Web publishers have a new tool in the fight against AI data scraping. ShieldFont, a custom font created by designers Isaque Seneda and Gabriel Abrucio, exploits a typographic feature called ligatures to feed scrapers a subtly altered version of a page while human readers see the original text. The approach aims to disrupt unauthorized training data collection at the source code level.

What You Need to Know

ShieldFont replaces specific words in the underlying HTML with alternative terms, but those replacements only appear in the raw code. When a browser renders the font, ligatures map the altered characters back to the intended words. AI scrapers that extract plain text from the HTML receive the nonsensical version, while human visitors see the correct content. The technique is designed to work without requiring changes to existing web infrastructure.

How ShieldFont Exploits Ligatures

Ligatures are a standard feature in many typefaces, typically used to combine adjacent letters into a single glyph for better readability. ShieldFont repurposes this mechanism: it encodes entire word substitutions directly into the font file. For example, the word "horse" might display normally to a reader, but the underlying HTML actually contains the word "potato." The font's ligature rules swap the glyphs when rendering, so the scrambled HTML is invisible to the human eye.

This approach targets how most AI scrapers operate. Many bots download the raw HTML source and strip out rendering instructions, extracting only the text content. ShieldFont does not alter the visible page layout, meaning there is no degradation in user experience. The designers describe it as a practical opt-out for publishers who want to protect their work from unauthorized training datasets.

  • Ligature substitution: The font replaces specific words in the HTML with decoys, readable only through the font's rendering engine.
  • No user impact: Human visitors see the intended text without any visual changes or delays.
  • Scraper confusion: Bots that ignore font rendering extract scrambled data, reducing the value of scraped content for training.

Why This Matters

Web publishers have struggled to defend against AI scraping without harming legitimate users. Legal actions like lawsuits and technical measures such as IP blocking often create collateral damage or require constant updates. ShieldFont introduces a method that is invisible to readers and does not rely on server-side detection of bots. If widely adopted, it could force AI companies to adapt their scraping pipelines, potentially slowing the rate of unauthorized data collection. However, the approach is not foolproof. Scrapers that render pages with a full browser engine or use optical character recognition would still capture the correct text. The tool represents another step in the ongoing arms race between content protection and data extraction.

Limitations and the Arms Race Ahead

No defense against scraping is permanent. Sophisticated AI scrapers could evolve to detect ShieldFont by comparing the rendered text with the raw HTML or by using headless browsers that apply font ligatures. The designers acknowledge this cat-and-mouse dynamic but argue that ShieldFont raises the cost of scraping for many common bot configurations. The font is available for free and can be embedded in any website, lowering the barrier to adoption. As AI companies continue to seek large training datasets, tools like ShieldFont may become an essential part of the web publisher's toolkit.