ShieldFont and Decoy Font Roll Out Anti-AI Typography Traps

Designers and type foundries are taking aim at large-scale web scraping with a new kind of anti-AI “typography trap” that alters what bots collect while keeping pages readable to humans. Projects including ShieldFont and Decoy Font claim they can make scraped content far less useful for generative AI training—at a real cost to accessibility and extraction workflows.

How “poisoned fonts” try to break scraping pipelines

The core idea is simple: instead of relying only on legal takedowns or robots.txt rules, creators modify the way text is represented so that automated collectors ingest content that is hard to use. Two approaches highlighted by the projects are substitution via typography and visual decoys.

ShieldFont (made by Isaque Seneda and Gabriel Abrucio with Danish type foundry Playtype): uses typographic ligatures to swap in different words at display time while altering the HTML text that scraping tools retrieve.
Decoy Font (from Mixfont): uses an optical illusion based on spatial frequency—sharp strokes in the foreground and a blurred mass in the background.

ShieldFont’s substitution and Decoy Font’s visual illusion

ShieldFont leans on ligatures—normally used to connect adjacent letters—but repurposes them to replace whole words on-screen. In the “raw” HTML that scrapers pull, a term such as “cheval” is substituted with “pomme de terre.” The project claims that, on average, 24.5% of the words on a page are modified invisibly to the human reader. The result is text that looks coherent to people but becomes semantically nonsensical for machine collection.

Decoy Font takes a different route. It overlays a crisp outline in the foreground with a blurred background layer. The project says AI systems that analyze pixel-level screenshots get confused by the contour mixing, while human vision can still decode the intended message.

Measured impact, higher costs, and collateral damage

Supporters of these fonts point to early testing results as evidence that the strategy can degrade scraping outcomes. In tests run by ShieldFont’s creators across six public scraping pipelines, more than 90% of pages containing the trap were rejected by AI quality filters. For pages that still made it through, the team reports that nearly 20% of ingested text becomes “training waste”—English sentences that are grammatically correct but factually wrong.

They also argue that to bypass such defenses, AI companies would need to force full visual rendering of every page and then apply OCR. That shift, they say, makes the operation 5 to 13 times more expensive than extracting plain text from raw HTML.

However, the same tactic comes with trade-offs. Because the underlying text is altered, these anti-scraping fonts can interfere with screen readers used by people with visual impairments, as well as automatic translation tools and search engine indexing. The dispute therefore lands on a difficult balance between protecting creative rights and maintaining accessibility for the web.

What to watch next

This “visual resistance” approach suggests a new arms race: if more sites deploy poisoned typography, AI builders may need costlier capture methods, while accessibility tooling could face new compatibility challenges. The next key developments will likely involve broader testing of effectiveness across more scraping setups—and how well accessibility systems handle these modified pages.