Open source project fools AI scrapers with poisoned font If you don't want AI scrapers training themselves on your website, there's a new way to stop them that doesn't involve server-side blocking or praying they respect your instructions in robots.txt. A team of creatives have teamed up with a typography company to create a new type of font that’ll trick LLM scrapers into ingesting …
"Screen readers used for those with visual impairment also have trouble with it too". Presumably it also fails (I.e. displays the raw nonsense version rather than the "real" content) if you override the site's suggested font, whether that's for accessibility, personal preference, or any other legitimate reason.
Sounds like a cute tech demo but completely impractical for real use.
Assuming those "are you human" detectors still work and aren't fooled by AI scrapers they could deliver the real content to humans (including those with visual impairment) and the slop to AI. Alternatively, if there is some way for browser fingerprinting to determine the user is visually impaired (maybe based on use of specific plugins or something?) they could serve them the real stuff.
Sadly I think this, like the font approach, will be a waste of time and effort. Static, permissionless, and open methods of defence against scraping - plugins, fingerprinting and encoding using scripts/fonts etc -will **never** work against AI long term, because it only needs one model developer to feed the scraper the solution to cracking it - and this becomes another tool that the scraper can call when it sees something that looks like nonsense.
For example a simplistic prompt to break tte original approach might be:
- check the first paragraph of text against known language and grammatical models to see if it makes sense
- if it doesn't, check the page for use of non-standard fonts
- if the page does use non-standard fonts, call up a headless browser, navigate to the page, capture the coordinates of each piece of text, take screenshots of each element
- for each screenshot, run OCR against it to extract the 'decrypted' text.
As a defender you can create more clever tarpits and rabbit holes to slow them down, but the scrapers - that are themselves capable of calling the models they've trained - have the benefit of unlimited perseverance and the ability to optimise against any widespread approaches the world uses against them.
The only approach I can think of that I can see working is to introduce enough subtly poisoned disinformation to the corpus of training material to reduce the utility of the models using it to its users.
I think this is inevitable if you use such a method. Also a simple copy/paste from a user wanting to keep some text from the page will fail.
I am using Anubis web firewall to try and stop scrapers. Of course it might not work, but at least a human can still copy/paste my pages if they like.
Screen reader user here. If they work, meaning you're in a normal browser, JS running normally, they're accessible enough. Basically, if what you're doing when you hit them is either waiting for them to complete or checking a box or pressing a button, that part is fine for a screen reader as well. Screen readers don't generally expose that they are running to websites because it would be a serious fingerprinting method that the users can't get away from, so running one doesn't increase your likelihood of failing the automated check.
The story is a bit different if CloudFlare has a reason not to like you. If you use a browser or browser settings that they don't like and thus don't automatically pass them, then the next step is a captcha. I'm not sure if it's site-specific or just random, but this captcha is frequently visual only, with the "solution" for visually impaired people being to create an account and get a tracking cookie you have to give to whoever wants it to be allowed to browse. I would argue this is illegal, but they've been doing that for years. Occasionally, they had audio captchas, though I have not seen one in some time, and text captchas, which I have seen intermittently and are very annoying, but at least they don't require I identify myself to browse open sites.
If it breaks copy and paste and screen readers and non-compliant browsers and anything else, then it is more trouble than it is worth.
The AI bubble will burst or deflate. We just have to get the popcorn in and wait.
I'll be celebrating when it does, as we can consign those Cloudflare human checks to the dustbin of history. Slower and more annoying than cookie checks.
The AI bubble may burst but there is absolutely no chance AI tools are going to disappear. Like many bits of new tech, the challenge is how to make useful/popular tech profitable. We had this with facebook and twitter where everyone was using it but it didn't make money, with web search, with online maps, etc.
And yes, this font thing is an interesting technical tidbit but it's clearly not going to go mainstream. If it breaks basic stuff like copy-paste, F3 (search), etc it's a gimmick. And clearly, AI can quite easily learn to deal with this if it became wide-spread.
completely impractical for real use
Sadly this sort of tech is increasingly in real use. You don't even need to be visual impaired to quickly hate it. A single word you want lookup in a dictionary, a name, a journal reference, a technical word that demands Wikipedia or literature seach, and so on, you're out of luck. It's not even really that you can't copy-paste a tiny bit of text, it's that you expect to be able to and you're most of the way through the action before it's failed, feeling like an idiot because you've pasted a nothing into Google and hit return instinctively, and then you have to think your way around it which inevitably ends with tabbing back and forth checking to see if you've spelt some awkward Swiss name correctly.
I really think this kind of tech can do one. Any version of it that gets popular will be defeated automatically by scrapers and only inconvenience humans.
Maybe the better way is to have a surreptitious "authentic user" test, e.g. detecting for mouse movements or humanish navigation, and if it isn't received, then insert garbage into the page. It could even be styled so it's not visible usually but be garbage all the same. Maybe even use AI to generate the garbage.
You don't want to insert garbage into the page. You want to insert plausible looking misinformation so the AI will provide its own users with plausible looking misinformation (which they already do quite a bit). That way the human users of AI will find they are wasting a great deal of their own time double checking and correcting everything the AI tells them and eventually get fed up and stop using it.
I have personal experience wasting time on AI advice on how to use audio software that told me to use options that don't exist, never existed, and for which there are no plans for creating. They were simply figments of the AI's imagination. It all looked very plausible though, with the AI providing definitions, examples, and explanations that were consistent and very real looking. They were simply entirely made up however. I now know to google for examples and explanations that are written by real humans who actually know something about the subject.
If you are pretty sure that you are dealing with an AI, the answer may be to somehow use another AI to create plausible looking misinformation to feed to the opposing AI. This may be a very worthwhile area of AI research for someone interested in the subject.
The problem there is still the presumption that the consumer of your html is either a) a "real genuine human" interacting with the webpage in a way that you expect "real genuine humans" to do so, or b) an evil AI bit that must be stopped. Consider the following:
1. accessibility devices/screen readers/etc
2. search engines
3. browser plugins (ever head of tampermonkey?)
4. legitimate crawlers (maybe I'm a researcher trying to map usage of the phrase WibblySplong across some set of websites. I've written little scripts that "curl https://ticket-sales.com | grep "Tickets available" to run via cron and mail me. Yes there are still plenty of sites where that works today, though obviously none of the big ones)
5. web archive tools
6. etc etc etc
I'll end by quoting the opening sentence of the RFC 1866 abstract: "The Hypertext Markup Language (HTML) is a simple markup language used to create hypertext documents that are platform independent. (emphasis mine)
Around here the Americans with Disabilities Act implies web pages need to follow Web Content Accessibility Guidelines. There are automated scanners to verify the guidelines are followed and it is tedious. Lots of information and web pages have been removed because it is too much trouble to get the page to pass.
There are similar scanners for PDF files. For example, next year every thesis and dissertation will need to pass an accessibility scanner before a student can graduate.
I've been hoping chatbots get to the point where people who can't see or can't hear are automatically on equal footing as everyone else. That would make it so much easier to make web pages and PDF documents.
Isn't a concern here that the LLM doesn't "know" it's ingesting garbage, and will happily tokenise away, increasing the probability that regurgitation generates nonsense.
Hooray, you may say, this will make people more cautious about trusting LLM output, and they will be more inclined to cross-check sources or reject the technology altogether. Except I sincerely doubt that'll be what actually happens. Do we really want more idiots filling their heads with plausible- (or even implausible-)sounding nonsense? Some of these people may even have a vote.
To be clear by garbage I mean plausible misinfo, in the style of that proposed using fonts. i.e. coherent, readable sentences that almost make sense but mislead the AI into ingesting it, poisoning it in the process. Of it's consuming images then throw some fakes in there too. Depending on the nature of the website and its general trustworthiness this could do a heap of damage to the model.
I think the people who made this and those who will deploy it don't mind the damage they could do to LLMs and LLM users, if not seeing it as a bonus. I am not concerned about that damage, though I wouldn't go to the effort of intentionally causing it. I don't have concerns about misleading users because LLMs are already unreliable and likely always will be. I could argue that, the more nonsensical the output, the more obvious that will be so damage saves people from better LLMs which sound more plausible but still emit inaccurate text, but whether that is true or not, I mostly think that users of LLMs have made their choice, can change their mind at any time, and the consequences are for them to deal with. I am also unconcerned about damage to LLM providers because it is the responsibility of those who make the things to manage the quality of their training data, training techniques, and post-training refinement, not me as the writer of text they ingest without permission.
My argument was precisely that this is not what will happen. That this will, rather, just nudge us further towards idiocracy.
(And no, I don't give a stuff about damage to LLM providers either.)
> I don't have concerns about misleading users because LLMs are already unreliable and likely always will be.
More of a Bad Thing is not just a Bad Thing – it's a Worse Thing.
Some of us here read email in plain text, because HTML is a security hole (and just a damn nuisance).
We do not need special fonts to read ordinary English text.
This abuse of basic IT standards is yet another way of forcing us to use HTML email readers and thereby expose us to their security holes.
You are assuming that the class of people and organizations that send HTML emails* are capable of understanding the distinction between web pages and email and that if they understand, they care.
* HTML email is, and always was, a spectacularly dumb idea as it is a huge potential security problem
You are assuming that the class of people writing HTML emails give a speck of poo about what a tiny minority of snobby malcontents think about HTML email. While you may have a technical point you represent a market(ing) share that makes Linux desktop users look significant.
It's also ridiculously patronising to think only people who don't know about tech use HTML email. You just show your own bias and ignorance.
If all this is doing is substituting letters, I doubt that this will work... An LLM will simply treat it as a foreign language. And there's a lot more non-English language content than this stuff.
What it will do is mean that your Google search ranking will go to zero, because your website won't match anything users are looking for, and doesn't appear to be in the user's native language.
No, it won't, because all the words will be recognizable English ones and the grammatical parsing will also look like English. Language detection methods would certainly categorize it as English, so unless they have another model trying to guess whether the content is plausible, it would not be sorted as any other language using the tools they already employ.
Seems shieldfont is an npm based creation. A quick hop to github threw cold water on my plans to tinker with it. While the poisoning the scraping is a fantastic idea, one will have to take great care if you build you own rather than using the prebuilt CDN, and even then, you are relying on the CDN build catching any poisoned npm packages in the chain before the latest build is made public. I guess that comes with the territory when it's javascript that is being extended, I just wish I had more confidence in the package manager. After the recent rash of install script and bun poisoning AUR (was/is) dealing with, care is certainly required.
"SheildFont could also impose an SEO penalty on people who use it, as search engines, like AI scrapers, read the raw HTML to look for content, as do translation apps and the copy/paste function built into computer operating systems. Screen readers used for those with visual impairment also have trouble with it too, though there is a feature built in to ensure screen readers can get the user-displayed text, albeit slowly. "
So, you get a hefty font file, tank your hard-won SEO, exclude and / or piss off visually impaired users (which might even be illegal) and you STILL can't guarantee it will keep the bots at bay. How very useful. Not.
Seriously, if you hate the bots that much, and you care so little about actual users, just shut down your site - that will fix those pesky scrapers, eh?
On my site, you have to write certain characters into some text boxes and do not tick the I am a human checkbox. Doing this sets a cookie. Having the cookie lets you in. Without the cookie, you'll just be asked for the magic incantation, unless you're a whitelisted search engine bot.
It is custom code (just a little dollop of PHP) and my site traffic plummeted massively. While some scrapers can be devious, most are thicker than a dozen short planks.
Note: two part s of the design criteria were "works on anything from NetSurf to Lynx" and "doesn't require any third party anything".
Every blind or visually impaired person will absolutely hate anyone who implements this, unless there's a way for Jaws or other screenreaders to 'render' ShieldFont into real text.
Clearly no-one thought "Hmmmm, what else might be reading the plain HTML...". Yet more eminently stupid ideas from people who don't think further than their own screens.
P.S. I am not visually impaired or blind, but I do care *very much* about making sure websites stay accessible to those visually impaired or blind.
This post has been deleted by its author
I think you'll find that the people using this don't think AI can bee improved and don't care about helping LLM creators to try. Since LLMs improving is not the change they want to see in the world, they're not breaking your preferred rule. Some of them want LLMs to stop thrashing sites, whereas those who chose this may actually want to see those that continue to do so worsen, so they are in fact promoting the change they prefer if this works long-term which I doubt.
It's a good idea and I wish the authors well, but this is likely to be used by the same people who absolutely demand that you have JavaScript etc. enabled so that their dodgy content is fully enabled.
A user who prefers to have as much scripting etc. as possible disabled- certainly when he first visits a website with which he's unfamiliar- will see content indistinguishable from AI hallucination.
The results resemble those from a procedure devised by the Oulipo, a French literary-mathematical workshop, called "S+7" (or "N+7" in English), in which each noun is replaced by the seventh noun following it in a dictionary. My favorite example is Harry Mathews' version of Wordsworth: "I Wandered Lonely as a Cloud" becomes "I wandered lonely as a crowd / That floats on high o'er valves and ills / When all at once I saw a shroud, / A hound, of golden imbeciles..." I see real possibilities! (Re: "The Imbeciles": https://www.theatlantic.com/past/docs/issues/2002/04/rose.htm )
A rhyming dictionary would be good. Usually you try to pick a slim dictionary. Bilingual ones are very good. The Atlantic article says Mathews used Langenscheidt's Standard English-German Dictionary. If I had it sitting around here I'd count the distance between "crowd" and "shroud..."
