ShieldFont: Open Source Project Uses Poisoned Fonts to Defend Against AI Scrapers
Key Takeaways
- ▸ShieldFont uses OpenType font-level manipulation to corrupt text for AI scrapers while keeping content readable for humans through grammatical word substitution
- ▸Approximately 25% of words are replaced with compatible alternatives from ~250 grammatical pools (e.g., plural abstract nouns about communication only swap with other similar abstract nouns)
- ▸The technique extends glyph substitution (GSUB) from single characters to entire words, enabling word-level substitution while keeping font files relatively small
Summary
An open-source project called ShieldFont has launched to protect website content from unauthorized AI scraping by poisoning data at the typography level. Created by Amsterdam-based design studio Seneda & Abrucio in partnership with a typography company, the tool manipulates OpenType fonts to replace words with grammatically similar alternatives that fool LLM scrapers while remaining perfectly readable to humans.
The technique leverages glyph substitution (GSUB) tables—a font feature traditionally used for typographic ligatures—to automatically substitute roughly 25% of words before scrapers can read the raw HTML. ShieldFont maintains text coherence by swapping only between words of compatible grammatical categories, spread across approximately 250 linguistic categories accounting for part of speech, abstractness, singular/plural status, verb transitivity, and verb inflection. This ensures the poisoned text appears 'unusual but sensible' to LLMs—coherent enough to be ingested for training but degraded enough to reduce utility.
The open-source solution offers a new defense mechanism against AI training without relying on robots.txt compliance or server-side blocking. Even when scrapers reject the poisoned content entirely, users win by protecting their work from unauthorized training data extraction.
- Poisoned text appears coherent enough for LLMs to ingest but degraded enough to reduce training value
- ShieldFont represents a client-side defense requiring no robots.txt compliance, server-side filtering, or reliance on scrapers respecting opt-out protocols
Editorial Opinion
ShieldFont is a creative and accessible defense against the unauthorized commodification of online content for AI training. However, its long-term effectiveness depends on whether scrapers evolve to handle grammatical-constraint poisoning. Without enforceable legal frameworks protecting content rights, this represents one skirmish in an arms race that will likely intensify indefinitely.
