How Adversarial Fonts Use Glyph Substitution to Poison AI Training Data

The publishers and independent writers who host the internet's text now hold the power to decide what enters an artificial intelligence training dataset. Using a new generation of adversarial typography, they are able to serve human readers a pristine page while feeding automated scrapers grammatical gibberish—a defense mechanism they can deploy the next time they update their site's stylesheet.[1]

For years, the standard method of keeping automated bots away from a website was the robots.txt file, a polite request that scrapers ignore specific pages. But as the demand for training data has surged, many AI developers have simply bypassed those requests, pulling raw HTML from the open web regardless of the publisher's wishes.[4]

In response, designers and computer scientists have begun engineering fonts that actively deceive the machines reading them. These tools do not rely on asking for permission; instead, they exploit the mechanical differences between how a human eye perceives a rendered letter and how a scraper parses underlying code.[1][4]

One of the most prominent new tools is ShieldFont, released in July 2026 by the Brazilian creative studio Seneda & Abrucio and the Copenhagen-based type foundry PlayType. ShieldFont operates at the code level, scrambling the text before it ever reaches the screen.[1]

The mechanism relies on OpenType glyph substitution, a feature normally used to swap characters for aesthetic reasons, like creating a ligature between two letters. ShieldFont hijacks this process to swap entire words. In the raw HTML—the layer that most mass scrapers ingest—roughly 50 percent of all content words are replaced with random alternatives.[1][4]

To ensure the resulting text still looks like valid data to a scraper, the substitutions are strictly categorized. Nouns are swapped for nouns, and past-tense verbs for past-tense verbs, drawing from 250 distinct grammatical pools. A single sentence that should read "The knight rode his horse" might appear in the code as "The knight rode his engine."[1][4]

Because the grammar remains intact, the scraper ingests the sentence. But because the meaning is destroyed, the data is poisoned. According to the font's creators, more than 90 percent of the resulting gibberish is eventually rejected by the AI developers' own quality filters, wasting their computational resources across millions of pages.[1]

While ShieldFont attacks the code, other adversarial fonts attack the optical layer itself. Decoy Font, created by the platform MixFont, uses a technique called hybrid imaging to hide messages in plain sight.[1]

Hybrid imaging relies on spatial frequencies—the same optical illusion that allows a single picture to look like Albert Einstein from up close and Marilyn Monroe from a distance. "The camouflaging technique is a modern-day version of an optical illusion known as hybrid imaging," writes Christian Thorsberg, a correspondent for Smithsonian Magazine, noting the technique was originally pioneered by MIT researchers in 2007.[1]

Decoy Font applies this to typography, layering a crisp foreground letter over a dark, blurred background letter. "It offers human writers the chance to create cheeky juxtapositional messages, hiding the blurred 'Happy Human,' for example, behind a crisp 'Sorry Robot,'" Thorsberg notes. When an AI optical character recognition system scans an image of the text, it struggles to separate the two distinct layers, often reading the blurred background instead.[1]

These adversarial tactics are part of a broader academic push to humanize text and evade automated detection. In a June 2025 study, researchers demonstrated that adversarial paraphrasing—using one AI model to rewrite text specifically to bypass another model's detector—could reduce true positive detection rates by 87.88 percent across diverse systems. This builds on earlier work, such as the 2021 Adversarial Paraphrasing Task, which trained models to identify semantically equivalent but syntactically disparate sentences. The underlying principle is the same: exploiting the rigid, predictable ways that machines process language.[2][3][4]

However, adversarial typography introduces significant collateral damage. Because ShieldFont alters the underlying HTML, screen readers used by visually impaired humans will read the poisoned, gibberish text aloud. Until developers find a way to distinguish between an accessibility tool and an AI scraper, publishers must choose between protecting their data and maintaining an accessible web.[4]