This is really cool. The website does a great job of explaining what's going on. I still haven't made it through everything, but I'll definitely be returning to play around with this next week!
Most mass scrapers collect webpage content through HTML, and there is no widely effective opt-out. Robots.txt, the standard way to signal non-consent, is only a request and is often ignored.
ShieldFont uses word-level ligatures. It replaces words in the source, then uses OpenType GSUB rules to render the text back to normal for human readers.
Scrapers reading the raw HTML collect a different but grammatically coherent version that passes AI quality filters, introducing noise into their datasets. (try it here: shieldfont.org/encoder)
It can be broken in individual attacks, but makes large-scale automated scraping less reliable and more expensive.
The main face is built by Playtype, but you can also generate your own version using a your own typeface and seed.
P.S.: We an accebility feature for screen readers ;)
This is really cool. The website does a great job of explaining what's going on. I still haven't made it through everything, but I'll definitely be returning to play around with this next week!
What does just copy pasting from the website to notepad look like? (I can't check, I'm on mobile)
I’m also on mobile but natively It’ll give the version of the text that AI would see. You could get around that with even handling and clipboard substitution, though.
Good work!
Thank you for your service! 🙏
That’s really cool!
Well I'll be sure to check this out! I made my own custom one (with more features and such) for ungenerated.io here
But mine is pretty poor on accessibility. Pretty neat!
Looking through yours, WOW! I had some ideas for accessibility, etc, but yours is so full of features it's amazing. Shows what a team and some dedication will do. Slick site!
I like the idea but I’m not sure I like poisoning data instead of using to so ai just skips the content.
Amazing
This is cool but chatbots don't really scrape the source the way crawlers do. Most grep the pages with a function.
grepping the page still doesnt render it, so it's the same mechanism as a crawler either way. layerx actually tested this exact source v render gap and found every non-agentic assistant they tried failed to catch it, meaning they read naive raw source https://layerxsecurity.com/blog/poisoned-typeface-a-simple-font-rendering-poisons-every-ai-assistant-and-only-microsoft-cares/
The AI will just use your accessibility features instead.
the unlock costs about as much compute as ocr does, and it's a serial chain so you can't parallelize it away like you could a batch ocr job. also i assume you're describing one agent reading one page, not the mass scraping? it's insane but currently most mass scrapers (except google) currently don't even run js to trigger it in the first place
I'm too dumb to even understand how this works but A+ for poisoning AI
Yeah, let's create a shitty user experience (fucking up accessibility and copy/paste) to poison AI, very good idea. /s Especially as AI scrapers or AI themself will soon be able to easily convert the poisoned text with zero effort.
OP says that they have accessibility features specifically for screen readers. Others report no issues with copy paste.
Amazing idea and execution. I wonder if this gets used more widely in more typefaces.
Thanks, man! And yeah it works on any font already, not just Optik. shieldfont.org/docs/custom-mappings
Until they're trained on this, right?
thats kind of the point actually, we want it to learn from this text, thats what poisoning entails.
but we ship three separate dictionaries at once (alpha/beta/gamma) plus you can mint your own with a private seed / so the model is always hit with new words meaning other words.
aka too much chaos for it to handle.
docs here: https://shieldfont.org/docs/custom-mappings
What about SEO
yeah of course the words in your source are what google indexes, so we recommend you dont shield everything. leave whatever you actually want ranked unshielded and only wrap the stuff you don't need search traffic on, its a real tradeoff, but not too far from USA Today, Reuters hiding their article behind a paywall.
This is super cool OP, I’m not proficient enough with the back-end to fully understand the processes used to achieve these results (and you seem to have put a lot of consideration into the various aspects that would impact actual users!) but the nerd in me is very happy to find out lol great work!!
thanks a lot! if you want more of the nerdy stuff the white paper goes pretty deep into the testing and all (should be non-expert-friendly). but yeah, the short version is just us capitalizing on the fact that OpenType is Turing complete, which is hilarious. there was a guy who put doom inside a .ttf btw haha
This is marketing not security. But well done on the former
Seems like this will also affect web crawler like Google, IIUC this could negatively impact SEO.
how could this be accessible for screen readers?
Hello, this actually quite terrible. You're not just poisoning your text for AI, but for everyone.
A control only screen readers reach asks the reader’s own browser to solve a time-lock puzzle for the key.
A screen reader challenge that takes very long and drains your battery doesn't make the website accessible. You claim that it takes ~7.6 s to solve, but it will be significantly longer on low-powered mobile devices.
kiss your SEO goodbye if you do this. Still a very cool idea for some use cases!
So... either you are foregoing accessibility in order to thwart AI, or AI is just going to scrape from your accessibility features. I really do not understand how this is supposed to work in a way that's effective. How exactly is your screenreader-accomodating function not something that can be simply grabbed like any other text? You explained in another comment but it seemed like a "it's a lot slower" kind of solution, which isn't a real solution (scraping that happens at scale will still happen, speed is irrelevant) and is just going to agreeve regular users.
hi! so the current solution (not the final solution) is that we create a puzzle that would be as expensive to run as using OCR. that gets costly at scale, and that's the current deterrent we thought of. but agreed that there's tons of room for improvement, and we will keep looking!
you can see an example of what screen readers are handed here: shieldfont.org/demo
I tried copying and pasting the text and got the garbled "for AI" text. You promote this font for people to use to fight with AI, but people will use it to soft-DRM practically all digital text. I can already imagine people, government agencies even, trying to protect their texts by mass converting all their base data to garbled text and telling their users to install this font to read the real text. And user demand for OCR services will even go higher since the most practical way to copy text is now pointing a smartphone at it and reading it with Google Lens. The big AI firms have all the vig guns. This is like trying to kill whales by poisoning the oceans. Sure the whales will suffer but all the fish and birds will die en masse before that.
yeah copy/paste giving you the scrambled version is annoying, we're actually working on a fix for that, restoring the real text on select, not shipped yet but its in the works fair worry tho, that font story sounds like a thing to avoid. what were actually betting on is smaller, like people choosing to shield their own stuff knowing about the tradeoffs in a rebellious opt-in way. cant stop someone from misusing open source code tho, thats a real risk. but we're for now focusing on the achilles heel of mass scrapers which is: the cost of extra compute needed if your webpage is no longer a sweet little piece of HTML! and yeah its an arms race, and we would need to keep updating strategies as things adapt!
Seems like we now see one of these silly cyphers riding the AI hate wave every other week...
I hate to be a doomer, but this isn't going to work on AI companies like Xai or Claude. Most AI companies don't entirely automate data scraping. It's actually smaller ones that are more likely to automate this with mass scrapers. Checking dataset quality before it's fed to AIs is one of the main tasks of an AI engineer.
looking at this vercel report (below), seems like the incentive just isnt there yet. render-and-ocr runs 5-13x more per page than a plain fetch, and at the call volumes these companies operate at that adds up fast. dont know about xai specifically, but the report showed claudebot and gptbot making hundreds of millions of fetches in one month on one cdn and neither rendered js or the page. thats our bet for now. source (https://vercel.com/blog/the-rise-of-the-ai-crawler)
Although this sounds like a valiant attempt to allow public viewing of content while preventing AI from scraping, isn't it simply a matter of one instance of this being recognized for what it is? Any time any content comes across with your fonts, it's simply translated? And if they are scraping the HTML and notice your font, why not scrape the rendered content? It seems to me that you are adding one more step, thinking it's noise, but in the billions of parameters that AI uses, one additional step is not significant. I'm saying this works great until it doesn't, and then it won't work at all. And considering that valid content is critical to new datasets, any garbled mess of text that doesn't make sense will trigger a refilter. Your garbled text will force AI to reconsider your content, realize it's a font-sub issue, filter accordingly, and record the correct content regardless--even if it has to screen cap the rendered font and OCR. I think it's great and it might work for a while, but a better solution might be to prevent public exposure entirely.
definitely an ongoing endeavor, and we're looking forward to see what other people with more data architecture knowledge can also bring to the game. for now the bar seems so low, that any level of chaos or barrier would be a decent deterrent.
Isn't it a *little* ironic that you're using the thing you're trying to prevent? https://preview.redd.it/67o76w916ngh1.png?width=560&format=png&auto=webp&s=20746a62e2941ae73d3dd6ffb07fd434ddbac461
we decided to leave claude there to make a point. remember the other day when higgsfield had to fight open ai’s attack with MORE AI? that’s kind of where we’re at here. and yeah, it sucks that a bunch of unauthorized data was used to train the models that we used to build ShieldFont. to fight (and keep fighting) the speed with which scrapers might counterattack, we don’t really think we have an option here.
That’ll teach em
This is just genius
AI will find out all about it from this Reddit post
How does it work with screen readers?
If a person can use it, so can AI. Pretending it can't (and that you can or even SHOULD prevent that) is just an exercise in karma/internet attention farming. It's just fearmongering, relying on people who don't know how this stuff works. That and it literally doesn't work, so there's that.