A Font That Swaps “horse” for “potato” Got Over 90 Percent of Pages Rejected by AI Scrapers in Its Creators' Tests

ShieldFont uses ligatures — not Unicode tricks — to show readers one sentence and hand crawlers another. Ars Technica's August 12, 2026 write-up carries the numbers, and the caveats.

A typeface called ShieldFont substitutes an average of 24.5 percent of the words on a webpage when the page is drawn on screen, leaving human readers with the text the publisher wrote while handing anything that downloads the raw HTML a differently worded, semantically broken version, according to Ars Technica's August 12, 2026 report on the project. The font is the work of designers Isaque Seneda and Gabriel Abrucio, who describe it in a white paper as “a practical opt-out from unauthorized AI training,” in remarks quoted by Ars Technica.

The mechanism is a ligature, not a Unicode trick

The interesting part of ShieldFont is how ordinary its underlying machinery is. Ligatures are a long-standing font feature that swaps certain letter pairs for a single better-fitting glyph when they sit next to each other. ShieldFont points that same machinery at whole words, Ars Technica reports: the substitution happens only when the font engine renders the page, so the plaintext source code that a crawler pulls down is never the text a person sees.

The choice of replacement word is where the design gets deliberate. Swapping in synonyms or antonyms would be trivial for a capable scraper to reverse, and swapping in outright gibberish would be easy for a quality filter to spot and discard. ShieldFont instead substitutes words of the same part of speech drawn from an unrelated informational context — “horse” becomes “potato,” in the example Ars Technica cites. The sentence still parses. It just says something else.

The numbers the creators report

The word-swapping dictionary took three months to refine and covers close to 12,000 common words, per Ars Technica's account. Publishers can raise the noise floor by choosing among three different mappings for each replaceable word, encoding their own, or varying mappings from paragraph to paragraph.

Beyond the 24.5 percent overall substitution rate, the creators report replacing 45.8 percent of “content words” and damaging the meaning of between 31 and 56 percent of individual passages, depending on which corpus was studied. Tested against six publicly available scraper pipelines, more than 90 percent of pages that would otherwise have been accepted were rejected by the quality filter once the substitutions were applied, the authors say. Of the pages that still got through, close to 20 percent of the component words were what the authors call “training-time garbage: real English, correctly spelled, asserting nothing true.” Their summary, as quoted by Ars Technica: “Dropped means they did not get your work. Kept means they got something wrong.”

What it costs the publisher, and what defeats it

The trade-offs are not small, and the report names them. Search engines, screen readers, copy-and-paste tools and translation software can all be tripped up by the altered HTML, which makes the page less useful to the audience the publisher actually wants.

The defense is also not absolute. Any page a human can read can be read by a scraper that renders the full page and runs optical character recognition over an image of the result. What that costs is the point: API pricing from third-party scraping tools suggests pre-rendering runs five to 13 times the cost of pulling plaintext HTML, Ars Technica reports — a meaningful penalty at the scale of billions of pages.

The creators frame the goal as consent rather than prevention. “Being discoverable does not mean consenting to AI training,” they write, and they say they hope others build different versions of the same idea, on the theory that a crowd of incompatible tricks is harder to bypass than one.

Two things the Ars Technica piece does not settle, and which this desk in Los Angeles could not verify from it: how ShieldFont is licensed and distributed, and how badly it degrades a real screen-reader session. Those await the source repository and independent testing.