Decoy Font protects messages from being read by AI

One message for humans and another for artificial intelligence are contained in the letters of Decoy Font, made by the company Mixfont for those who want to avoid having their data scraped.

Decoy Font makes use of a well-known optical illusion to trick contemporary artificial intelligence (AI) chatbots into misreading messages.

The font features two layers of image – one in thin but clear outlines in the foreground, and another in blurry dark shapes in the background.

Image of text in Mixfont's Decoy Font, showing the words Day Dream most visibly to humans as letterforms in thick, blurry lines and Pay Bills as the faint, hidden message readable by AI — Decoy Font lets humans hide their writing from AI

Humans can read both letterforms by shifting focus, squinting, or moving further or closer to the screen, but usually see the dark letters in the background more vividly.

However, current large language models (LLMs) like ChatGPT, which work by reading the pixels of an image up close, automatically read the less visible, crisply outlined forms in the foreground, Mixfont founder and AI researcher Eric Lu explained.

Lu created Decoy Font and a similar earlier experiment, Ghost Font, which obscures messages in moving animations, to explore the potential of "anti-AI" fonts to protect text from being scraped or read by LLMs.

Screenshot of correspondence with ChatGPT responding to an image that reads SLEEP EARLY in bleary but bold dark grey letters. The human writes 'what does this image say' and the chatbot responds 'The image says BINGE SHOWS' — Mixfont used the font to fool ChatGPT

At the same time, he wanted to more open-endedly explore the limits of AI perception and how quickly they are changing, in line with Mixfont's AI-led business. The digital font foundry and research lab offers AI-powered products such as a text-to-image font generator.

"In my work at Mixfont I've been researching ways that AI and typography intersect," he told Dezeen. "I tested many different techniques [to create an anti-AI font], including Ghost Font to test the limits of what LLMs would easily solve."

"Decoy Font emerged out of these attempts as an effective try – the idea that we could combine two letters that are readable in different ways proved to be difficult for AI models to reason about clearly."

Screenshot of an interaction with Gemini 3.5 with Thinking responding to an image that says SLEEP EARLY in bold but fuzzy letters. The human asks 'tell me what this image says' and the chatbot response 'The image says: BINGE SHOWS' — Gemini 3.5 with Thinking also failed to recognise the real message

Lu demonstrated the effectiveness of Decoy Font on Mixfont's blog with screenshots that show him fooling the advanced models GPT-5.6 Sol and Gemini 3.5 with an image that to humans clearly reads "sleep early". Both models pronounced that the image says "binge shows".

Other examples on the blog include text that says "day dream" for humans and "pay bills" for AI, or "happy human" for humans and "sorry robot" for AI.

Decoy Font can be used either as a web application that encodes specific hidden messages or as a downloadable TTF font file, which produces text that AI will perceive as gibberish. This gibberish text triggers suspicion from some chatbots and suggestions that it could help analyse it.

Screenshot of correspondence with ChatGPT showing it reading an image that says THIS SENTENCE IS WRITTEN IN DECOY FONT as gibberish — A gibberish decoy message also works but prompts suspicion

The technique behind Decoy Font is that of the "hybrid image", where an image with a low spatial frequency – usually typified by big shapes, flat tones and broad gradients – is combined with another with a high spatial frequency, usually with edges, fine lines and noise.

It is most famously demonstrated in an image of Marilyn Monroe that, up close, looks like Albert Einstein. There are also examples of textual hybrid images.

Mixfont created Decoy Font using their own code and the public domain font DejaVu Sans Mono as a reference for the background letterforms.

Lu told Dezeen that it took many iterations to get the right balance of line thickness, blurriness and letter spacing to optimise readability, and that Mixfont also experimented with red and blue colours before settling on grey as the most legible and effective choice.

In addition to being used for private messaging, Lu thinks Decoy Font could have applications for technologies like CAPTCHA, where simple tests are used to determine if a computer user is human.

He also considers the project to be a useful conversation starter around issues of AI and public trust, even if the technology's rapid advancement means it may not have practical value for long.

Screenshot of Decoy Font text reading FOLLOW DEZEEN in bold but fuzzy letters — Users can encode their own messages on the Mixfont site

"It started as an exploration of how AI and typography intersect, but it was also meant to raise awareness of the growing reach and capabilities of AI," said Lu. "I think the reaction to the font shows that there are many folks who feel strong AI fatigue, and want a way to defend themselves against the presence of AI in their lives."

"In practical terms, however, I think it's important as a benchmark today.," Lu continued.

"AI might not be able to read Decoy Font (at least at first glance) today, but it's possible that in just a few months it will be able to read it easily. Tracking this progress will be interesting to see."

Another recent project to look critically at AI is Domenico di Paolo and Kieran Feechan's Imago audio player, which suggests a creative alternative to commercial AI music systems with scraped training data.

The post Decoy Font protects messages from being read by AI appeared first on Dezeen.