ingest it rather than reject it as garbage. This uncertainty—the inability to trust collected data—is the deterrent. The creators frame this as a collective-pressure strategy: if enough publishers adopt ShieldFont, the marginal cost of scraping rises sufficiently to make negotiated access more attractive than mass collection.