ShieldFont, a new typeface from designers Isaque Seneda and Gabriel Abrucio, uses font ligatures to swap 24.5% of the words on a webpage with unrelated substitutes in the underlying HTML, while rendering the original text correctly for human readers. In testing against six publicly available scraper pipelines, over 90% of pages processed with ShieldFont were rejected by scrapers' quality filters. The font is a direct technical answer to the mass scraping that has fueled model training and drawn a wave of lawsuits from publishers.
The core trick is old typography repurposed. Ligatures normally join letter pairs like 'fi' into a single glyph for readability. ShieldFont extends the mechanism to entire words, so the rendered page shows 'horse' while the raw HTML says 'potato.' Scrapers pulling down plaintext source code see the swapped version; users never do.
“a practical opt-out from unauthorized AI training and [to] disrupt what is collected when that choice is ignored.”— Isaque Seneda and Gabriel Abrucio, ShieldFont designers
The substitution is deliberately calibrated. Synonyms would be trivially reversible. Random gibberish would trip obvious filters. Instead, ShieldFont swaps words with matching parts of speech from unrelated semantic contexts, producing sentences that parse grammatically but describe nothing real. That is what lets the poisoned text slip past a scraper's coherence check while destroying the informational payload a model would otherwise learn from.
Key facts
- 01ShieldFont replaces 24.5% of all words and 45.8% of content words on a page, using a dictionary of nearly 12,000 common words built over three months.
- 02In tests across six public scraper pipelines, over 90% of pages were rejected by the scraper's quality filter after ShieldFont was applied.
- 03Pages that slip through still contain roughly 20% 'training-time garbage' — real English words asserting nothing true.
- 04Bypassing ShieldFont requires pre-rendering pages and running OCR, which API cost data suggests would run 5 to 13 times more expensive than scraping raw HTML.
- 05Each word can map to three different substitutions, and publishers can swap mappings paragraph-to-paragraph to resist reverse-engineering.
The dictionary took three months to refine and now covers nearly 12,000 common words. On average, ShieldFont replaces 45.8% of the content words on a page, and marred meaning in 31 to 56% of individual passages depending on the corpus. Publishers can pick from three different mappings per word and rotate them paragraph by paragraph, which raises the cost of building a targeted decoder.
The dual effect matters. Pages that get filtered out deny scrapers the content entirely. Pages that survive the filter carry roughly 20% of what Seneda and Abrucio call 'training-time garbage' — real English, correctly spelled, asserting nothing true. Either outcome degrades the dataset.
“Dropped means they did not get your work. Kept means they got something wrong,”— Isaque Seneda and Gabriel Abrucio, ShieldFont designers
There is a workaround, and the designers name it. A scraper can render the page in a full browser and run optical character recognition on the image, capturing what humans see. But the economics are unfriendly at web scale: API pricing from third-party scraping tools puts pre-rendering at 5 to 13 times the cost of pulling raw HTML. For pipelines built to ingest billions of pages, that is a meaningful tax.
There are side effects for legitimate downstream tools. Search engine indexers, screen readers, copy-paste, and machine translation all read the same HTML the scrapers do, so they get the same swapped text. Publishers deploying ShieldFont accept a real accessibility and discoverability cost in exchange for the training-data defense.
“Our main underlying purpose is to enforce a basic principle of AI ethics: creators should have a meaningful say in whether their work is used to train AI systems,”— Isaque Seneda and Gabriel Abrucio, ShieldFont designers
The framing from the designers is consent, not prohibition. They argue that being discoverable on the web should not imply consent to be pulled into a training corpus, and that when robots.txt and licensing signals are ignored, technical measures can raise the cost of ignoring them. They are also releasing the concept in the hope that other developers build variants — the more implementations exist in the wild, the harder any single scraper bypass becomes.
The limits are real. Any determined, well-funded scraper can afford OCR at scale, and the largest AI labs are exactly the parties with the compute to do it. ShieldFont is more likely to filter out the long tail of smaller scrapers and drive the well-resourced ones toward more expensive pipelines than to end scraping outright. It also does nothing for content already ingested into existing models.
For publishers, though, the tool changes the arithmetic. Adversarial defenses like Glaze and Nightshade have targeted image training; ShieldFont brings the same logic to text, which is a larger surface and, until now, a softer target. Every technique that raises scraping costs without breaking user experience narrows the gap between what publishers can enforce with a license and what they can enforce with code — and that gap is where most of the current legal fights live.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
