In the escalating arms race between AI companies and web publishers, a new weapon has emerged: a font. Designed by Isaque Seneda and Gabriel Abrucio, ShieldFont promises to render web pages perfectly readable for human visitors while serving AI scrapers a subtly edited, nonsensical version of the content in the underlying HTML. The font is being hailed as a 'poison pill' for unauthorized data harvesting, offering a practical, user-friendly opt-out for publishers who want to protect their content from being consumed as training data.

A Font That Fights Back

ShieldFont leverages ligatures—a typographic feature traditionally used to combine letter pairs into more elegant forms—to replace entire words with alternatives when the page is rendered in a browser. To a human, the page looks completely normal. But a scraper that downloads raw HTML source code sees the altered words, effectively destroying the text's value as training data for large language models. The designers describe the font in a white paper as 'a practical opt-out from unauthorized AI training and disrupt what is collected when that choice is ignored.'

'a practical opt-out from unauthorized AI training and [to] disrupt what is collected when that choice is ignored.'

How ShieldFont Works

The technical trick behind ShieldFont is both simple and ingenious. In a normal font, ligatures replace character pairs like 'fi' or 'fl' with a single glyph. ShieldFont extends this concept to entire words. By defining ligatures for word sequences, the font instructs the browser's text engine to replace the actual word in the source code with a completely different word on screen—or rather, the reverse. The source contains the altered word, while the rendered page shows the original. This means that when a scraper fetches the HTML and extracts the text without rendering it, it gets the nonsensical version.

For example, the word 'horse' might be mapped via a ligature to 'potato' so that the HTML says 'potato' but the reader sees 'horse.' Ars Technica, which first reported on ShieldFont, noted that the substitution only happens when the font engine draws the page on screen, meaning scrapers that simply download plaintext source code get an altered version that end users never see.

Why Now? The Rise of AI Scraping

AI companies like OpenAI, Google, and Anthropic have scraped massive portions of the public web to train models such as ChatGPT, Gemini, and Claude. This has led to a wave of lawsuits and technical countermeasures. One of the most prominent legal battles is New York Times v. OpenAI, where the publisher alleges copyright infringement over the unauthorized use of its articles for training. Law firm Lewis Silkin notes that this case highlights the conundrum facing publishers: how to protect content while remaining visible online. The outcome of such cases could set precedents that define the boundaries of fair use in the AI era, but in the meantime, publishers are taking matters into their own hands.

A Growing Arsenal of Countermeasures

ShieldFont is just the latest entry in a rapidly expanding toolkit designed to thwart AI scrapers. Other approaches include:

  • Robots.txt exclusions and IP blocking—the simplest but easily ignored methods.
  • Cloudflare's 'AI Labyrinth'—a honeypot that feeds scrapers with infinite mazes of irrelevant content.
  • Nightshade and Glaze—tools that perturb images in ways that are invisible to humans but confuse AI models.
  • Legal challenges and cease-and-desist letters, as seen with the NYT lawsuit and many others.

What sets ShieldFont apart is its elegance and ease of deployment. A site owner simply includes the font in their stylesheet, and it works automatically. It requires no JavaScript, no server-side logic, and no technical expertise. Moreover, it is free.

Limitations and Implications

ShieldFont is not a silver bullet. It relies on a browser's font rendering engine; scrapers that use a headless browser—like Puppeteer or Selenium—will fully render the page and see the intended text. Adversarial AI systems could also potentially reverse-engineer the ligature mappings and decode the original content. Additionally, the font only works if the scraper respects the font files, which are often not downloaded when fetching raw HTML.

Despite these limitations, the design philosophy behind ShieldFont reflects a broader shift in how web publishers view their relationship with AI companies. Instead of relying solely on legal or corporate channels, creators are developing grassroots, technical solutions to enforce their preferences. This is a form of 'digital civil disobedience'—a way to embed a choice directly into the medium.

Looking Ahead

ShieldFont may not stop the AI juggernaut on its own, but it adds another layer to a defense-in-depth strategy. As more publishers adopt such tools, AI companies will be forced to either negotiate proper licensing agreements or build more sophisticated scrapers that can render pages fully—a cat-and-mouse game that shows no signs of abating.

For now, Seneda and Abrucio are offering ShieldFont as a free download, hoping that widespread adoption will send a message: the web is not a free training ground, and respect for content creators' choices cannot be ignored. Whether it's a horse or a potato in your HTML, the point is clear—the era of unchecked AI scraping is coming to an end.