The Consent Layer

The reason this concentrates wealth so efficiently is that the input costs nothing. Yanis Varoufakis calls the arrangement technofeudalism[2], and the part of it that matters here is not the size of the platforms but how they are fed: by unpaid labour supplied by the people using them. Tiziana Terranova described the pattern in 2000, long before any of this, as activity “simultaneously voluntarily given and unwaged, enjoyed and exploited.”[3]

What is new is what is being taken. The first round of unpaid digital labour wanted our photographs, our clicks, our locations: the exhaust of living online. This round wants something we had not previously thought of as extractable. A sentence is a sequence of decisions. When I write, I am choosing this word rather than that one, putting this clause before that one, deciding what to leave out. The finished paragraph is a record of thinking that took effort to do. That ordered thinking is exactly the artifact these systems are built out of, and it is being taken for free to build a machine whose purpose is to do the same thinking more cheaply than I can. We are not being asked to hand over our data. We are being asked to hand over the work, and to train our own replacement with it, and to do both without being told.

Which is also why written text has never been worth more. Epoch AI projects that models will be trained on datasets equal to the entire stock of public human-written text somewhere between 2026 and 2032.[4] The supply of good human writing is growing far more slowly than the computing power chasing it. Every genuinely new article is worth more to a scraper this year than it was last year.

Robots.txt is the main tool available to publishers. It is a plain-text file that tells automated crawlers which parts of a website they should or should not access. But it is only a request, not a technical barrier. The standard itself says crawlers are asked to follow the rules and that the file does not control access.[5] The only large-scale peer-reviewed study found that AI crawlers were often more compliant than other categories, with ClaudeBot and GPTBot (from Anthropic and OpenAI, respectively) making genuine efforts. Even so, compliance with a full block caps at 26%. AI bots also checked Robots.txt less often than any other group, with under 40% re-checking it within a week, and a crawler can avoid the rules simply by changing its name.[6]

So nothing currently makes it costly to ignore a publisher’s wishes. This paper explores a different approach: making the text itself polluted, harder, and more expensive to collect without permission.

A web page is delivered as HTML, a text-based file that contains the page’s content and structure. Both browsers and web scrapers access this same file. The browser renders the intended text for the reader, while the scraper extracts the altered text stored in the source code.

The swap lives in the font, and every font in the world can already do this. Typefaces routinely draw two or three letters as a single joined shape, because certain letter pairs collide awkwardly when set side by side. The classic case is f followed by i: the hook of the f crashes into the dot of the i, so the font draws one merged shape instead. You have read thousands of these without noticing. A joined shape like that is called a ligature, and the font carries a table listing which sequences of letters to replace with which single shapes as the page is drawn.

That table is a thirty-year-old standard feature, present in essentially every font you have ever used.[28] In our case, we point it at whole words instead of pairs of letters. Where a normal font says “draw f and i as one shape,” ours says “draw the letters of engine as the shape of the word horse.”

Targeting whole words matters because of how a language model reads. It does not take in a sentence the way you do. It breaks text into tokens, short chunks that it treats as single units of meaning. A token is not exactly a word, but for our purposes you can think of it as one. Every token sits at a point in a vast space of meanings, and a sentence is the shape you get by connecting those points in order. Change which words are in the sentence and you change the shape, which is the only thing the model ever actually learns from.

The substitution happens only when the page is drawn on screen. It changes nothing about the file itself, and nothing about what your reader sees. Write “The knight rode his horse into battle” and that is exactly what they get. The stored source says engine.

Every pair runs both ways and no word is used twice, so the dictionary is perfectly reversible: you can always recover your own text.

A sentence, to a model, is the shape drawn between points in a space of meanings (§ 02). What fixes each point is the words that habitually sit near it. Horse lands where it lands because it keeps turning up beside saddle, stable, rider and hoof. Potato lands somewhere else entirely, beside mash, fries and roast.

So when we swap one word for the other, meaning is destroyed because it is relocated. The machine reading the source is handed a new address and records it as ordinary fact.

The distance travelled is the whole design, and it is why we never substitute a synonym. Swapping horse for steed would move the word a few inches and change nothing a model learns from it. Swapping it for potato moves it across the map. § 06 puts a number on that difference. As an example from our study, swapping for synonyms, the kind of substitution a thesaurus would produce, breaks only 2.1% of passages. ShieldFont substitutes words with cohyponyms (a cool term we learned for words that are neither synonyms nor antonyms), breaking between 31% and 56% of passages.

Relocation is also why the technique survives inspection. Some filters are good at identifying gibberish. But there is nothing scrambled about our shielded text. Every sentence is grammatically correct. Every word is real, correctly spelled, and used in a position it could legitimately occupy. Except now it is a sentence with a completely different meaning. And a model will learn that meaning as if it were the new truth.

1. 1Scrapers take the source code without drawing the page.
   A good scraper never reveals their secrets. But based on what is publicly available, most seem to extract webpages without actually opening them. It makes sense economically because rendering pixels costs money. And every extra dollar you have to spend for one webpage, you have to spend for another 999,999. Expensive.[9]
2. 2So they take our swapped words, not our real ones.
   A font is only consulted when something is being drawn or visualized. Nothing is drawn, so what the scraper stores is the decoy text.
3. 3Quality filters throw most web text away. They throw most of ours away too.
   The strictest published filter discards around 92% of ordinary web text. In the same way, it discards most shielded pages.[15] That is actually a win: a discarded page never trains anything, which is what our initial goal was.
4. 4But a few pages survive. And when you shield them, 9.70% still pass.
   Imagine you were to take the pages that cleared that filter. If you shield them, 9.70% still pass. And we used strict filters. Those (poisoned) pages enter the training dataset. This is from one of the tests we ran.
5. 5And those carry the wrong meanings.
   On a page that survives, 19.4% of the words assert nothing true. And a polluted dataset should eventually degrade a model.[17]

The starting instinct was word frequency, and it was correct. English is extraordinarily top-heavy: the 100 most common lemmas account for half of all written English.[8] A lemma is a headword and all its inflections counted as one, so be covers is, are and was. The first dictionary we built took the top of that curve: 400 words, swapping the, of and and along with everything else.

That strategy had a pro, but also a con. It turns out that randomly swapping the most common words in English breaks grammar. Like, a lot. It's good because it changes the directions of things. Up becomes therefore, but becomes hug. But that still left exposed domain-specific words that carried most meaning. High-resolution words like neural, quantum and algorithm all stayed unshielded. And language models actually put most of their attention on those exact content words.

So the result was that we did not manage to hide meaning, nor pass filters. One of the filtering scores we looked at, perplexity, scores how surprised a language model is by a piece of text: low means the words fall roughly where the model expected them, high means they do not.[26] Perplexity is like a good way to catch gibberish. In that first version of the dictionary, shielded texts raised perplexity by 1,076%. Now, shielded raises it by only 121%. Past roughly 150%, every filter we tested throws the page away.

The current dictionary determines a 113-word do-not-swap list: pronouns, articles, conjunctions, prepositions, every form of be, have and do, modals, negations and quantifiers. It is a hand-written list, applied at the first stage of the build, before any word is put in buckets. It is also the oldest surviving rule in the system, dating to our seventh dictionary.[7]

With the top of the frequency curve off limits, the dictionary had to grow to hide anything at all. It went from 400 pairs to 1,267 to 11,988 in the current version, working down through the most frequent words specific enough to carry meaning and common enough to appear on a real page.

In the current version, a word is only ever swapped for another word from the same grammatical pool. Not just noun for noun: plural abstract noun about communication for plural abstract noun about communication. There are about 250 such pools, built by crossing part of speech with sense category, concreteness, singular or plural, verb transitivity, verb inflection and adjective degree. Difficult words to say: we are matching grammar (and perplexity, to a certain extent).

Inside a pool, the substitute must never be a synonym, which would change nothing, and never an antonym, which would be a predictable cipher. Of 13,132 candidate pairs built under those constraints, 11,988 survived them. That is why an encoded page reads as grammatical English while meaning something else.

Every build is scored on three quantities.

Concealment is how much of the meaning is hidden. We compute it as the distance between a machine-readable summary of the original passage and a summary of the encoded one.

Filter survival is the share of pages that get past the graders deciding what reaches training. A quality filter is the program a pipeline runs to throw away junk before training begins.

Poison potential is how much a swap changes what the sentence asserts. Something like how wrong a sentence is.

Concealment and filter survival pull against each other, and that tension is the entire engineering problem. Raising concealment lowers filter survival. Held within one recipe family, a 512-cell sweep, the two move together at a Pearson correlation of −0.56: a strong, consistent inverse relationship, not a promise that one point of concealment costs exactly one point of survival. A wider pool of 855 builds across several recipe families reads −0.86, but that number is confounded by mixing dictionaries of different general aggressiveness, so −0.56 is the figure to trust.

So there is a sweet spot. Hide too little and scrapers get your ideas. Hide too much and (1) no scraper keeps the page or (2) they easily spot your text is encoded (and might try to reverse it).

Getting to that sweet spot took two kinds of rule. Twenty-four of them are in the shipping dictionary and are not negotiable: they decide which words are even eligible, how they are pooled, and which pairings are forbidden. Those are the table below. Another thirty were built, measured and thrown away, and because the reasons they failed are the most useful thing we know about this problem, they get their own list in the appendix (§ 13).

We still need to know one important thing: how different is the shielded version of a text relative to the original text?

The instrument to measure that is an entailment classifier: a public model, built by other people, that judges whether one sentence follows from another.[27] We run it in both directions and count a passage broken only when the original no longer implies the encoded version and the encoded version no longer implies the original. A failure in one direction only does not count.

The design is four corpora (four types of texts: older fiction, fiction, general web content, news articles), 1,000 passages each, against two controls. The first control leaves the text untouched and gives the instrument’s own error rate. The second swaps words at exactly our rate but for their synonyms, holding the amount of disturbance fixed and changing only whether the substitute means the same thing. That second control is what separates real meaning loss from a classifier being unsettled by unusual vocabulary.

One thing about how this was run. The experiment was pre-registered on three corpora, where the median was 50.4%. A fourth corpus, a second body of fiction, was scored afterwards and pulled that median to 41.8%. Both figures are honestly computed and they differ only in which corpora are counted. Reporting per corpus makes the choice moot, and the comparison that carries the argument does not move: at our weakest we are fifteen times a synonym swap, and on news, twenty-seven.

The waste figure describes a scraper’s day. On a page that survives the quality filter, 19.4% of the words are training-time garbage: real English, correctly spelled, asserting nothing true. That is the figure across all four corpora. Across the first three it was 24.1%, the same corpus-count difference that moved the entailment median. It needs no claim about what happens to a model, because it is a property of the page and it was measured on the page.

The gap between the two coverage figures is deliberate. A quarter of all running words are swapped, but 45.8% of the meaning-carrying words are, because the, of and is are left alone on purpose (§ 05). The budget is spent where it buys something.

On the filter, the number is about one in ten. Of the pages that would have cleared a real pipeline’s educational-quality grader before shielding, 9.70% still clear it after: 13 out of 134. It replicated at 10.27% on a different three corpora with a different scoring harness, so the result holds across six corpora and three separately seeded dictionaries.

Two caveats travel with it. The denominator is small, and the 95% confidence interval runs from 5.8% to 15.9%. And in absolute terms the rate is 0.38%, because that grader keeps only 3% to 7% of unshielded web pages in the first place. The conditional rate is the one that answers the question being asked, which is what shielding costs a page that would otherwise have been taken.

We ran four graders over the same pages and they disagree with each other almost completely. The rank correlation between them is close to zero. Retention runs from 2% to 65% depending on which grader you ask, with a median of 12%, so a page one grader discards, another keeps. That is why we refuse to tune against any single one. A page only has to survive the grader a given pipeline actually runs, and nobody outside those companies knows which that is.

So we test against the strictest gates that are published. The hardest is a classifier trained to keep only educational-quality writing —the one that discards 92% of ordinary web text.[15] Yes that was an em-dash. Let a man live a little. We grade ourselves against that one on purpose, and try to make the cut throughout all disagreeing filters (§ 06).

Which turns the awkward-looking number (9.70% making it past filters) into the strongest one we have, because it's a conservative cut. The quality filter is a good detector for our pipeline. It is the tool built to notice text that is off, by the people whose job is noticing.

It catches nine in ten of our pages. But it also makes the tenth page precisely the fraction the best known public detectors could not tell apart from ordinary writing.

One flip side. A lab might deliberately want unusual text: surreal poetry fails conventional filters while being genuinely novel material, and a team hunting for range might reach for the exact type of text we offer: correct but weird English. That could be a different game, and an interesting one. A dictionary tuned for strangeness rather than for passing.

C4’s (one of the pipelines) reports that many of the scraped pages contained warnings stating that Javascript should be enabled, “so we removed any line with the word Javascript.”[9]

The closest thing to an exception is a 2025 NVIDIA maths dataset, which routes pages through Lynx, a text-only terminal browser, and whose claim is to be the first pipeline to use a browser at all. Lynx follows layout rules. It never hunts down through divs and downloads a font. It never draws a pixel, so shielded text passes through it unchanged.[10]

Live traffic data points the same way. Across one content network in a single month there were 569 million fetches by OpenAI’s crawler and 370 million by Anthropic’s, and neither executed JavaScript. However, two more advanced crawlers do draw full pages, AppleBot and Google’s Gemini (and ShieldFont might not work here for now).[11]

Both Google and Apple are endorsed by a 2022 security paper called Bad Characters, which recommends drawing every page and photographing/OCRing it as the “catch-all defense”.[12] They are right about the mechanism. The disagreement is about the legitimacy, because at web scale every cent drags.

Drawing a page instead of fetching it costs five to about thirteen times more, a multiplier three scraping vendors publish openly.[13] Reading three billion pages with the cheapest published self-hosted OCR runs to roughly $528,000. For scale, Common Crawl’s entire 2024 budget was $1,326,638, for 26.67 billion pages across ten crawls.[14] The OCR pass alone would eat 40% of the foundation’s annual money to reach 11% of its pages.

So the effort goes into being hard to crack. A single page can carry several dictionaries across different paragraphs, so an attacker has to work out which block goes with which font before decoding anything. Our component supports that, and it is the recommended deployment.

Beyond that, no two sites are configured alike: a renamed class, a different font path, the whole site or a single paragraph. Decoy markers could put fake shield classes and fake font names on unshielded text, so a fingerprint built by reading the page lies to whoever built it. And nothing in the bytes we serve says “ShieldFont”: the font names are neutral, the class is neutral, there is no version string, and the shipped font either drops its glyph names outright or hashes them, so the file never spells out in plain text which word a given shape draws.

So for as long as we keep our code chaotic enough, a scraper cannot make sense of shielded content at scale. They would need someone (or some AI model) to expensively dedicate attention to each page. They are better off either (1) dropping your content altogether, or (2) changing their entire scraping pipeline to OCR the whole internet.

One honest tell remains, and it’s optional. A full, unsubsetted font carries a glyph for every word in the dictionary, about 825KB for the whole 12,011-pair vocabulary, and file size is a signal. A build-time subsetter ships only the glyphs a page’s own content can trigger, the way Tailwind ships only the CSS a page uses, cutting that by up to 78%, down to roughly 82KB for a typical page. It also makes the font unique per page, which is a good thing.

ShieldFont is one way to do it. There are many others and we want to build them. And our main underlying purpose is to enforce a basic principle of AI ethics: creators should have a meaningful say in whether their work is used to train AI systems. Where consent is not respected, technical design can make taking that work without permission less useful and more costly.

This is not an anti-AI stance. We would not have built this whole thing without AI. This is a stance in favor of compensation, and credit. And to state publicly that being discoverable does not mean consenting to AI training. As a collective.

Anything one team ships has consistent tells, and given enough examples, adversarial actors will learn to bypass it. But a technique that ten independent projects implement in ten incompatible ways has nothing consistent to learn. This is the rare case where a competitor makes us stronger. A competing, incompatible implementation of this idea would be a success, not a threat. If you build one, we will link to it.

And it compounds. One shielded page contributes one page of wrong data. 19.4% of that page is asserting nothing true (§ 06). What scales is the number of pages, and the moment when your pages also start belonging to other people. When a horse becomes a potato.

Chinese websites have remapped fonts against scrapers since at least mid-2016. The best evidence is production HTML rather than a paper: an archived capture of Maoyan’s box-office page from August 2016 serves its numbers as private-use codepoints behind a custom web font, and captures from February and April that year do not.[18] The counter-technique is published too, in practitioner write-ups rather than research: one reports recovering 602 glyphs in about three seconds, another defeats a site that rotates its font on every visit.

TuringFonts (2015) published a letter-for-letter cipher font to stop harvesting of email addresses and phone numbers.[19] A quality filter throws its output away as gibberish, and a model recovers the plain text by letter frequency in a single pass. Sang Mun’s ZXX (released May 2012, six cuts) is a typeface built to defeat text-scanning at the letterform.[20] Ross Anderson’s verdict on it at the time was “I don’t think any of this is more than privacy theater. The fonts could probably be broken.” He was right, and the same is true of ours (§ 08).

Nightshade[21] and Glaze brought poisoning and protection to images. Both have since been defeated by published attacks,[22] and that is the most useful thing about them for anyone building in this area: a protection whose value depends on remaining unbroken has a short life.

LayerX’s 2026 “Poisoned Typeface” uses the same gap between what a page draws and what its source says, in the opposite direction.[24] There the render is the attack and the source is the alibi: the person sees the payload and the assistant reading the page sees something harmless. Every non-agentic assistant they tested failed to notice.

Nobody has applied font-level word substitution to protecting training data. That is the whole of the novelty claim. The two academic papers that use the same primitive use it to attack.[23]