ShieldFont feeds AI scrapers gibberish while humans see the real page

Two designers have built a font that exploits the gap between what a browser renders and what a scraper downloads. Isaque Seneda and Gabriel Abrucio call it ShieldFont, and the premise is almost too clever: use ligatures — the typographic trick that swaps ugly letter pairs for polished glyphs — to quietly replace entire words in the underlying HTML. Humans see the real article. Bots scraping the raw source get a corrupted version where, as their white paper puts it, a horse might become a potato.

The mechanics are worth understanding. Ligatures normally exist to make text prettier, merging ‘fi’ or ‘fl’ into a single smooth character. ShieldFont weaponizes that feature. The substitution happens only at the render layer, so any scraper that pulls plaintext HTML before a browser draws it gets nonsense. End users never notice a thing. It’s a fundamentally different approach from robots.txt blocks or paywalls, which scrapers can simply ignore — ShieldFont doesn’t ask for permission, it just makes the stolen data worthless.

Seneda and Abrucio are refreshingly clear-eyed about the arms race they’re entering. Not all word swaps are equally effective. Swap common words for obvious synonyms and a smart scraper will reverse the substitution in minutes. Replace them with total gibberish and a filter might flag the text as corrupted and bypass it. The designers describe aiming for a middle ground: substitutions that look plausible enough to evade detection but degrade the training value enough to make the scraped data useless.

This lands in a legal landscape where OpenAI, Google, and others are already fighting lawsuits over training data, and publishers are deploying technical countermeasures with mixed results. ShieldFont is a different bet — that the best defense isn’t blocking scrapers but poisoning what they take. Whether scrapers adapt by rendering pages like a browser does, which would neutralize the trick entirely, is the obvious next question. For now, it’s a cheap, clever middle finger aimed at anyone hoovering up the open web.