ShieldFont targets AI scrapers with font-level text poisoning
ShieldFont uses OpenType substitutions to show humans one text while feeding AI scrapers altered copy, with clear SEO and accessibility tradeoffs.
By Dominic Okoye · Staff Writer
· 3 min read
ShieldFont targets AI scrapers with an open-source font technique that makes a web page look normal to readers while presenting different wording in the underlying text that bots may collect. Amsterdam design studio Seneda & Abrucio, working with Copenhagen type company Playtype, released the project as a deterrent for publishers and site owners that do not want to rely only on server blocks or robots.txt requests.
The project is designed to alter meaning without turning a page into obvious junk. According to ShieldFont’s white paper, substitutions are drawn from tightly matched word groups, so a noun is replaced by another noun, a verb by another verb, and other traits such as plurality, concreteness and inflection are also considered. The creators say there are about 250 such pools, and roughly one quarter of the words in a passage may be swapped.
How does ShieldFont fool AI scrapers?
ShieldFont uses the glyph substitution system built into OpenType fonts. That system is usually used for ligatures, such as replacing a sequence of letters with a cleaner combined glyph. ShieldFont extends the idea from letters to whole words: the HTML can contain one word, while the font renders another word for the human viewer.
That means a scraper reading raw page code may ingest the substituted text rather than the text a person sees in a browser. In one demo described by the project, a sentence typed into the encoder is transformed into odd but syntactically plausible wording rather than random characters. The goal, Seneda & Abrucio said, is to add uncertainty to scraped training data, not only to make a bot discard a page.
The implementation is not especially large by software standards. Seneda & Abrucio said ShieldFont document and desktop fonts are about 5 MB, while compressed web fonts that include the full substitution dictionary are about 800 KB. The web files are large compared with typical fonts, the studio said, but much smaller than the desktop version.
ShieldFont ships with three substitution dictionaries. Its GitHub repository also describes how users can create their own mappings, a step meant to make reverse-engineering less straightforward. The default font is based on a modified version of Optik from Playtype.
What are the limits of ShieldFont?
The creators do not present ShieldFont as a hard block against determined scraping. A scraper can avoid the poisoned HTML by taking a screenshot and using optical character recognition, or by collecting what is visually rendered rather than what appears in the page code. A targeted system could also download ShieldFont and test its dictionaries to decode the substitutions.
The tradeoffs are material for anyone considering production use. Search engines read raw HTML, which means ShieldFont could affect search visibility. Translation tools and operating-system copy-and-paste functions may also pick up the altered text. Screen readers can have difficulty as well, although the project includes a feature intended to let them retrieve the displayed text, with a speed penalty.
Seneda & Abrucio described ShieldFont as working today but still at v0 alpha. The studio said the point is to raise the cost and uncertainty of unauthorized mass scraping, especially if many sites adopt similar defenses. The project is available through an online demo encoder, as a React component, and through CSS and CDN integration, with setup details published on ShieldFont’s site and GitHub page.
This story draws on original reporting from The Register.
