AI training data has become a pressure point for web publishers. As AI companies scrape large parts of the public web, creators are looking for ways to keep their work visible to readers while making it harder to absorb into training sets without permission.
ShieldFont is one proposed answer. Created by designers Isaque Seneda and Gabriel Abrucio, it uses a familiar feature of digital typography in an unfamiliar way: the page looks normal to a person, but the text collected by a basic scraper can become meaningfully wrong.
A font that changes what machines collect
ShieldFont is built around ligatures. In ordinary typography, ligatures help display certain letter combinations more neatly when characters sit close together. ShieldFont uses that mechanism at a much larger scale, replacing whole words when the page is drawn on screen.
The key distinction is between what a person sees and what a scraper receives. A reader looking at the rendered webpage can see the intended text. A scraper that pulls the underlying HTML as plaintext can receive substituted words instead.
That makes the technique different from simply blocking access. The page remains readable. The defensive move happens in the gap between browser rendering and raw text collection.
According to the source article, ShieldFont was described by its creators as a way to give web publishers "a practical opt-out from unauthorized AI training and [to] disrupt what is collected when that choice is ignored."
Why the word swaps are designed to be plausible
The substitution strategy matters. If a system replaced words with obvious nonsense, a scraper might detect the page as corrupted and learn to route around it. If it used simple synonyms or antonyms, the change might be easier to reverse.
ShieldFont instead swaps words for other words with similar grammatical roles but different meanings. The source gives the example of replacing "horse" with "potato." The resulting sentence can still look like ordinary English in structure, but the factual meaning has been scrambled.
That is the point. A quality filter may reject the altered page because it looks less useful. If the page is not rejected, the scraper may keep text that is spelled correctly and grammatically coherent but informationally unreliable.
The creators refined the word-swapping dictionary over three months. The final list includes nearly 12,000 common words that can be replaced with ligatures. Publishers can also add uncertainty by choosing from three different potential mappings for each replacement, encoding their own mappings, or changing mappings from paragraph to paragraph.
What testing showed
In the tests described in the source article, ShieldFont changed a significant share of the text that scrapers would collect. On average, it replaced 24.5 percent of all words on a page and 45.8 percent of all "content words."
The effect on meaning varied by corpus. The source reports that ShieldFont marred the meaning of anywhere from 31 to 56 percent of individual passages.
The authors also tested ShieldFont on six publicly available scraper pipelines. They said that over 90 percent of pages that would otherwise be accepted by scrapers were rejected by the quality filter after the word replacements.
That still leaves some accepted pages. But the accepted subset carried another kind of cost for scrapers: nearly 20 percent of the component words were described by the authors as "training-time garbage: real English, correctly spelled, asserting nothing true."
Dropped means they did not get your work. Kept means they got something wrong
That line summarizes the intended tradeoff. ShieldFont tries to make scraping less useful whether a protected page is filtered out or admitted into a training corpus.
The limits for publishers and readers
ShieldFont is not invisible to every part of the web. Because the HTML is altered, tools that depend on that underlying text can be affected. The source article names search engines, screen readers, copy/paste tools, and translation software as possible problem areas.
That creates a real publishing decision. A website may want protection from AI scrapers, but it may also need search visibility, accessibility, easy copying, and translation. ShieldFont does not remove that tension. It shifts the choice from a legal or policy statement into the technical layer of the page.
The technique is also not foolproof. A scraper could render the full webpage, capture the visual output, and use optical character recognition to recover what a human reader sees. Any page readable by people can, in principle, be interpreted through that route.
But the source article notes that this approach is heavier than simply collecting raw HTML from billions of webpages as plaintext. Based on API costs from third-party scraping tools, pre-rendering would cost anywhere from five to 13 times as much as scraping HTML directly. For large-scale scraping, that added cost and time could matter.
A broader fight over consent
ShieldFont sits within a larger conflict over AI training and the public web. The source article points to lawsuits and technical fixes that have already emerged in response to large-scale scraping for valuable training data.
The creators frame the project around consent. In their words, "Our main underlying purpose is to enforce a basic principle of AI ethics: creators should have a meaningful say in whether their work is used to train AI systems." They also argue that "Being discoverable does not mean consenting to AI training."
The broader idea is not limited to one font. The creators hope others build different ways to "show[ing] one thing for humans, something else for machines." If many methods appear across the web, scrapers would have a harder time learning a single bypass.
For publishers, ShieldFont is less a final answer than a new kind of leverage. It keeps the page open to human readers while making automated extraction more expensive, less predictable, or less valuable. In a web shaped increasingly by AI data collection, that technical distinction may become part of how creators defend the work they still want people to find.