ShieldFont: the font that turns pages into gibberish for AI scrapers

The mass harvesting of web content to train AI has already led to lawsuits and technical countermeasures. The latest response is a font called ShieldFont, created by designers Isake Seneda and Gabriel Abrusio. The idea, laid out in their white paper, is simple: the page stays perfectly readable for a human, but a scraper that downloads the raw HTML as plain text gets a substituted, meaningless version.

When a horse becomes a potato

At its core are ligatures — a long-standing typographic feature that usually replaces pairs of letters with a tidier glyph. In ShieldFont, ligatures swap whole words for other words, but only at the moment of rendering on screen. The reader sees the correct text, while the source code retains the fake.

The authors ruled out simple synonyms and obvious gibberish: both are easy to detect or reverse. Instead, words are replaced with others of the same part of speech but from an entirely different semantic context — “horse” becomes “potato.” The sentence looks grammatically correct, but the meaning is distorted, which is exactly what ruins the data's value for training.

Over three months of refining the dictionary, the authors assembled roughly 12,000 common words suitable for substitution. To make detection harder, three replacement options are available for each word, and a publisher can define their own mappings and vary them from paragraph to paragraph.

On average, ShieldFont replaces 24.5% of all words on a page and 45.8% of “content” words, distorting the meaning of between 31 and 56% of passages. When tested against six public scraper pipelines, over 90% of pages that would have passed a quality filter are rejected after substitution. Of the roughly 20% of words that remain, the authors call them “training garbage”: real English, written without errors, but asserting nothing true. In their formula: “Rejected means they didn't get your work. Accepted means they got something wrong.”

A game of cat and mouse

The method has side effects. Search engines, screen readers, copying text, and translators also stumble over the altered HTML, making the page less convenient for a genuine audience. And the protection is not absolute: a scraper can render the whole page and recognize the text optically. But such rendering, by the authors' estimate, costs 5–13 times more than simply reading the HTML, which strikes hard at mass data collection.

It is precisely this indiscriminate, industrial-scale harvesting that the authors want to make harder. “Being findable does not mean consenting to AI training,” they write, hoping that other implementations of the principle of “showing one thing to people and another to machines” will emerge: the more different techniques there are, the harder it becomes for scrapers to get around them all.

Source: Ars Technica