What happened?

AI companies' penchant for scraping through large swaths of the public web in search of valuable training data has already led to lawsuits and to technical fixes aimed at stopping the practice. Now a pair of designers hopes to stymie those scrapers with a new font.

ShieldFont, as designers Isaque Seneda and Gabriel Abrucio write in a recent white paper, was made to offer web publishers "a practical opt-out from unauthorized AI training and [to] disrupt what is collected when that choice is ignored".

When is a horse a potato?

The font is built around ligatures, a long-standing feature of many fonts usually used to replace certain letter pairs with a more readable version when they are pushed up against each other. With ShieldFont, those ligatures are instead used to replace entire words with others, in an attempt to destroy the text's value to scrapers.

The substitution only happens when the font engine draws the page onscreen, meaning scrapers that simply download plaintext source code get an altered version end users never see.

Calibrating the substitution

When it comes to fooling AI scrapers, not all ligature-based word replacements are created equal:

  • Synonyms or antonyms: too easy for a smart scraper to reverse.
  • Completely unrelated gibberish: easier for a smart scraping filter to detect, and potentially circumvent.
  • ShieldFont's choice: words of a similar part of speech that occupy a completely different informational context — swapping "horse" for "potato".

The result is a scrapable sentence that looks semantically correct but has a completely altered meaning. Even altered pages that get through a scraper's quality filter therefore contain scrambled informational content that can poison a training data set.

Why does it matter?

The approach sits somewhere different from methods like robots.txt that depend on voluntary compliance. A publisher using robots.txt says "do not scrape" and waits for the scraper to honour that request. ShieldFont is designed for the case where the request is ignored: if it is, the value of what is collected drops.

The two halves of the designers' phrasing capture that distinction: offering "a practical opt-out" and disrupting "what is collected when that choice is ignored".

Where the method stops

ShieldFont protects only the text drawn by the font. Images on the page, heading tags, structured data blocks and the metadata in a page's source code all fall outside that protection — meaning a scraper can work out what the page is about from elsewhere, even without noticing the text was scrambled.

Another practical question is copy and paste. When a user copies the text they see on screen, what reaches the clipboard is the underlying text rather than the drawn one, so a sentence a reader quotes may come out scrambled too. How that behaviour is handled is not stated in the report.

What is not settled

The designers say they refined their word-swapping dictionary over three months. There is no independent measurement of how well the method holds up against real scrapers, and whether font-based substitution can be detected and worked around remains an open question.

Accessibility is a separate heading: screen readers read the page from the underlying text, not from what the font engine draws. That means blind users could hear the scrambled text too; how the white paper addresses this is not stated in the report.