The web’s newest weapon against AI scrapers is a font

Ars Technica 报道，面对 AI 爬虫对全网内容的无差别抓取，一种思路截然不同的防御工具出现了：不是屏蔽爬虫，而是让爬虫“读到”错误的内容。ShieldFont 的核心思路是利用人类视觉与机器文本提取之间的差异——将网页上的文字以特殊方式渲染，人眼看到的是正常可读的字符，但底层文本编码被替换为完全不同的内容，使 AI 爬虫抓取到的数据失去训练价值。

这一做法本质上是一种“数据投毒”策略。与 robots.txt 声明或 IP 封锁等传统手段不同，ShieldFont 不阻止访问，而是主动降低被抓取数据的质量。如果大量网站采用类似方案，依赖公开网页作为训练语料的模型可能面临“垃圾进、垃圾出”的风险——模型在训练时无法有效区分哪些文本是真实的人类语言，哪些是被字体“伪装”过的噪声。原文未提供该字体的具体技术实现细节（如字符映射规则、是否开源、兼容性范围等）。

从落地影响来看，对普通网站运营者而言，这提供了一种低门槛的“软防御”选项：不需要维护复杂的反爬规则，只需在页面样式中替换字体即可。对 AI 开发者来说，则意味着数据清洗环节需要额外考虑“字体层投毒”这一新的污染向量——仅靠 URL 过滤或内容去重可能不够，还需检测文本编码与视觉呈现之间的一致性。不过原文未提及 ShieldFont 的实际部署规模、对搜索引擎收录的影响，以及是否可能被滥用为 SEO 黑帽手段，这些仍有待观察。

ShieldFont 概念配图

AI companies' penchant for scraping through large swathes of the public web in search of valuable training data has already led to lawsuits and technical fixes aimed at stopping the practice. Now, a pair of designers are hoping to stymie these scrapers with a new font designed to offer people a perfectly readable webpage while serving scrapers a subtly edited, nonsensical version in the underlying HTML.

ShieldFont, as designers Isaque Seneda and Gabriel Abrucio write in a recent white paper, was made to offer web publishers "a practical opt-out from unauthorized AI training and [to] disrupt what is collected when that choice is ignored."

When is a horse a potato? The font is based around ligatures, a long-standing feature of many fonts that is usually used to replace certain letter pairs with a more readable version when they're smushed up next to each other. With ShieldFont, though, those ligatures are instead used to replace entire words with others in an attempt to destroy the text's value to scrapers. This substitution only happens when the font engine draws the page on screen, meaning scrapers that simply download plaintext source code get an altered version that end users never see.

Read full article

Comments