ShieldFont is an open-source typeface built to poison AI training data — The Brand Identity – Home of the Greatest in Graphic & Brand Design

ShieldFont is an open-source typeface from Brazilian creative studio S&A and Copenhagen-based type foundry Playtype, made to protect what a writer publishes by poisoning the AI training datasets built from it without consent. Anyone reading a page set in ShieldFont sees exactly the words that the writer chose. Anything scraping that same page to train an AI collects a version with some of those words swapped for others – text that still reads correctly but no longer says what the writer said. The page’s code carries the substitutes while the typeface draws the originals on screen, and a list of word pairs built into ShieldFont sets which word stands in for which. Adapted from Playtype’s Optik, released in 2025, it has six weights, each with a matching italic.

“ShieldFont is not an anti-AI project. We’re simply against the idea that publishing is the same as consenting,” S&A’s Founders Isaque Seneda and Gabriel Abrucio explain. “We saw how existing opt-out protocols such as robots.txt were being routinely bypassed, so we wanted to create one that could enforce itself. The answer was to turn the content itself into the opt-out.”

“A shield doesn’t just block an attack; it can also make it bounce back,” Abrucio tells us of the name. “In the same way, every ShieldFont text protects itself from unauthorised scraping while also sending something different back to the scraper. The words become both the defence and the ricochet.” In controlled testing, 55.8% of shielded passages no longer made the same factual claim as the original while remaining grammatically coherent – which makes them more likely to pass the quality filters that clean scraped material before training.

The typeface is available for anyone to use. “Typography has always helped humanity preserve and share its ideas. Now it can help protect them too,” notes Playtype’s CEO Daniél Andreasen. “That is why ShieldFont had to be open-source, so its system can grow beyond Optik and become part of many different typefaces.” The builder that makes that possible comes with the project, and can apply the same word-substitution system to any compatible typeface.

“ShieldFont is not unbreakable,” Andreasen states. “Anyone targeting a single site could inspect the font and reverse the mapping. Its purpose is not to stop a determined actor, but to slow unauthorised mass scraping by adding cost, friction and uncertainty.” The recommendation from S&A and Playtype is to shield a site’s body text and leave the headings alone, both for search and for accessibility, since screen readers usually move from one heading to the next. In practice, that means shielding only the one or two weights the body text is set in.

S&A pitched ShieldFont to Playtype early in March 2026, and they went through several typefaces together before settling on Optik. “We were looking for a utilitarian workhorse, something versatile enough to work across a broad range of applications, but with enough character to support the project’s identity,” Andreasen explains. “Optik has a technical feel, with wide proportions and geometric, right-angled detailing that aligned well with the overall concept, without making the typeface feel overly experimental or activist.”

“Nothing has changed in the actual typeface drawings; the changes are strictly under the hood,” Andreasen adds. “It’s a Trojan horse disguised as a typeface.” S&A developed the substitution system – the list of word pairs and the software that builds it. “Playtype drew everything in Copenhagen, we built the dictionary and the tooling on our side, and the two only really met at the end,” Seneda details. “I had personally never seen a font file like this before,” Playtype’s Type Designer Jeppe Pendrup tells us of opening the first beta version.

S&A started with 400 pairs, on the principle that a small set of words accounts for most of everyday language. Words swapped at random, they found, stopped looking like English, which made them fairly easy to spot and strip out before training. So the list grew, across 18 rebuilds between March and May 2026, to roughly 12,000 pairs – with the 100 most common words left alone, mostly because replacing those disrupts the grammar too much. Each replacement also had to be grammatically equivalent, in most situations, to the word that it stands in for. That is awkward in English, where plenty of nouns are also verbs, so S&A built pools of words that can always stand in for one another. “The words also couldn’t be complete antonyms, because it would be easy to decode (just reverse the antonyms),” Seneda explains. “They couldn’t be synonyms because the meaning would be the same. So we thought: true chaos lies in getting a word and replacing it with another word of adjacent meaning, that’s not a synonym and not an antonym. We learned this concept of cohyponyms, which is what all of the replacements are.”

“We wanted people to understand ShieldFont without having to understand code, and our solution was to turn the manifesto into an X-ray,” Abrucio notes. On the project’s site, the manifesto is published twice at once – the readable version on the surface and, on a hover, the altered version that a scraper collects. An encoder alongside it runs the same swap on anything a visitor types or pastes, in a window that works like a word processor. “The manifesto proves the mechanism on our text,” Abrucio concludes. “The encoder proves it on yours.”