On July 30, 2026, the ShieldFont Project released the code and whitepaper v2.0 for "ShieldFont," a mechanism that shows humans and AI scrapers different text. The text on-screen in the browser remains the original, but collection programs that extract HTML directly receive grammatically correct English with a different meaning. It uses glyph substitution, a feature OpenType has had for years—not some unknown browser vulnerability. The goal isn't an undecipherable secret, but rather undermining the assumption that mass collection can be done cheaply.
robots.txt is not a technical barrier that stops unwanted collection. The standard specification RFC 9309 explicitly states that the rules are not access authorization. Research presented at the 2025 Internet Measurement Conference observed 130 self-identified bots over 40 days and concluded that stricter disallow rules were less likely to be followed, making sole reliance on robots.txt risky. ShieldFont keeps the expression of refusal intact while imposing additional processing costs on collectors who ignore it.
False Text in the HTML, Original Text on Screen
ShieldFont consists of an encoder that first converts the original text into different words, and a font that visually reverses that conversion on screen. For example, where you want a human to read "horse," the HTML stores "engine." When the browser applies the font, the string "engine" is rendered as a composite glyph shaped like "horse," while a scraper reading the DOM takes home "engine."
What supports this behavior is OpenType's GSUB (Glyph Substitution) table. It's normally used for ligatures that combine "f" and "i" into a single "fi," or for positional glyph variations in Arabic script. ShieldFont extends this same Lookup Type 4 to entire words, substituting multiple character glyphs with a single glyph shaped like the original word. Since this is a standard feature that separates character codes from glyphs, the display works as long as the font loads, even with JavaScript disabled.
The implementation also handles word boundaries. After the first GSUB pass triggers a ligature, if letters are attached before or after it, chained contextual processing reverts it back. This prevents a rule for "on" from misfiring in the middle of a longer word. The same handling applies at the start of paragraphs, at line ends, for short words enclosed in quotation marks, and in hyphenated compound words.
However, converting the text after it's already sent to the browser offers no protection. The React version needs to encode at build time or during server-side rendering. If the original text is passed to a client-only component, the screen may appear protected, but the plaintext and dictionary remain in the JavaScript bundle. Before the font itself, the design of the delivery pathway determines success or failure.
About 250 Grammar Pools Swapping 24.4% of Words
Randomly scrambling characters makes it easy for post-collection quality filters to spot anomalies. What ShieldFont aims for isn't broken text, but "false text that reads as valid English." In the public benchmark's v8 evaluation, v18-alpha replaced 24.4% of all words. In the same 4-corpus evaluation, when limiting the denominator to content words, the replacement rate averaged 44.7%, with a median of 45.8%. It excludes 113 words—articles, prepositions, pronouns, auxiliary verbs, and the like—from swapping to preserve the sentence's skeleton.
About 12,000 word mappings are drawn from roughly 250 grammar pools. The pools are organized around part of speech and number, while also matching specificity. For verbs, transitivity and conjugation are matched; for adjectives, even comparative forms. Nouns move to nouns, and past-tense verbs move to past-tense verbs that can occupy the same position. Synonyms are excluded from candidates because meaning would remain intact, and antonyms are excluded because the rule would be too readable. Hypernyms, hyponyms, and words sharing a root are also avoided.
This constraint emerged from a tug-of-war between naturalness and meaning destruction. The initial dictionary swapped even high-frequency words, pushing up perplexity—a measure of how unnatural a sentence appears to a language model—by 1,076%. The current version's increase is 121%. Increasing substitutions hides the original text better, but also makes the false text more likely to be caught by quality filters. In a same-series comparison across 512 configurations published by the project, the correlation between concealment level and filter pass rate was -0.56.
Numbers and dates also receive treatment. Digits are swapped in pairs—0 and 5, 3 and 8, 4 and 9, 6 and 7—while 1 and 2 are left unchanged to preserve year-like sequences. Most personal names and technical terms fall outside the dictionary, so they pass through unchanged. As a result, proper nouns appear authentic while some events, actions, and quantities shift to different relationships. This is why detection is harder than with blatant text corruption.
Most Are Caught by Quality Filters, But 13 Slip Through
The public benchmark took 1,000 samples each from news, general web content, contemporary novels, and older novels, and measured whether the original and converted sentences preserved the same claim using an NLI (Natural Language Inference) model. The implementation counts the equivalence relationship as broken if the entailment probability falls below 0.5 in either direction—from original to false text, or from false text to original.
| Corpus | Rate of Broken Equivalence with Original |
|---|---|
| CC-News (news) | 55.8% |
| OpenWebText (general web) | 51.9% |
| BookCorpus (novels) | 34.5% |
| PG-19 (old novels) | 31.1% |
| Control group with synonym substitution at equal density | ~2.1% |
This comparison makes it hard to argue that the judge model was merely confused by unusual words. In news content, equivalence was lost 27 times more often than with synonym substitution; even in old novels, where the effect is weakest, it was still 15 times more frequent. That said, NLI judgment isn't a fact-by-fact verification. It's a semantic equivalence test using a single public model with a 0.5 threshold, and verification with other models remains to be done.
At the entry point of collected data—the quality filters—an even more careful reading is needed. When run through the public classifier that Hugging Face used to build FineWeb-Edu, the absolute pass rate for converted sentences ranged from 0.2% to 1.0% depending on the corpus. Even the original sentences only passed at 2.9% to 7.4%. This is because FineWeb-Edu itself uses a strict filter that discards 92% of source data.
The project's figure of "about 10% pass the filter" is a conditional rate, with the denominator limited to sentences that passed in their original form. Of the 134 such sentences, 13, or 9.70%, still passed after conversion. The 95% confidence interval is wide, at 5.8% to 15.9%. This doesn't mean that 10% of all pages enter training as false text.
There are also constraints on reproducibility. The evaluation script adds the Python hash() of the corpus name to the random seed, so the sample changes with each process, making it impossible to redraw the same 134-sample denominator using the same procedure. A verification script that recalculates 13/134 from saved per-sentence scores is publicly available, but replication attempts will draw a different sample, not the same one.
Moreover, pass rates depend heavily on the classifier. Comparing FineWeb-Edu, Pythia-160M, and two KenLM models, the correlation in pass/fail ranking for each sentence was nearly zero. Conditional pass rates ranged from 2.0% to 65.3%, with a median of 12.4%. Since real AI companies use undisclosed classifiers, FineWeb-Edu's 9.70% cannot be treated as an industry-standard performance figure.
"Poisoning the AI" Has Not Yet Been Proven
ShieldFont directly demonstrates three things: that different text from the original can be recovered from the HTML, that semantic equivalence breaks down according to NLI models, and that most public quality filters discard the converted sentences. What it hasn't measured is how much performance or false knowledge changes when foundation models are pre-trained on data mixed with converted text. The project is seeking the computational resources needed for large-scale training experiments, and states it will publish even a null result.
The whitepaper's figure that "19.4% of pages that pass become wasted" is also not a directly audited proportion of tokens. It's an index created by multiplying the content-word substitution rate by the NLI-measured semantic loss for passing sentences. This can be used to compare the degree to which collected data has weakened as a training signal for the original text, but it doesn't mean 19.4% of the model gets corrupted. "Poisoning" at this stage remains a design philosophy—the only proven effect is data alteration and exclusion.
The defense itself can be decoded. One could render the screen and apply OCR, apply the font using a headless browser like Playwright, download the font and reverse-engineer the GSUB mapping table, or feed screenshots into a vision-language model. When the project tested its own reverse converter, it managed to recover all mappings for the target font. This isn't encryption.
Even so, in mass collection, the costs of identification and reverse conversion add up. According to a 2024 survey by Vercel and MERJ, GPTBot collected 569 million pages and Claude-family bots collected 370 million pages in one month, yet neither executed JavaScript. Google's Gemini-family bots and AppleBot did render pages. Based on commercial scraping rates, the ShieldFont side estimates that render-capable collection costs 5 to about 13 times more than standard collection.
However, if known CDN URLs or CSS classes are identified, an attacker can target only protected pages and reverse the font. There's no need to OCR the entire web. This is why the project itself calls the public CDN version "the easiest deployment method to discover." Mixing three dictionaries paragraph by paragraph and creating site-specific private mappings raises post-identification costs, but whether economic defense actually works depends on the number of participating sites and the diversity of implementations.
Before SEO, Can the Plaintext Loopholes Be Closed?
The cost borne by adopters is not small. Search engines index the false text, and translation services, copy-and-paste, and in-browser search also read the false text in the DOM. If RSS, JSON-LD, OpenGraph, or CMS APIs distribute the original text, scrapers can recover plaintext without ever dealing with the font. It's easy to apply to paywalled articles or archives that don't need search traffic, but applying it broadly to product pages or breaking news would harm discoverability and reader experience.
Accessibility is an even heavier concern. The React version excludes the false text from screen readers using aria-hidden, and provides a beta feature that decrypts the original text on the user's device, taking some time to do so. This has been manually verified with VoiceOver, but NVDA and JAWS remain untested, and there's also an unresolved issue where keyboard focus moves to buttons that aren't visible on screen. A state where protected text cannot be read aloud is not an acceptable side effect of anti-scraper measures.
Currently, only English is supported. Moving to Japanese word forms and grammar would require more than translating the dictionary—it would need to be redesigned from the ground up, accounting for particles, conjugation, compound words, and word segmentation. The code is published under AGPL-3.0, but the bundled Optik-derived font is a proprietary product distributed under license from Playtype. Anyone wanting a fully open configuration would need to generate a different font from a compatible OFL-licensed TrueType typeface.
ShieldFont is not a tool for keeping public documents secret, but an experiment in imposing additional costs on mass collection that ignores consent. The public benchmark showed that NLI-based equivalence between original and false text broke down in 31.1% to 55.8% of cases across four corpora. Crossing the next line will require replication with different NLI models, testing actual mixing into pre-training, alternative displays that don't delay assistive technology users, and a wider spread of sites operating unique mappings. Once all of that is in place, a "price of consent"—making it more costly to ignore and collect anyway—could be embedded into the web's delivery layer.