Decoy Font can misdirect AI vision, but it cannot hide the text beneath

• Decoy Font combines a sharp decoy letter with a blurred intended letter, so the same rendered glyph can produce different readings at different viewing scales.
• Mixfont has shown examples involving multimodal AI systems, but it has not published the trials, prompts, model settings or error rates needed to measure reliability.
• The downloadable font leaves the underlying typed characters copyable, so it cannot stop a crawler that reads a page's text rather than its pixels.
• Hybrid fonts and anti-OCR typefaces predate this release; Decoy's practical distinction is its installable, static TTF implementation, not a new theory of visual masking.

Mixfont has released a free font designed to send machines toward the wrong letters. The experiment is a useful test of how multimodal models prioritize visual detail, but it is not a general barrier to scraping: its effect begins only after text has been rendered into pixels, and the creator acknowledges that informed agents may get around it.

A font that attacks the first visual reading

Decoy Font places two signals inside each glyph. Thin, sharply defined outlines carry a foreground decoy at high spatial frequency. A heavier, blurred form carries the intended letter at low spatial frequency. Close inspection favors the outlines; moving farther away or squinting can make the underlying message easier to see.

Mixfont made the design available as a TrueType font derived from DejaVu Sans Mono and licensed it for personal, commercial and client work, according to the project page. A contemporaneous account says Mixfont published the TTF on July 15. Another report on the release identifies Eric Lu as an AI researcher and Mixfont's founder.

The evidence for its effect is still a creator demonstration. Mixfont says screenshots steered ChatGPT, GPT Sol and Gemini 3.5 with Thinking toward the foreground letters. The retained project page gives no test corpus, number of attempts, prompts, model settings, image dimensions or character- and word-error rates. It therefore supports the claim that Mixfont observed misleading outputs, not a claim that the font consistently defeats those systems.

The same page supplies the most important qualification. Mixfont says agents with coding abilities may see beyond the initial lettering and that prompting an agent to look for hidden letters can reveal the other message. The creator describes the font as an initial point of confusion, not a guarantee.

One secondary report goes further, saying the font adds two randomly chosen decoy letters for every entered letter and that this prevents pattern-based decoding. That mechanism is not documented in the retained project description, which says only that the font prints a decoy for each letter. Without a specification or reproducible test, the stronger decoding claim should not be treated as established.

The underlying characters remain in reach

The font changes glyphs, not the character string that selected them. Mixfont demonstrates this directly: text displayed in Decoy can be copied and pasted into a notepad. A scraper that extracts HTML, a document text layer or copied characters therefore does not have to solve the optical illusion at all.

That divides deployment into three materially different choices:

The third route addresses access rather than perception. Cloudflare's AI Crawl Control documentation, for example, describes per-crawler allow and block choices, with a charge-per-successful-crawl option in private beta. Blocking is enforced through a Web Application Firewall rule on the customer's zone. Those controls can fail against traffic that is not identified as the targeted crawler, but they operate at the layer where a publisher can actually refuse a request.

Decoy's sticker price is simpler: the TTF is free. Yet turning text into an image to force a vision contest moves costs onto readers and publishers. A W3C accessibility technique says images of text cannot follow browser scaling, user-selected colors or operating-system high-contrast settings in the way real text can. The technique is one way to meet WCAG, not a mandatory implementation, but its tradeoff is directly relevant: the version of Decoy most resistant to text extraction is also the version that gives users the least control over presentation.

Human legibility is not a fixed property either. The project page tells readers who cannot resolve the intended message to move the screen farther away or squint. That may be acceptable for an experimental graphic, but the retained sources provide no reading-speed, error-rate or accessibility study showing that the visual burden reliably falls on machines rather than people.

The visual idea has a documented history

Decoy adapts a known perceptual method. A 2006 paper on hybrid images describes combining the low spatial frequencies of one image with the high spatial frequencies of another so interpretation changes with viewing distance.

More pointedly, that paper already includes a hybrid-font example. Its authors high-pass-filtered text and added low-frequency, text-like masking; in the reported example, the text was readable below one metre and unreadable at about two metres. Those distances describe that particular image and filter setup, not a benchmark for Decoy. But the example establishes that applying spatial-frequency masking to letterforms is at least two decades old.

The paper also discusses a 2002 text-masking study that superimposed four letters carrying energy at different spatial scales. Observers reported the visible letter changing as they moved away, although multiple letters remained visible at once and the result looked distorted. That is a closer precedent for Decoy's competing letterforms than a hybrid photograph alone.

Within the retained record, Decoy's practical contribution is to package a two-message design as a downloadable TTF that can be typed into projects and tested against multimodal AI systems. That makes the technique easier to use and distribute. It does not make spatial-frequency letter switching new.

There is also a longer lineage of fonts aimed at machine readers. In 2013, a profile of Sang Mun's ZXX described four freely downloadable styles that used camouflage blobs, noise, overlaid crosses and false secondary letters to exploit weaknesses in OCR. Mun presented that project as a way to make surveillance and privacy tangible; the profile called it a provocation rather than a true security measure.

Later work shows why visual attacks deserve testing without turning any one result into a universal score. The abstract of a 2018 adversarial-text study says minor changes to printed-text images caused a deep-learning OCR system to replace selected words with semantic opposites while preserving the meaning for human readers. The retained page does not contain the paper's methods or numerical results, so it cannot support a performance comparison with Decoy. It does show that machine-readable typography is an adversarial contest in which the recognizer and input pipeline matter.

The next decision is what Decoy is meant to protect

The font can be evaluated only against a defined route to the text. If the threat is a vision model looking at an unprompted screenshot, Mixfont has demonstrated a plausible speed bump. If the threat is a crawler reading selectable text, the same demonstration is beside the point. If the goal is to govern access or charge for crawling, a downloadable font provides no identity, permission or payment layer.

A meaningful next test would publish the font version, images, prompts and model versions, then report character and word accuracy across repeated trials. It would separate four outcomes: reading the intended message, reading the decoy, producing unrelated text and refusing to answer. Tests should cover both an unprompted first pass and a reader told that the image contains low- and high-frequency messages.

The human side needs the same discipline. Reading accuracy and speed should be measured at stated font sizes, image dimensions and viewing distances, with compression and screen scaling varied. Accessibility testing should include magnification, high-contrast settings and nonvisual access. Additional scripts should be tested before extending the creator's suggestion that character-based languages might benefit.

Until that evidence exists, Decoy Font's defensible value is narrow: it makes some rendered text visually ambiguous and may waste an automated reader's first attempt. Whether that friction is worth deploying depends on where the underlying characters remain available and whether the human audience bears more of the cost than the crawler.