ShieldFont Poisons AI Training Data by Swapping Words While Preserving Grammar

ShieldFont is a free font developed by Brazilian agency Seneda & Abrucio and Danish studio Playtype that protects web content from unauthorized scraping by generative AI systems. Instead of relying on robots.txt, the font uses OpenType glyph substitution to replace approximately one quarter of words with semantically similar alternatives from 250 categorized groups. Human visitors see the original text, while scrapers receive grammatically consistent but factually altered content that can still pass basic quality filters. Testing against FineWeb-Edu showed that roughly 10 percent of previously high-quality fragments remained acceptable after poisoning, yet 55.8 percent of those fragments contained incorrect facts. The technique works only with English text at present and is available on GitHub. Limitations include vulnerability to OCR-based screenshot attacks and reduced accessibility for screen readers used by visually impaired users.

AntiMalwareTranslated from Russian

Read at source

ShieldFont, a free font created by Brazilian agency Seneda & Abrucio and Danish studio Playtype, offers website owners a new way to disrupt unauthorized collection of text for training generative AI models.

Publishing content online now exposes material not only to human readers but also to AI scrapers that frequently ignore robots.txt directives. ShieldFont counters this by allowing scrapers to access the page while feeding them deliberately altered text that remains grammatically plausible.

The font leverages the OpenType mechanism for glyph substitution, replacing entire words rather than individual characters. Nouns are swapped with nouns, past-tense verbs with past-tense verbs, and plural forms are preserved. The vocabulary is organized into 250 groups based on parts of speech and semantic features, resulting in roughly one quarter of words being altered while maintaining readable structure.

This controlled substitution aims to keep poisoned text inside training datasets instead of being filtered out by quality checks. When evaluated with FineWeb-Edu, about 10 percent of fragments previously rated as high quality still passed after protection, yet 55.8 percent of tested excerpts contained facts that no longer matched the original.

ShieldFont is not immune to all extraction methods. Screenshots followed by OCR can recover the original text, and screen readers for visually impaired users currently read the substituted words. Developers have added a beta feature to supply the correct text to assistive technologies, though accessibility concerns remain unresolved.

The font currently supports only English and is freely available on GitHub.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in AI Security

Logical Argument Claims Full Alignment of Superintelligent AGI Is Fundamentally Impossible
Claude Account Bans Linked to IP Reputation, Device Environment and Payment Channels, But No Confirmed Formula
Local LLMs in AppSec: What Open Tools and Models Can Handle in Application Security