Thanks for introducing me to shieldfont.org! It's the first of these I've seen that feels designed to be more than a visual experiment, reading through their landing page is interesting. In particular, their section on accessibility seems to contradict this post's opening premise:
> Screen readers get the real words.
A screen reader reading down the page is never handed scrambled text, and our NVDA test asserts exactly that. Screen review and touch exploration are untested. ShieldFont hides shielded passages from accessibility tools by default with aria-hidden="true", because a decoy read aloud is fluent, grammatical, wrong English, and that is worse than silence.
> The real words remain sealed in the same page, and a visible notice above the block carries the control that uncovers them. It is on by default and reachable by mouse, keyboard and screen reader alike. Pressing it sets the reader’s browser to solving a compute-heavy puzzle: JavaScript and a few seconds of processing, more than most mass scrapers are willing to spend. That puts the words within reach of a screen reader, a translator and copy/paste.
I'd love to hear your thoughts on that. Also just aside, love this TUI-esque blog design and color palette (maybe a bearblog theme? still worth an upvote)
When you look at their live demo (https://shieldfont.org/demo/), it says: If you use a screen reader, custom font, or translator, please uncover the text before reading.
They also actively block copying the text, telling you to "uncover" the text first. The uncover operation is VERY expensive.
Anyone using assistive technologies or trying to copy "protected" text is SOL.
Search engines will index the decoy. You'll get no traffic. Their solution is basically putting yourself in a black hole.
With this kinda of stuff it's hard to tell whether the person is doing it unironically, or knows it's "performative art". A while ago there was a trend of using a tool which imperceptibly perturbs an image in a way that supposedly breaks AI training on it. Of course, artists ate it up, despite the skepticism from AI researchers. Same with people setting up their sites to be "AI scraper traps", generating gibberish content. Probably also trivial to filter out, but people do it.
There could be benefits unlocked in legal documents by retaining a machine-readable version and distributing the obfuscated version with a legend at the top. We proposed one that said:
"This document contains mitigations against review by automated systems. Recipients should ensure that they have read the contents on screen or in print. Recipients with bona fide vision impairments may be entitled to unmitigated documents upon request."
In testing, obfuscating small portions of text slipped under the radar of most (then-)frontier LLMs.
We used a font that was rendered on the fly and reported faulty or fake Unicode mappings: https://tritium.legal/blog/noroboto but others have proposed and done the same with ligatures.
There was a story once about a boy with a wheelchair who needed a ramp to get into school, and the school made him use the loading dock ramp used for garbage and other things at the back. The school argued that it was an appropriate accommodation.
Accessibility is not accessible if you need to go through extra steps to get it.
Cerebrally, this as a solution makes sense. But if you know anyone with a vision or other impairment, gating it behind a request is not only cruel but gets within dangerous striking distance of an ADA lawsuit, for general applications.
Maybe in the legal field or specific niche cases it's possible. But this would represent a major step backwards in the work we've done lowering barriers for a population whose only difficulty in accessing common resources is because they were born, or got sick, differently than anyone else.
> Accessibility is not accessible if you need to go through extra steps to get it.
That seems a bit entitled to me, especially in the story you shared. They had access to the school just like everyone else. Why does it have to be in the exact same spot? Surely they could be dropped off by the loading dock as easily as others could be dropped off out front, and maybe even moreso. Should the wheelchair accessible stall be the first stall in the bathroom so they don't have to go through "extra steps" to get to it? As long as the ramp had the proper gradation to satisfy the ADA, I don't see the problem.
> They had access to the school just like everyone else
They literally did not. They had access to the school from a different entrance than everybody else. Specifically, one intended for cargo before people.
My dad caught paralytic Polio at age 2 and has had limited mobility his entire life, so I'm familiar with that issue.
Our internal, hypothetical use-case was between contracting parties who were looking to avoid terms escaping into the wild. This shouldn't show up in standard ToS or similar. There are already really good legal reasons for that.
It is not sufficient to work against current AI. It needs to also work against AI that has been trained by a competent team aware of your mitigation. Or worse, a competent developer with no particular AI skills.
Otherwise, you are relying on obscurity, and will lose as soon as you become interesting enough to matter.
You will also break non-AI machine processing use cases. That isn't just accessibility, it is things like search.
You will surely not have a good time enforcing the terms of a legal document that explicitly spells out that it is intentionally obfuscated from the party it intends to bind.
I'm a bit frustrated by what seems to be a widespread strong negative reaction to anti-AI fonts. The accessibility problem is real, but I feel like that's a reason to push the investigation deeper for solutions to that problem, not a reason to abandon the effort entirely. The largest intellectual property infringement in the history of the universe is actively unfolding, and it's resulting in an existentially threatening transfer of wealth and power. That's a problem worth exploring every solution for, and solving it may entail some serious sacrifices.
It's simply that a font won't solve anything. That concept is worst than security by obscurity, as it causes more problem and add more constraints than what it solves... for a very limited time until AI bots are adjusted to decode those fonts properly.
I believe the cat and rat game is already there, for multiple places, spam, captchas and now for AI content, yes, it's objective is to make it harder for AI companies to get such data, if it wastes their time, it's a win.
> it's objective is to make it harder for AI companies to get such data, if it wastes their time, it's a win.
That's only one half of the equation, though, isn't it? What if it makes it harder for legitimate users as well? It seems there's a balance to be struck.
We are now in a weird middle ground where we want to write things OCR algorithms have trouble transcribing which also means we write things people with accessibility issues have trouble seeing. No child left behind?
It's like the old tale about the national park bin with the smartest bear / dumbest tourist crossover, except we're now comparing capabilities of the smartest AI with disabled humans.
I think the difficulty was specifically with CAPTCHA challenges, which had to be quick to generate but still legible - OCR on physical documents has to be robust to a different set of problems
That said, what kind of errors are you getting? I think the main practical difference between Tesseract's LSTM-based OCR and newer VLM-based OCR like PaddleOCR [1] is (hopefully) getting to skip making heuristics for the layout of the document, but errors possibly compounding over multiple tokens - are you getting individual illegible words or having the documents smooshed together because the OCR can't parse the layout?
Well, I used specialized software specifically for solving CAPTCHA on select few file sharing websites. My later experience with general purpose OCR software was just as awful as yours. But it's a product problem, not technology problem - you really don't need an advanced AI for it, you just need a good implementation of traditional shape-matching OCR that doesn't seem to exist anywhere for some reason.
Is it part of the joke that the site is intentionally over-pixelated while the author critiques readability? (edit: I don't mind esoteric design and I play old games. I found it funny to see a blog with aesthetics that are not optimized for long reading to complain about the readability of fonts)
I don't think any anti-AI font design is more than design-as-art statements against AI. If there is evidence of them being used exclusively for business and without accessible fonts aside them, I'm willing to be wrong.
Accessibility is important, and I find that "Reader Mode" in most browsers is quite good. Everyone should have access to the tools to consume content. Did your browser not provide that functionality?
> Screen readers get the real words. A screen reader reading down the page is never handed scrambled text, and our NVDA test asserts exactly that. Screen review and touch exploration are untested. ShieldFont hides shielded passages from accessibility tools by default with aria-hidden="true", because a decoy read aloud is fluent, grammatical, wrong English, and that is worse than silence.
> The real words remain sealed in the same page, and a visible notice above the block carries the control that uncovers them. It is on by default and reachable by mouse, keyboard and screen reader alike. Pressing it sets the reader’s browser to solving a compute-heavy puzzle: JavaScript and a few seconds of processing, more than most mass scrapers are willing to spend. That puts the words within reach of a screen reader, a translator and copy/paste.
I'd love to hear your thoughts on that. Also just aside, love this TUI-esque blog design and color palette (maybe a bearblog theme? still worth an upvote)
They also actively block copying the text, telling you to "uncover" the text first. The uncover operation is VERY expensive.
Anyone using assistive technologies or trying to copy "protected" text is SOL.
Search engines will index the decoy. You'll get no traffic. Their solution is basically putting yourself in a black hole.
"This document contains mitigations against review by automated systems. Recipients should ensure that they have read the contents on screen or in print. Recipients with bona fide vision impairments may be entitled to unmitigated documents upon request."
In testing, obfuscating small portions of text slipped under the radar of most (then-)frontier LLMs.
We used a font that was rendered on the fly and reported faulty or fake Unicode mappings: https://tritium.legal/blog/noroboto but others have proposed and done the same with ligatures.
Accessibility is not accessible if you need to go through extra steps to get it.
Cerebrally, this as a solution makes sense. But if you know anyone with a vision or other impairment, gating it behind a request is not only cruel but gets within dangerous striking distance of an ADA lawsuit, for general applications.
Maybe in the legal field or specific niche cases it's possible. But this would represent a major step backwards in the work we've done lowering barriers for a population whose only difficulty in accessing common resources is because they were born, or got sick, differently than anyone else.
That seems a bit entitled to me, especially in the story you shared. They had access to the school just like everyone else. Why does it have to be in the exact same spot? Surely they could be dropped off by the loading dock as easily as others could be dropped off out front, and maybe even moreso. Should the wheelchair accessible stall be the first stall in the bathroom so they don't have to go through "extra steps" to get to it? As long as the ramp had the proper gradation to satisfy the ADA, I don't see the problem.
They literally did not. They had access to the school from a different entrance than everybody else. Specifically, one intended for cargo before people.
Our internal, hypothetical use-case was between contracting parties who were looking to avoid terms escaping into the wild. This shouldn't show up in standard ToS or similar. There are already really good legal reasons for that.
Otherwise, you are relying on obscurity, and will lose as soon as you become interesting enough to matter.
You will also break non-AI machine processing use cases. That isn't just accessibility, it is things like search.
there is a reason nobody uses text based captchas anymore.
Their own whitepaper brings up a bigger issue: if it works, it poisons search engines as well.
That's only one half of the equation, though, isn't it? What if it makes it harder for legitimate users as well? It seems there's a balance to be struck.
I’ve heard Tesseract OCR recommended, but even in 2026, no matter how I scan receipts or documents, the OCR output seems far worse than human reading?
That said, what kind of errors are you getting? I think the main practical difference between Tesseract's LSTM-based OCR and newer VLM-based OCR like PaddleOCR [1] is (hopefully) getting to skip making heuristics for the layout of the document, but errors possibly compounding over multiple tokens - are you getting individual illegible words or having the documents smooshed together because the OCR can't parse the layout?
[1] https://github.com/PaddlePaddle/PaddleOCR
I don't think any anti-AI font design is more than design-as-art statements against AI. If there is evidence of them being used exclusively for business and without accessible fonts aside them, I'm willing to be wrong.
I can't read this bad font, sizing, spacing, etc. The main offender is the color choice, and fonts that are just god aweful to read.