ShieldFont Aims to Poison AI Training Data Without Hurting Human Readers
Two designers have launched ShieldFont, a typeface designed to give web publishers a practical opt-out from unauthorized AI training. The font uses ligatures to swap words when the page is rendered on screen, so human readers see perfectly normal text while scrapers that pull the raw HTML source get an altered, nonsensical version.
- ShieldFont swaps words at render time via ligatures, leaving human-readable pages intact
- Its dictionary covers nearly 12,000 common words, replacing 24.5% of words per page on average
- Over 90% of pages that scrapers would otherwise accept are rejected by quality filters in testing
- The designers cite AI ethics: creators should have a say in whether their work trains AI systems
How It Works
Ligatures are a long-standing feature of many fonts, normally used to replace letter pairs with a more readable version when they sit next to each other. ShieldFont instead uses ligatures to replace entire words with other words. The substitution only happens when the font engine draws the page onscreen, meaning scrapers that download plaintext source code get an altered version that end users never see.
Designers Isaque Seneda and Gabriel Abrucio explain in a white paper that swapping common words for synonyms or antonyms would be too easy for a smart scraper to reverse, while unrelated gibberish could be easily detected. ShieldFont instead replaces words with terms of the same part of speech that occupy a completely different informational context, such as swapping “horse” with “potato.” The result is a scrapable sentence that looks semantically correct but has a completely altered meaning, so even pages that pass a scraper’s quality filter contain scrambled content that can poison a training data set.
The Numbers
After three months of refining the word-swapping dictionary, the creators ended up with nearly 12,000 common words that can be replaced with ligatures. Publishers can choose from three different mappings for each word to increase the chaos, encode their own, or swap mappings from paragraph to paragraph.
On average, ShieldFont replaces 24.5 percent of all words on a page, including 45.8 percent of content words, marring the meaning of anywhere from 31 to 56 percent of individual passages depending on the corpus studied. In testing on six publicly available scraper pipelines, over 90 percent of pages that would otherwise be accepted are rejected by quality filters after the replacements. Of the small subset that still gets accepted, nearly 20 percent of the component words are what the authors call training-time garbage: real English, correctly spelled, asserting nothing true.
Limitations and Workarounds
ShieldFont is not a foolproof defense. Any page readable by a human could also be correctly interpreted by an AI tool that renders the full webpage and applies optical character recognition. But that requires much more work than pulling raw HTML, and API costs from third-party scraping tools suggest pre-rendering would cost anywhere from five to 13 times as much as simply scraping HTML, adding heavy time and expense at scale.
There are side effects for publishers too. Search engines, screen readers, copy and paste tools, and translation software can all be tripped up by the altered HTML, making the page slightly less useful to the intended audience.
Designers’ Goal
The creators say their main underlying purpose is to enforce a basic principle of AI ethics: creators should have a meaningful say in whether their work is used to train AI systems. “Where consent is not respected, technical design can make taking that work without permission less useful and more costly,” they write. “Being discoverable does not mean consenting to AI training.” They hope other developers build on the idea of showing one thing to humans and something else to machines, making it harder for AI scrapers to learn how to bypass them all.
Source: Ars Technica
