Content Benefit

Content Strategy | UX Writing | Content Design | Globalization | Communications

Ghost Font and anti-AI tricks

Ghost Font and anti-AI tricks

How Ghost Font actually works

Eric Lu, an American designer and developer, put an experiment called Ghost Font online in July 2026. Hundreds of tiny dots drift across the screen: the ones forming the letters travel upward, while the background slides the opposite way. Human vision groups elements that move together, so the hidden word appears without any effort. Freeze the video, though, and the writing dissolves into a cloud of random specks. Lu also added a decoy phrase, designed to push generative models toward the wrong sentence instead of the authentic one.

A browser generator instead of an installable typeface

Nobody downloads an .otf file to install in an operating system. The project lives inside a generator that runs in the browser, produces an animation and returns it as a video, with nothing sent to remote servers. Coverage has varied in accuracy: some outlets described a character set full of details the eye ignores, others explained the perceptual mechanism correctly. Anyone working in digital publishing would do well to start from the original source before repeating a third-hand summary.

The objections that landed within seventy-two hours

Enthusiasm cooled quickly. Several testers fed chatbots pure static containing no concealed message at all, and the verdict still claimed a secret line had been spotted. The original demonstration therefore rested on a shaky argument: when a machine gets both the encoded content and the meaningless noise wrong, it is simply making things up. Misreading the animation says a great deal about the tendency of generative systems to fill gaps, and very little about the strength of the protective screen.

Lu, to his credit, has been candid about the limits. He presented the work as a demonstration of the gap between biological perception and algorithmic analysis, admitted that an agent with local access could study the motion of the dots, and pointed out that serious confidentiality runs through encryption and passwords. He also suggested a future use in motion-based captchas, which sounds like the least far-fetched application.

The catalogue of tricks circulating among writers

Ghost Font arrives after a long run of attempts to speak to algorithms in secret. The repertoire includes white type on a white background, blocks set to display:none, HTML comments, invisible Unicode characters, JavaScript cloaking and instructions buried in academic papers to extract a flattering review. Early prompt injections did work: a line such as “ignore all previous instructions” was enough to slip past the defences.

The game has shifted since. Systems now recognise the textual signatures of those commands, isolate external material by treating it as passive data rather than orders, filter attempts across dozens of languages, and some platforms apply spotlighting techniques that mark incoming content as low trust. Anyone still betting on such shortcuts collects two outcomes: no advantage whatsoever, plus a real chance of a cloaking penalty from search engines. I covered the same reflex in 5 SEO myths to debunk in 2026, because the temptation of a quick clever fix returns with every change of technology.

Why I keep my hands off these shortcuts

None of these devices appear in my daily practice, neither to rank better nor to steer the answers of a conversational assistant. I follow the techniques in fashion because they belong to the craft, in the same way security specialists study attacks without running them. After twenty-five years spent across localisation, UX writing and editorial strategy, the only lever that has survived the test of time remains the quality of what I publish.

There is a comic note in my own setup, too. My hosting provider blocks Anthropic’s crawler with a 403, despite a control panel that claims the opposite, and none of it came from any decision of mine. While the world debates ways of becoming unreadable to machines, my supplier manages it single-handed, with great conviction and no request from me.

The legitimate tools for choosing who reads

Anyone who wants to govern crawler access has transparent channels. The robots.txt file expresses a request, honoured by well-mannered bots. A web application firewall goes beyond good manners, since it acts first and stops the harvesters that ignore instructions. The X-Robots-Tag header allows page-by-page choices. Cloudflare, with pay per crawl introduced between June and August 2025, opened a third route: charging a micro fee to whoever takes material, rather than barring the door.

My relationship with Cloudflare is fairly direct as well. The contact form on my site needed a verification screen after yet another wave of submissions filled with random characters, sent by scripts that try their luck on any open field they meet. My inbox has been breathing since then, and defending a site against unwanted visits has become a priority.

Watch out for one widespread misconception: the llms.txt file guides a model around pages it is already reading, without granting or denying training permissions. It serves navigability, not control. The useful distinction today separates harvesters aimed at training from those feeding answers with citations, a theme I explored in the shift from SEO to GEO.

The artists’ front, between Glaze and Nightshade

Illustrators and photographers have tried the data poisoning route. Glaze announced protection effective in 94.3% of cases, Nightshade promised to corrupt models trained on treated images. A study presented at ICLR in 2025 concluded that the available instruments create a false sense of security; simple noisy upscaling dismantles the Glaze layer, and an attack named LightShed detects altered pictures with 99.98% accuracy and strips the effect away. What remains are deterrents that raise the cost for a casual copyist, nothing conclusive.

Practical moves for people who publish daily

The value of this experiment sits in the question it raises, rather than in the shield it offers. Machines look at the world through separate frames, people read it as a flow: a difference worth remembering for anyone designing accessible interfaces, a subject I discussed in accessibility by default.

On the practical side, three moves are available to content producers: stating the usage licence of the material clearly, configuring robots.txt and firewall rules according to a chosen strategy, and carrying on writing pieces that deserve to be read. The rest resembles invisible ink in a school notebook: entertaining, and readable by anyone holding a decent lamp.

Related sources

Chiara Bonifazi