IA · 13 August 2026 · 4 min read
ShieldFont: The Anti-Scraping Font That Poisons AI Data Without Disrupting Readers
In brief: Designers Isaque Seneda and Gabriel Abrucio have introduced ShieldFont, a custom typeface designed to protect web content from unauthorized AI model training. By exploiting OpenType font ligatures, the font displays correct visual text to human users while embedding grammatically valid but contextually wrong words into the raw HTML, effectively poisoning web crawlers' datasets.
by Team Mocchi's
The Escalating Battle Over Web Content Scraping
Over the past two years, the training of large language models (LLMs) has sparked an unprecedented conflict between digital content creators and artificial intelligence corporations. Traditional blocking tools, such as robots.txt files or IP-based rate limiting, have proven largely ineffective: many web scrapers routinely ignore voluntary directives, while aggressive firewall rules or CAPTCHAs risk degrading the experience for human visitors and hurting search engine rankings.
Amid this growing tension, designers Isaque Seneda and Gabriel Abrucio have introduced ShieldFont. Detailed in a recent white paper, their approach turns a fundamental component of web design — font typography — into an active defense mechanism that poisons AI web scrapers' datasets without altering the reading experience for humans.
How ShieldFont Works: The Magic of OpenType Ligatures
To understand how ShieldFont operates, one must look at OpenType font ligatures. In standard web design, ligatures are typographic features designed to replace adjacent character pairs (such as "fi" or "fl") with a single, visually appealing glyph. ShieldFont pushes this concept much further: instead of merging letter pairs, it maps entire words in the HTML source code and renders them on screen as completely different visual words.
When a human user visits a page secured by ShieldFont, the browser's rendering engine downloads the custom font file and displays the correct sentence. However, the raw HTML code served by the server contains entirely different text. As reported by Ars Technica, if the raw HTML contains the word "potato," the font engine displays it visually as "horse." A human visitor reads "The cowboy was riding a horse," while a bot scraping the raw HTML ingests "The cowboy was riding a potato."
Semantic Poisoning: Bypassing Automated Quality Filters
The core innovation of ShieldFont lies in its method of text alteration. If a webpage simply replaced words with random characters or unreadable noise, modern scrapers would easily flag the anomaly using perplexity scores and discard the page before adding it to their training sets.
To bypass automated quality filters, ShieldFont utilizes a dictionary of roughly 12,000 common words, replacing approximately 24.5% of the text on a page with terms matching the same part of speech but originating from entirely different semantic domains. Nouns are swapped for other nouns, verbs for verbs, and adjectives for adjectives. The resulting raw text appears syntactically sound and natural to automated parsers, yet its underlying factual meaning is completely scrambled. To prevent AI developers from reverse-engineering the font with static lookup tables, ShieldFont offers three distinct word-mapping variations and allows publishers to alternate mappings between paragraphs.
Technical Limitations, Accessibility, and the Cost of OCR
Despite its ingenuity, ShieldFont carries technical trade-offs that prevent it from being a universal fix. The most significant concern involves accessibility: screen readers used by visually impaired users read the underlying HTML text, resulting in scrambled auditory output. Additionally, traditional search engine crawlers might misindex page content if they do not account for font-level visual rendering.
On the AI side, the theoretical countermeasure for machine learning firms would be deploying headless browsers with Optical Character Recognition (OCR) to extract text directly from visual page renders. However, performing full visual rendering and OCR across billions of web pages would increase compute and energy costs by orders of magnitude, making large-scale web scraping financially prohibitive.
Mocchi's take
The emergence of tools like ShieldFont illustrates how content protection on the web is shifting from passive access barriers to active data obfuscation. For companies managing high-value technical documentation, proprietary insights, or digital assets, relying solely on legacy safeguards like robots.txt is no longer enough to prevent data harvesting. While custom font mechanisms introduce accessibility and SEO trade-offs that require careful evaluation, this development highlights a broader enterprise reality: protecting digital intellectual property in the AI era will increasingly demand multi-layered architectures that defend data right at the point of web distribution.