ShieldFont AI scrapers are the target of a new open-source type project that makes a webpage appear normal to a reader while leaving substituted words in the HTML collected by a basic crawler. The aim is narrower than an anti-scraping force field: designers Isaque Seneda and Gabriel Abrucio say the tool is meant to add cost, friction and uncertainty to unauthorized mass collection.
That matters because a site’s robots.txt file is a voluntary request to crawlers, not a technical barrier. Publishers unhappy with AI companies collecting web text for model training have been looking for measures that do more than ask bots to behave.
How does ShieldFont block AI scrapers?
ShieldFont exploits a standard font feature called glyph substitution, or GSUB. Ordinary ligatures use it to turn letter combinations such as “fi” into a single cleaner-looking glyph. ShieldFont stretches that old machinery to whole words.
A publisher first changes selected words in the text held on its server. The font’s substitution rules then make the altered word draw on screen as the word the author intended. A person using a browser sees readable prose; a crawler that downloads only raw HTML gets the replacement text instead.
The replacements are designed to preserve grammar while wrecking meaning. Rather than swapping a noun for a verb or dumping obvious nonsense into a paragraph, the project uses words from similar grammatical categories and contexts. Fast Company reported that this is deliberate: pure gibberish is easier for a scraper’s quality filter to discard, while plausible-looking bad text may be retained.
Ars Technica reported that the creators built a dictionary of nearly 12,000 common words over three months. In tests of six public scraper pipelines, the project’s authors said more than 90% of pages otherwise accepted by quality filters were rejected after the substitutions. Those are the authors’ results, not an independent measurement of harm to a trained model.
What ShieldFont can and cannot stop
- It can disrupt: low-cost crawlers that collect raw page source as plaintext. Ars Technica reported estimates from third-party scraping-tool APIs suggesting full rendering could cost roughly five to 13 times more than plain HTML collection.
- It does not defeat rendering: a crawler can load the page in a browser and use OCR or a vision system to read what the visitor sees. The Register also reported that a determined operator could obtain the font and work to reverse its mappings.
- It creates collateral damage: search indexing, translation, copy-and-paste and find-in-page can encounter the decoy text rather than the visible sentence. Screen readers can face the same problem.
Help Net Security reported that the project includes an accessibility alternative intended to avoid reading decoys aloud, but only VoiceOver on macOS had been verified at the time; NVDA and JAWS support was pending. It also reported that RSS feeds generated before ShieldFont’s transformation may expose the original text anyway.
The result is a deterrent with a conspicuous price tag for publishers. ShieldFont may make indiscriminate HTML harvesting less attractive, but it also makes a site harder for search tools and assistive technology to handle. It is an argument about leverage in web scraping, not proof that determined AI collectors can be locked out.
This story draws on original reporting from Ars Technica.
