ShieldFont: A Clever Typeface That Turns Webpages Into AI Scraper Bait

AI companies scraping the public web for training data have sparked lawsuits and technical countermeasures. Now, designers Isaque Seneda and Gabriel Abrucio are trying a novel approach: a font that makes webpages appear perfectly normal to humans but serves AI scrapers a subtly corrupted version of the text.

The font, called ShieldFont, exploits ligatures—a typographic feature typically used to combine letter pairs like "fi" into a single glyph. In ShieldFont, ligatures are repurposed to replace entire words with alternatives. The substitution happens only when the browser renders the page, so scrapers that download the raw HTML source get a version where common words have been swapped for semantically unrelated ones—like "horse" becoming "potato."

The goal is to poison training data. Replacing words with synonyms would be too easy for scrapers to reverse, while gibberish would be easily detected. So ShieldFont swaps words with similar parts of speech that say something completely different, producing sentences that look grammatically correct but assert false information. After three months of refinement, the creators built a dictionary of nearly 12,000 common words, with three possible replacement mappings per word to thwart detection. Publishers can even encode their own mappings or vary them paragraph by paragraph.

On average, ShieldFont replaces 24.5% of all words on a page, including 45.8% of "content words." In tests against six scraper pipelines, over 90% of pages were rejected by quality filters after the substitutions. Of the pages that slipped through, nearly 20% of words were "training-time garbage: real English, correctly spelled, asserting nothing true." As the authors put it, "Dropped means they did not get your work. Kept means they got something wrong."

There are trade-offs. Screen readers, search engines, copy-paste, and translation tools can be tripped up by the altered HTML. And ShieldFont isn't foolproof—a scraper that renders the page and uses OCR could still read it correctly. But that approach would cost five to thirteen times as much as plain HTML scraping, making it impractical for large-scale operations.

The creators see ShieldFont as a way to enforce a basic principle: creators should have a say in whether their work trains AI. "Being discoverable does not mean consenting to AI training," they write. They hope other tinkerers will build on the idea of showing one thing to humans and another to machines, creating a diversity of defenses that make scraping the open web increasingly costly and unreliable.