A new open-source tool called ShieldFont tricks AI scrapers into ingesting poisoned text by displaying one thing to human readers while feeding completely different words to bots that harvest web content for training data. Created by Amsterdam design studio Seneda & Abrucio in partnership with Copenhagen typography shop Playtype, the project was announced this week. The font makes pages appear normal to visitors but replaces roughly a quarter of words in the underlying code with different terms from the same grammatical category, turning phrases like "good luck reading this, you useless robot" into "good comfort reading this, you yellow barrier" in the raw HTML.
The substitution follows strict grammatical rules to avoid detection by scrapers designed to reject obvious garbage. Nouns swap only for nouns, verbs only for verbs, and the system goes deeper than basic parts of speech. The creators built around 250 pools that cross part of speech with sense category, concreteness, singular or plural status, verb transitivity, verb inflection, and adjective degree. A word like "daughter" in the source code might render as "journalist" when displayed to readers. The modified desktop fonts weigh in at roughly 5 megabytes, while compressed web fonts with the full substitution dictionary reach about 800 kilobytes. Three different dictionaries ship with the project, and users can build custom versions to prevent reverse-engineering.
The goal isn't to make scrapers reject the text outright, according to Seneda & Abrucio, but to introduce "uncertainty and chaos into training data" so that companies can't tell whether harvested content is genuine. "Pure scrambling fonts already existed," the designers explained. "We wanted a mechanism with actual consequences: scrape without asking, and you can't tell if what you took was real." The system works by extending OpenType font ligature tables, which normally substitute single letters or character pairs, to swap entire words instead. Even Google Docs supports basic versions of this glyph substitution feature for special characters.
The technology has significant limitations that the creators acknowledge openly. Screenshots run through optical character recognition bypass the poisoned HTML entirely, as do any scraping methods that capture what users actually see rather than raw code. AI systems that download ShieldFont and run all three substitution dictionaries can decode protected pages. Search engines read raw HTML just like scrapers do, which could hurt SEO rankings, and translation apps, copy-paste functions, and screen readers all struggle with the swapped text. The purpose "is not to stop a determined actor, but to slow unauthorized mass scraping by adding cost, friction and uncertainty," the designers said in a press release.
The long-term strategy relies on collective adoption rather than technical perfection. If enough websites deploy ShieldFont or similar protections, scrapers face mounting costs to verify and clean their data, which could force them to negotiate permission rather than harvest indiscriminately. The project is currently in alpha stage but fully functional, available as an online demo encoder, React component, and through CSS and CDN integration. Whether it becomes a widely adopted defense or remains an experimental deterrent depends on how many publishers decide the tradeoff between protecting their content and accepting accessibility and SEO penalties is worth it.