A new “AI-proof” font was designed to be hard for AI agents to scrape, but you can’t tell by just looking at it. Unlike other anti-AI fonts that use letters that are difficult for bots to read, ShieldFont swaps out words behind the scenes to poison the data that automated scrapers take without permission.
ShieldFont was designed as part of a project created by a group of professionals including the Brazilian creative studio Seneda & Abrucio** **and the Danish type foundry PlayType. It shields text from large language models (LLMs) by garbling sentences in the HTML source code, leaving automated scrapers to sift through sentences filled with decoy words that make a sentence incoherent. Thanks to a custom font on a backend, though, the real text is displayed for a human reader to see.
For example: A sentence that originally reads, “The knight rode his *horse *into battle,” is altered in the source code so it’s scraped by a bot to read “The knight rode his engine into battle.” Since LLMs group words and phrases that are likely to be used together, the quality of its output is degraded if it scrapes a lot of jumbled text like this. The goal, according to two of ShieldFont’s creators, Isaque Seneda and Gabriel Abrucio, is to push back against unauthorized LMM scraping by making it harder and costlier to do so.
ShieldFont works using ligatures, the technical term in typography when two letters next to each other in a word are combined into a single glyph. Ligatures are designed for aesthetics, so letter combinations like fi in “fish” or fl in “flow” look naturally spaced instead of visually cluttered. When a program sees these specific letters next to each other, it swaps two characters for one that combines the letters into a single glyph. ShieldFont works in a similar way, except instead of letters, it swaps out whole words.
“We didn’t invent a new font capability, just pointed to an old one that hadn’t been used this way before,” Felipe Petroni, a creative director who was part of the project’s leadership, tells Fast Company.
Determining which words to swap out was tricky, since doing so at random results in gobbledygook phrasing that bots reject outright. The key was changing the meaning of sentences and phrases, not just words, so bots would still accept the text, resulting in a “poisoned” version of the scraped data. The thinking goes that if there are enough of these sorts of digital speed bumps, it will raise the cost of illegal scraping and those who build LLMs will opt to pay for what they take instead.
To determine which words to swap, ShieldFont’s creators made a do-not-swap list of 113 words that included things like pronouns, articles, conjunctions, prepositions, negations, quantifiers, and every form of be, *have *and do. Instead, it swaps out adjectives, adverbs, nouns, and verbs. Dates and numbers also get scrambled.
Their program doesn’t change any words for synonyms, which wouldn’t be a difficult enough decoy, or antonyms, which could more easily and predictably be undone by a bot. Nor does it swap out a person, place, or company or product name. In all, ShieldFont has 24 rules for determining which words get swapped.
ShieldFont’s creators said that in testing, their system led to more than 90% of content using it to be rejected by bot quality filters. Of the remaining text that’s accepted, 19.4% of it asserted false meaning.
Automated scrapers can get around ShieldFont by taking a picture of the text to view it as a human does, but that also raises the price of scraping at scale. Rather than scraping plain text files quickly and cheaply, it has to photograph the page and conduct image recognition. Seneda and Abrucio’s white paper** **notes that ShieldFont introduces some friction for humans too, as search engines index the decoy text, so publishers would have to use ShieldFont for content that doesn’t depend on search traffic. The substitute words also show up in translation tools and screen readers, and when users copy and paste.
Petroni and his team began prototyping ShieldFont in October 2025, and they partnered with the type foundry PlayType this March to develop a ready-to-use typeface with the ligatures called ShieldFont Optik. The protocol for ShieldFont is open-source and type-face agnostic.
Petroni says they made implementation for ShieldFont as low-friction as possible, and it comes with three public mappings, so the word “wrote,” for example, becomes either “sang,” “wrought,” or “labeled,” depending on whether it’s using its alpha, beta, or gamma dictionary.
“That’s deliberate; a decoder built for one mapping doesn’t work for another, and private mappings have to be identified and reversed one by one,” he says. “Scrapers can’t know in advance whether a site uses ShieldFont or which mapping it uses. Across millions of pages, that added cost is the point.”
ShieldFont is a font system designed for human reading, not bots. Instead of using visual tricks to make it harder to read, it confuses the bots in the code and leaves the human reading experience alone.