In the quiet contest between human authorship and machine harvesting, two designers have fashioned a new kind of lock — one built not from code walls but from the act of reading itself. ShieldFont, launched in late 2025, exploits the gap between rendering and raw text: human eyes see the intended words while scrapers receive fluent decoys, making the same page mean two different things depending on who — or what — is looking. The tool does not promise invulnerability, only friction, and in doing so it reframes the question of content protection as one of economics and ethics rather than pure t
ShieldFont swaps words to thwart AI scrapers while keeping human readers in the loop
The human brain can solve this at a much lower cost than machines
Mark
So the reader sees the real text, but the scraper sees fake text. How does that actually work without the reader knowing?
Mimi
The swap happens on the server before the page loads. The font file contains rules that say "when you see this scrambled word, draw it as this real word." The browser renders it correctly. But anything reading the raw HTML—a scraper, a language model, copy-paste—just gets the scrambled version.
Mark
That sounds fragile. Can't someone just look at the font file and reverse it?
Mimi
Yes. Every one of the 11,962 word pairs can be extracted from the font itself. Headless browsers that render fonts read it correctly. OCR and vision models working from screenshots do too. It's not unbreakable. It's a cost multiplier.
Mark
What's the actual cost difference?
Mimi
Seneda talks about it in cents per page. Raw HTML scraping is nearly free. OCR scraping—rendering the page, taking a screenshot, reading the image—costs real money at scale. Still cents, but cents add up across millions of pages.
Mark
But doesn't this hurt regular people? What about search engines? Accessibility?
Mimi
Search engines index the decoy because they get the same bytes as scrapers. RSS feeds leak the real text because they're built from source before fonts touch them. Screen readers either can't access the protected region or have to solve a puzzle to unlock it. It's a real trade-off. Abrucio calls it an investment in human creativity, but the friction is real.
Mark
So this only stops the cheap scrapers, not the sophisticated ones?
Mimi
Right. It stops tools that just grab text from code. A scraper that renders the page the way a browser does reads it perfectly. That's the limitation. But the cheap scrapers are the ones running across millions of pages.
Mark
Why would a writer accept this friction?
Mimi
Because they're losing control of their work. Seneda says people are already becoming more protective, weakening the internet's collaborative nature. ShieldFont is a bet that some writers will trade discoverability for the feeling that they have some leverage back against the companies training models on their words.
O Pulso
- AI scrapers are harvesting written content at industrial scale, and the legal and technical barriers protecting creators have so far proven too slow and too porous to keep pace.
- ShieldFont introduces a font-level sleight of hand — swapping words in source code so that machines receive coherent but incorrect text while human readers see exactly what the author wrote.
- The defense carries real costs: search engines index the decoy, copy-paste breaks, screen reader compatibility is unresolved for major tools, and RSS feeds bypass the protection entirely.
- Headless browsers, OCR, and vision-language models that render pages as humans do can defeat the shield, meaning the protection holds only against the cheapest, most voluminous tier of scraping.
- The creators argue that even partial deterrence matters — if rotating dictionaries, per-site seeds, and increasing puzzle complexity raise the price of scraping by even cents per page, the leverage shifts at scale.
- The deeper bet is cultural: ShieldFont is as much a provocation about the ethics of AI training as it is a technical tool, inviting creators to weigh discoverability against the cost of being consumed without consent.
In the quiet contest between human authorship and machine harvesting, two designers have fashioned a new kind of lock — one built not from code walls but from the act of reading itself. ShieldFont, launched in late 2025, exploits the gap between rendering and raw text: human eyes see the intended words while scrapers receive fluent decoys, making the same page mean two different things depending on who — or what — is looking. The tool does not promise invulnerability, only friction, and in doing so it reframes the question of content protection as one of economics and ethics rather than pure technology. At its heart, it is a wager that making theft expensive enough might restore some dignity to the act of publishing.
Two designers have built a weapon disguised as a typeface. When a human reads a ShieldFont-protected page, the browser displays the author's exact words. When a scraper pulls the same HTML, it receives something different — a grammatically fluent sentence with different words substituted in. The human and the machine are reading the same bytes, but they are not reading the same thing.
Isaque Seneda and Gabriel Abrucio launched ShieldFont in October 2025, backed by the type foundry Playtype. Before a page loads, a build step swaps each word for another of similar kind and frequency. The font then renders the swapped word to look like the original. The substitution must happen server-side — push it to the browser and you ship the entire dictionary with the page, defeating the purpose.
The shield has gaps. Search engines index the decoy. Copy-paste yields encoded text. Find-in-page searches fail silently. RSS feeds typically bypass font rendering entirely. Screen reader support is partial, with VoiceOver on macOS verified but NVDA and JAWS still untested. Abrucio is direct about the trade-off: the technology is not for anyone who needs to minimize friction or prioritize discoverability.
The defense holds against cheap scrapers — tools that harvest raw HTML without rendering anything — which also happen to be the tools operating across millions of pages simultaneously. But headless browsers, OCR, and vision-language models working from screenshots read a shielded page exactly as a person does. Research published in early 2026 showed that a substitution-cipher font could fool eleven major AI assistants; only one vendor shipped a fix.
When roughly a quarter of a page's words are swapped, meaning fails to survive in more than half of news passages tested. Seneda and Abrucio do not claim otherwise. Their argument is about leverage, not perfection. Through dictionary rotation, per-site seeds, and time-limited puzzles, they hope to raise the cost of scraping enough to give writers some bargaining power against large technology companies. 'One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing,' Seneda says.
The code is open. The font belongs to Playtype. What ShieldFont offers is not a wall but a price tag — friction at scale, and a quiet argument that in a world where machines grow cheaper by the month, human cognition may be the last resource genuinely worth protecting.
Two designers have built a weapon disguised as a typeface. When you read a webpage protected by ShieldFont, your browser displays the words exactly as the author wrote them. But if a scraper pulls the same page's HTML code, it gets something different—a fluent sentence in the same grammar, same structure, same URL, but with different words swapped in. The human reader sees one thing. The machine sees another. Both are looking at the exact same bytes.
Isaque Seneda and Gabriel Abrucio started ShieldFont in October 2025 with backing from the type foundry Playtype. The mechanism is elegant: before a page loads, a build step exchanges each word for a different word of similar kind and frequency. The font then renders that swapped word to look like the original. Anything that reads the raw code without rendering the page—scrapers, copy-paste operations, language models digesting HTML—gets the decoy. The swap has to happen on the author's server or machine. If you push it to the reader's browser, you ship the entire dictionary alongside the page, defeating the whole purpose.
This is not a perfect shield. Search engines index the decoy because Googlebot receives identical bytes to any scraper. Copy-paste yields the encoded form. Find-in-page searches come up empty for phrases readers can clearly see on screen. RSS feeds leak the whole post in plain English on most platforms, since feeds are built from source data before fonts touch them. Screen readers encounter a protected region and either get hidden from it entirely or must solve a puzzle in their browser to unlock the real words—a trade-off that leaves accessibility in a difficult position, with VoiceOver on macOS verified but NVDA and JAWS still pending.
Abrucio frames the cost plainly: "Who should walk away from it: people who need to minimize friction at all costs, especially when profit or clarity is the main goal." The technology trades SEO reach and user friction for protection. You can shield only key parts of your content and leave the rest available for indexing, but there is no free lunch. The bet is cultural, not technical. "We think about the gap between what scraping costs today and what it would cost in a scaled ShieldFont scenario," Seneda says. "That is real money, even if it is still only cents per page."
The defense stops the cheap end of scraping—tools that grab text straight from code and never render anything. That is also the end that runs across millions of pages. But a headless browser that renders fonts reads a shielded article exactly as a person does. OCR and vision-language models working from screenshots do the same. In March 2026, LayerX Security published research showing that a substitution-cipher font could fool eleven AI assistants, including ChatGPT, Claude, and Gemini, into thinking a poisoned page was safe. Only Microsoft shipped a fix. Google closed its case after six weeks.
When researchers swapped about a quarter of a page's words, the meaning failed to survive in 55.8 percent of news passages tested. General web text sat close to half. Fiction held up better, near a third. Seneda and Abrucio do not claim the encoded text sails through quality filters. They are measured about their own numbers.
The real argument is about leverage. If ShieldFont can make scraping expensive enough—through dictionary rotation, per-site seeds, time windows, and increasingly complex puzzles—it might give writers bargaining power against large technology companies. "One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing," Seneda says. "We are already seeing people become more protective of their work, weakening the internet's collaborative nature." The benefit is primarily cultural: a tool that sparks debate around the ethics of AI training while making unauthorized harvesting riskier and costlier.
The code is free to take and build on. The font itself remains Playtype's property. A designer wanting to give away a font of their own has to build one on an open base. What ShieldFont offers is not invulnerability but friction—a small deterrent at scale, a price tag on the page, and an invitation for readers to donate their brain compute to help keep content from being stolen. In a world where machines are cheap and getting cheaper, Seneda argues, human cognition might be the last resource worth protecting.
Citações Notáveis
We think about the gap between what scraping costs today and what it would cost in a scaled ShieldFont scenario. That is real money, even if it is still only cents per page.— Isaque Seneda, ShieldFont co-creator
One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing. We are already seeing people become more protective of their work, weakening the internet's collaborative nature.— Isaque Seneda
Quer a matéria completa?
Leia o original em Help Net Security ↗
Technology