A font that speaks in two tongues

ShieldFont, a new web font project from Isaque Seneda and Gabriel Abrucio, is designed to give publishers a way to hide written work from automated data collection while keeping it readable for a human audience. The font works by showing one set of words in the browser and leaving a different set in the underlying HTML. Support from the type foundry Playtype helped launch the project in October 2025. The site deploying the font pays for the protection; readers do not need to install anything.

The project arrives amid a broader dispute over whether AI companies may freely use published text as training material. Publishers have tried several countermeasures: blocking crawlers, adding terms of service, inserting invisible warnings, and even poisoning datasets with misleading text. ShieldFont belongs to a smaller category of defensive design that targets the point where a machine reads code differently from a human reading pixels. The same basic technique has appeared in spam filters and adversarial examples, but ShieldFont packages it as a usable web font.

The result is a page where a person reading in a browser sees the writing as written. A scraper pulling the HTML receives different words in the same grammar, at the same URL, off the same bytes. Search engines index the decoy, since Googlebot and an AI scraper receive identical bytes. Copy-paste yields the encoded form, and find-in-page comes up empty for a phrase the reader can see on screen.

Abrucio described the project as a form of creative resistance. 'We think this font is for people who want to join a creative resistance movement and are willing to pay a small price to do so. Mostly writers and artists, but more broadly anyone who wants to protect their creativity. The main cost is reach through SEO. To reduce that, you can shield only key parts of your content and leave the rest available for indexing.'

He also drew a clear boundary around who should avoid it. 'Who should walk away from it: people who need to minimize friction at all costs, especially when profit or clarity is the main goal. Traditional design rules say those experiences should be optimized for user comfort. But in a changing world, the rulebook sometimes needs to be rewritten, especially when the goal is resistance.'

How the word swap works

Fonts have always been allowed to draw one thing when the code says another. Type f and then i, and most fonts merge the pair into a single joined shape so the letters stop colliding. Those substitution rules exist for typographic tidiness. ShieldFont points them at whole words.

A build step swaps the words in the page's code first, exchanging each one for a different word of the same kind and roughly the same commonness. The font then draws the swapped word to look like the word the writer chose. Anything reading the code without drawing the page keeps the swap, which covers scrapers, copy-paste into a text tool, and language models digesting raw HTML.

The swap has to happen on the writer's own machine or server. Hand the job to the reader's browser and the entire dictionary ships alongside the page, real words included. The site looks protected. The plain text sits in a file anyone can open. That constraint shapes the deployment model: the font must be built ahead of time and linked as part of the site's assets, not generated on the fly in JavaScript.

The approach is not a cryptography scheme. The project's own documentation acknowledges that every one of the 11,962 pairs in the shipped dictionary can be recovered from the font alone, given an inverter already built. Headless browsers that render fonts read the page as a person does. OCR and vision-language models working from screenshots do the same. Frequency analysis across a large corpus works against a static dictionary.

Accessibility is the hard part

Readers who rely on screen readers get the protected region hidden from them, so nobody hears a decoy read aloud. The alternative on offer makes the reader's browser grind out a puzzle for a few seconds to unlock the real words. VoiceOver on macOS is verified. NVDA and JAWS are pending, and authors working outside React have to build the alternative themselves.

A blog's RSS feed also leaks the whole post in plain English on most platforms by default, because feeds are built from the source data before any font touches it. That means ShieldFont cannot be a complete anti-scraping solution on a typical content site; it is a layer that raises cost for one kind of extraction while leaving other channels open.

Human compute versus machine compute

Seneda argues that the friction is intentional and economically meaningful. 'The project's friction is actually an invitation for users to donate their brain compute to help keep this content from being stolen. One of the core insights for ShieldFont is that there are certain compute tasks the human brain can solve at a much lower cost than machines right now, not only processing the pixels of a rendered font, but also tasks like finding a button, whether through vision or audio, which are expensive for machines at scale. And we want to allow everyone to help with their brains, no matter their ability.'

He puts a price on it. 'We don't think people realize how efficient biological brains are. Humans have compute, and that compute is worth money, and we can use it and put it into this fight. It comes down to a battle of commodities: human compute vs. machine compute.'

The economics are about widening the gap between cheap raw HTML scraping and more expensive OCR-based scraping. Seneda says that gap is real money, even if it is still only cents per page. It already serves as a small deterrent at scale, and the team wants to find more ways to increase that cost.

Offensive research and measured damage

The reading gap has offensive research behind it. In March 2026, LayerX Security published 'Poisoned Typeface,' in which Roy Paz built a page that showed a human one thing and handed AI assistants another, using a substitution-cipher font alongside CSS that shrank the decoy text to a single pixel. Eleven assistants read the page and called it safe, including ChatGPT, Claude, Gemini and Perplexity. Microsoft was the only vendor to see a fix through, and Google closed its own case after six weeks.

Seneda and Abrucio also measured what happens to meaning when a page is partially swapped. If about a quarter of a page's words are replaced, meaning fails to survive in 55.8 percent of news passages tested. General web text sits close to half, fiction near a third. The two decline to claim the encoded text sails through quality filters, and they demote their own numbers on damage to a trained model as measured with the wrong instrument.

Rotation, keys, and the roadmap

The repository ships four mapping variants and a script that mints a private mapping from a seed of the author's choosing. Per-deploy rotation, meaning per-site seeds and time windows, sits under near-term roadmap priorities. Font inversion survives any seed, and a new seed requires a newly built font, so rotation raises the attacker's cost.

Seneda says a future version could require a scraper to solve a different, highly complex cybersecurity puzzle for every page. 'We think about the gap between what scraping costs today and what it would cost in a scaled ShieldFont scenario. That is real money, even if it is still only cents per page. It already serves as a small deterrent at scale, but we believe we can find more ways to increase that cost.'

The larger goal, in his account, is leverage for writers. 'That could give writers real bargaining power against big tech and help restore the incentive to share work online. One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing, and we are already seeing people become more protective of their work, weakening the internet's collaborative nature. So the benefit is primarily cultural.'

Abrucio places the cost alongside things publishers already charge readers for. 'We understand that every form of protection introduces friction, from CAPTCHAs to paywalls. We see ShieldFont's trade-offs as an investment in human creativity: a movement that sparks debate around the ethics of AI training while offering a tool that can make unauthorized scraping more costly and riskier.'

What it stops and what it does not

The code is free to take and build on. The font that ships with it stays Playtype's property, so a designer wanting a font of their own to give away has to build one on an open base.

A crawler that draws the page the way a browser does reads a shielded article exactly as a person reads it. ShieldFont covers the cheaper end of scraping, meaning the tools that grab text out of the code and never draw anything. That is also the end that runs across millions of pages. For site owners, the decision comes down to whether they can accept a hit to search visibility in exchange for making mass extraction less automatic. The project is available free on GitHub.

Source: Help Net Security News