ShieldFont deployed to disrupt AI web scrapers by poisoning training data

Designers Isaque Seneda and Gabriel Abrucio have released ShieldFont, a typeface engineered to disrupt artificial intelligence web scrapers. The font renders webpages readable for human users while substituting approximately 24.5 percent of words with nonsensical ligatures in the underlying HTML. This technique aims to poison training data or trigger scraper quality filters, effectively enforcing an opt-out from unauthorised AI training.

The font is based on ligatures, a long-standing feature usually used to replace letter pairs for readability. With ShieldFont, these ligatures replace entire words with semantically unrelated terms that share similar parts of speech but occupy a different informational context, such as swapping “horse” with “potato”. This substitution occurs only when the font engine draws the page on screen, meaning scrapers downloading plaintext source code receive an altered version that end users never see.

The creators refined a word-swapping dictionary over three months, resulting in nearly 12,000 common words that can be replaced. Publishers can choose from three different mappings for each word replacement, encode their own, or swap mappings between paragraphs to avoid detection. On average, ShieldFont replaces 24.5 percent of all words on a page, including 45.8 percent of “content words”.

In testing on six publicly available scraper pipelines, over 90 percent of pages that would otherwise be accepted were rejected by quality filters. Of the pages that still get accepted, nearly 20 percent of component words are described as “training-time garbage,” meaning they are real English words that assert nothing true. This ensures that both dropped and kept pages disrupt the value of the collected data.

While ShieldFont pages remain readable for humans, the altered HTML may disrupt search engines, screen readers, copy/paste tools, and translation software. The method can be bypassed by scrapers using optical character recognition on rendered images, though this increases costs by five to 13 times compared to standard HTML scraping.