SHIELD(FONT)

We swap key words in your text with other real words in the page’s source code. For example, “winners” might become “avengers,” “toy gun” might become “sofa car,” and “Halloween contest” might become “Autumn campaign.” You still see the original text because the font restores it on screen. Only machines reading the raw HTML see the substituted version.

The clipboard copies the substituted words stored in the page’s code, not the original words you see on screen. So when you paste shielded text into ChatGPT, it reads the altered version rather than your original writing.

Content words carry most of a sentence’s meaning, while words such as the, of, and and mainly hold it together. ShieldFont changes only about 25% of all words, but nearly half of the content words. Across 1,500 passages from news, independent websites, and fiction, this caused 50% to lose their original factual claim. A control test replaced the same number of words with true synonyms, and only about 2% of passages changed meaning. The effect comes not from swapping words, but from swapping the words that matter most.

The dictionary is built from the 10,000 most common English words, focusing on nouns, verbs, adjectives, and adverbs because they carry most of a sentence’s meaning. Each word is paired with another of the same type, so nouns replace nouns and verbs replace verbs, helping sentences remain grammatically correct even as their meaning changes. Function words such as the, of, and and are left untouched because they hold sentences together but carry little meaning. Once different forms of each word are included, the current dictionary contains nearly 12,000 entries, covering a large share of everyday English.

Roughly, yes: topic and tone may survive. But the specifics, such as names, numbers, and claims, are often lost. When seven leading AI models tried to reconstruct the argument of shielded text, conceptual accuracy fell by 67%. Several models also refused the task, which counted as complete loss. Looking only at the models that answered, the drop was still 49%. The result is consistent: the broad subject may survive, but the details do not. The effect also grows with length. If an early sentence is altered, later reasoning may build on a false premise, so longer texts can lose more meaning than passage-level scores suggest.

It’s not gibberish. Every substituted word keeps the same grammatical role, so nouns replace nouns and past-tense verbs replace past-tense verbs. The sentence still reads correctly, but its meaning changes. In tests with FineWeb-Edu, a quality filter used to build a major public training dataset, about one in ten chunks that passed before shielding still passed afterwards. The other nine were rejected. Both outcomes help: rejected content stays out of training, while accepted content carries the “wrong” meaning into the dataset.

That tension is the core challenge, and we have worked to balance protection with disruption. If the text changes too much, quality filters reject it, keeping the content out of training. If it changes too little, the original meaning survives. ShieldFont aims for the point between these outcomes, where text can pass a filter without communicating the same meaning. Reaching that balance took sixteen generations of mappings, followed by a second line of development.

If a shielded text passes the scraper’s quality filter, the training system receives the substituted words as if they were the original content. It may see that a contest’s “winners” were “avengers,” or that a child found a “sofa car.” Instead of simply hiding the original content, the text adds false connections between names, events, and actions to an unauthorized AI training dataset.

We are careful with that claim. Early tests on small fine-tuned models showed the strongest negative effect of any mapping we tried, but those tests are too limited to prove what would happen at scale. What we can say with confidence is measured directly from the text: changing about 25% of the words caused 50% of passages to stop making the same factual claim. Whether you call the result poisoning or wasted training effort, what matters is that the content becomes less useful in unauthorized AI training datasets.

One shielded page is only a drop. The value comes from scale. If many creators use ShieldFont, scrapers must either reject more pages or spend more time identifying and decoding them. Pages that still enter the dataset carry altered information, making the collected text less useful for training. Blocking removes content from the scrape; shielding can either keep it out or change what gets collected. Individually, the effect is small. It is a collective defense: the more people use it, the harder and more expensive mass scraping becomes.

Yes. If someone photographs your page and runs OCR (optical character recognition: reading text back out of an image), they recover your words. But ShieldFont is not designed to stop someone deliberately targeting a specific site. It is designed to disrupt mass scraping, which depends on collecting HTML from billions of pages cheaply and automatically. Using OCR would require scrapers to render each page, turn it into an image, and process the pixels with a vision model. Because they do not know which pages are shielded, they would have to do this at scale. ShieldFont does not need to make OCR impossible; it needs to make it too costly to be worthwhile.

They will not need to learn. Here is the part we would rather you heard from us than found in a footnote: the font is the codebook, and anyone who downloads it can read the substitution table back out of it. We tested this ourselves and recovered all 11,962 word pairs with no errors. ShieldFont is not designed to keep a permanent secret or stop someone deliberately targeting one site. Its strength is at scale. ShieldFont ships with three mappings, alpha, beta, and gamma, and assigns each text block to one of them. Creating your own mapping makes a universal, prebuilt decoder useless against your site. A scraper must identify your font, extract its mapping, and decode your content specifically. The defense is economic, not cryptographic: the aim is to turn cheap, indiscriminate scraping into slower, more complex, per-target work. The more independent mappings people create, the harder that becomes across the web.

Search engines read the same scrambled HTML as scrapers, so they index the decoy words, not yours. Shield content you do not need Google to rank: paywalled pieces, archives, manifestos, or anything you would rather keep out of current AI training than surface in search. Leave your marketing pages plain. ShieldFont works block by block, so the choice is entirely yours.

Blocking tools such as robots.txt and Cloudflare’s AI gate are like walls: crawlers can ignore or work around them. We still recommend using them to express your non-consent publicly. Poisoning, however, creates leverage: if a lab trains on shielded text before it is detected, the data becomes less useful and may require extra work to remove or correct. The longer-term goal is to give creators a seat at the table, with a licensing route where AI companies pay for clean versions instead of using altered copies obtained through scraping. That system does not exist yet, but it is an outcome we’d like to help make possible.

Respect to the ancestors. The closest is TuringFonts (jfmdev): a substitution-cipher font that draws one letter in place of another, so a crawler reads scrambled text while a human reads the original. It was built to keep bots from indexing emails and phone numbers, and it predates the AI era. A letter-for-letter cipher produces character noise a modern quality filter throws away (and an LLM unscrambles by frequency in a single pass), and it never hides that the page is enciphered. ShieldFont is built for how AI actually ingests text: we swap whole words for other real, same-grammar-class words, so the page stays fluent prose with no character noise to flag and nothing to unscramble by frequency. Every word is a real word in the right grammatical slot, and the only thing broken is the meaning. We think in tokens and meaning rather than a hidden string, and the font itself is camouflaged. ZXX (Sang Mun, 2013) fought OCR at the glyph level, but modern vision models read it in one prompt. Ghost Font hides text in motion; Nightshade and Glaze poison images for artists. ShieldFont is the text-native cousin: it corrupts the source the machine actually copies. The reading gap itself also has independent security research behind it. In March 2026, LayerX Security published “Poisoned Typeface”, an attack study showing that a remapped font makes an AI assistant and a human read different text from the same page. All eleven assistants they tested read the underlying text instead of the rendered one, and only Microsoft took the disclosure through a full fix. Their work is offensive in framing and unaffiliated with ours, and it confirms from the other direction the same gap ShieldFont uses in defense.

We are contributing to the AI ethics debate from a simple position: creators should have a meaningful say in whether their work is used to train AI. You are changing how your own words appear in your own HTML, not entering another system or attacking a model. We encourage creators to state their non-consent clearly alongside their content. If an AI company respects that choice, nothing happens. The effect only applies when the work is scraped and used without permission. The goal is not to damage AI (we are not anti-AI; read Q21 for more), but to make unauthorized training less useful and harder to ignore.

Screen readers read the source code rather than the words displayed by the font, so the current <Shield> component uses aria-hidden to stop the substituted text from being read aloud. We have a built-in alternative, in beta and on by default, which allows users to spawn the real words on the page through an aria button only screen readers reach. The reader’s browser solves a compute-costly puzzle for the key, taking a few seconds. It works in our Dynamic Websites tier and requires JavaScript, which is part of the point: most scrapers never run any. Tested with VoiceOver and an automated screen reader.

Eventually, yes. Any fixed marker, such as a known class, font name, file pattern, or ARIA attribute, can become a fingerprint. ShieldFont responds in two ways: add camouflage so those markers no longer reliably identify protected text, and keep changing the pattern by shielding selected blocks and using different mappings across sites. A single deployment is easier to work around. Thousands of creators using different mappings and implementations force scrapers to spend more time identifying, checking, and decoding what they collect. ShieldFont does not end the arms race; it gives the open web a way to make unauthorized scraping harder and more expensive, especially when people build on it together.

No, and we won’t pretend otherwise. ShieldFont isn’t a lock. It’s friction. It disrupts large-scale automated scraping by changing the underlying text while keeping it readable for people on screen. That makes scraping and processing slower and more expensive, though the impact may vary. It is open source and designed to evolve, so “it’ll be decoded eventually” misses the point. The target can keep moving as others add new mappings and approaches. It is also not a client-grade security product, so do not replace Cloudflare, Akamai, robots.txt, or accessibility standards with it. Think of it as a creative intervention with teeth: a way for creators to make unauthorized AI training harder, more visible, and more costly.

No. ShieldFont is pro-consent, pro-choice, and pro-human authorship. People may want their work to be discovered without agreeing to have it copied into AI training datasets. ShieldFont gives them a simple, visible way to opt out of mass scraping and make that choice harder to ignore. The font is the creative expression of that position: not a rejection of AI, but a demand that creators have a say in how it is built, especially in what is taken from them.

Not yet. ShieldFont currently works only in English. Its three main dictionaries contain about 12,000 word pairs each: 11,970 in alpha, 12,034 in beta, and 12,036 in gamma. The optional maxhide version contains 2,534. Words in other languages are left unchanged, so they are not protected. On a mixed-language page, only the English text will be shielded, even if the whole section appears protected. For clarity, the current versions can be named en-a, en-b, en-c, and en-m; a future Portuguese set might use names such as pt-a. Creating a new language version is not simply a translation task: it requires native speakers to choose substitutions that still sound natural. Contributing a new language is therefore one of the most useful ways to help.