Every word on a webpage is readable by two very different audiences: the human visitor who opens a browser, and the automated scraper that downloads raw HTML to feed an AI training pipeline. For years, those two audiences saw exactly the same thing. ShieldFont, a project by designers Isaque Seneda and Gabriel Abrucio, is built on a simple but disruptive premise: they don’t have to.
The Typographic Trick Hidden in Plain Sight
To understand how ShieldFont works, it helps to understand ligatures. In typography, a ligature is a feature that automatically combines certain letter pairs into a single, more visually harmonious glyph when they appear side by side. It is a centuries-old tool, standard in professional fonts, and entirely invisible to the reader.
ShieldFont repurposes that mechanism for a completely different goal. Instead of merging letter pairs for aesthetic reasons, it uses ligatures to swap entire words for different ones. The substitution happens at the rendering stage, when the font engine draws the page on screen. A human visitor sees the original, intended text. A scraper that pulls down the raw HTML source code, as most do, gets the altered version instead.
The word replacements are not random. Simply swapping synonyms would be too easy to reverse. Replacing words with gibberish would be too easy to detect and filter out. The designers landed on a more precise strategy: replacing words with others that share the same grammatical role but belong to a completely different informational context. “Horse” becomes “potato.” The sentence still looks grammatically coherent. It just means something entirely different.
The Numbers Behind the Disruption
Three months of refinement produced a dictionary of nearly 12,000 common words that can be substituted through ligatures. Publishers can also choose from three different possible mappings for each word replacement, and can swap those mappings from paragraph to paragraph, making the pattern harder to detect and reverse-engineer.
The scale of the disruption is measurable. On average, ShieldFont replaces 24.5 percent of all words on a page. For “content words,” the words that carry the actual meaning of a text, that figure rises to 45.8 percent. Depending on the corpus studied, between 31 and 56 percent of individual passages end up with their meaning significantly altered.
The practical effect on scraping pipelines is substantial. Testing on six publicly available scraper pipelines showed that over 90 percent of pages that would otherwise pass a quality filter are rejected after ShieldFont is applied. That is a significant result. But the pages that do get through are not a clean win for the scraper either. Nearly 20 percent of the words in those accepted pages are what the authors call “training-time garbage”: real English, correctly spelled, but asserting nothing true. The designers frame this as a two-sided outcome: dropped pages mean the scraper did not get the original work at all; accepted pages mean the scraper got something wrong.
What This Reveals About the Scraping Problem
Here is what most coverage of this tool misses. ShieldFont is not primarily a technical solution. It is a statement about consent, expressed through technical design.
The designers are explicit about this. Their stated purpose is to enforce what they describe as a basic principle of AI ethics: that creators should have a meaningful say in whether their work is used to train AI systems. Being publicly discoverable on the web, in their framing, does not constitute consent to AI training.
This matters because the current landscape offers content creators very limited options. Robots.txt files can signal that a site does not want to be scraped, but compliance is voluntary and enforcement is essentially nonexistent. Legal challenges are slow, expensive, and unresolved. ShieldFont represents a different category of response: a technical friction layer that makes unauthorized scraping less useful and more costly, without requiring any legal victory or platform cooperation.
The tool is not without trade-offs. Search engines, screen readers, copy-paste tools, and translation software can all be affected by the altered HTML, which creates real usability costs for the intended human audience. ShieldFont is also not a complete defense. Any AI scraping tool that renders the full webpage and applies optical character recognition to the visual output would see exactly what a human sees. The designers acknowledge this. Their counterargument is economic: pre-rendering pages before scraping costs anywhere from five to thirteen times more than simply pulling raw HTML, which makes large-scale scraping significantly more expensive and time-consuming.
That asymmetry is the real point. Industrial-scale AI training depends on scraping billions of pages cheaply and quickly. ShieldFont does not make that impossible. It makes it harder, slower, and more expensive, which changes the calculus for scrapers operating at scale.
The designers also express hope that others will develop additional implementations of the same core idea: showing one thing to humans, something else to machines. A diverse ecosystem of such techniques would be considerably harder to bypass than any single method.
In Short
ShieldFont uses a standard typographic feature, ligatures, to serve two different versions of a webpage simultaneously: a readable one for humans, and a semantically scrambled one for AI scrapers. By replacing nearly a quarter of all words with grammatically plausible but informationally incorrect substitutes, it causes over 90 percent of treated pages to fail scraper quality filters, while poisoning the training value of the pages that do get through. The tool has real limitations and real side effects, but its significance extends beyond the technical. It represents a new category of response to the consent problem at the heart of AI data collection: not a lawsuit, not a policy, but a design choice that makes taking content without permission less useful and more costly.
Based on reporting from Ars Technica.