# Ghost Font Bypass and Hardening

> Source: <https://github.com/Sakotass/ghost-font-bypass-hardening>
> Published: 2026-08-04 00:29:59+00:00

| Before | After |
|---|---|

I built this after discovering a way to bypass the protection mechanism by identifying, aligning and removing the moving black elements. The attack uses nine frames, a small vertical-shift search, frame subtraction, thresholding and connected component analysis. It does not use machine learning.

Open the Ghost Font page [https://www.mixfont.com/ghost-font](https://www.mixfont.com/ghost-font), open the developer console, paste `code/ghost_font_browser_decoder.js`

and press Enter. The script captures nine frames from the visible canvas and opens the recovered mask in an overlay.

Browser origin rules still apply. If the canvas cannot be read/download or record the animation and use the Python decoder.

Python 3.12 and a system `ffmpeg`

executable are required.

```
python -m pip install -r requirements.txt
python code/vulnerable_ghost_font_demo.py \
  --output attack/ghost-vulnerable.mp4 \
  --report attack/ghost-attack.json \
  --artifacts attack/artifacts

python code/recover_ghost_font.py \
  attack/ghost-vulnerable.mp4 \
  --output attack/recovered-red.png \
  --classical-ocr \
  --ocr-output attack/recovered.txt
```

The measured mask overlap is `0.9077`

IoU. The template readout is `GHOST`

.

```
python code/hardened_ghost_font_demo.py \
  --output defense/ghost-hardened.mp4 \
  --report defense/ghost-defense.json \
  --artifacts defense/artifacts
```

The same attack reaches `0.0761`

IoU and returns `W4 WZWJ W`

. This result is limited to the global vertical-registration attack implemented here.

```
python code/build_attack_figure.py --results attack --output figures
python code/build_defense_figure.py --results defense --output figures
```

Both figures are built from the videos and decoder outputs in this repository.