A font that shows AI scrapers a different message than it shows you
Decoy Font exploits the gap between how AI and OCR systems read pixels up close and how humans perceive spatial frequency from a distance, showing each one a different message from the same text.
Decoy Font hides one message behind another using spatial frequency, then exports the result as an image or TTF.
Decoy Font is a downloadable TTF and web experiment from Mixfont. Each glyph combines two letters, so a person can read one message while an AI vision system or OCR pipeline may report the decoy.
What is Decoy Font?
It is an anti-AI font experiment built from DejaVu Sans Mono letterforms. Mixfont lets you enter a hidden message and a decoy message, shuffle the pairings, export an image, or download and install the TTF. The published license allows personal, commercial, and client use.
How the decoy text works
Each character overlays two spatial frequencies. Thin, sharp outlines carry the high-frequency decoy. A blurred, low-frequency mass carries the hidden letter. Up close, the outline wins. Farther away, or when you squint, the coarse shape becomes easier to see. It is the same hybrid-image trick used in the well-known Einstein and Marilyn Monroe illusion, applied to type.
Mixfont tested screenshots against ChatGPT and Gemini 3.5 with Thinking. In its examples, both systems read the foreground decoy instead of the hidden message. That is a useful demo, not proof that every model, image size, or OCR pipeline will fail.
Is there a Decoy Font generator?
Yes, but it is a pair-and-preview tool rather than a system that designs a new typeface from a prompt. The Decoy Font playground takes a hidden message and a decoy message, previews the result, and exports an image. The same page also has the installable TTF.
Where it fails
Decoy Font is obfuscation, not access control. A model can be prompted to look for both layers. An agent with image-processing or code tools can separate frequencies. A scraper may also collect the underlying text, CSS, font file, or accessibility content instead of reading a screenshot. Do not use it for passwords, private messages, customer data, or anything that needs encryption.
Why a build studio cares
The experiment is a clean example of a larger engineering rule: the same page can expose different information through pixels, markup, accessibility APIs, and network responses. A defense that fools one reader may leave the others untouched. Our prompt injection audit uses the same approach: map every input and permission boundary before trusting the visible result.
Next step: try Mixfont's live Decoy Font demo with your own message, then test the exported image against the exact OCR or vision model you care about. For an agent workflow that needs real permission boundaries and evals, see how GattyWorks builds AI workflows.