Stumbled across a few projects building fonts and images that work as optical illusions for neural networks. A human looking at the screen easily reads "Happy human," while the robot sees something completely different — like "Sorry, robot."
Algorithms don't see the world through our eyes. They rely on raw computation and can't grasp context the way the human brain does. Confusing their architecture programmatically is currently one of the main ways to protect your content from scraping.
Here are a few projects that elegantly exploit vulnerabilities in modern AI models:
Decoy Font: spatial frequency manipulation
A font from the Mixfont team. Each character has two layers of data baked in. The "decoy" is made of thin, high-contrast lines, while the real text is formed by lower-contrast, chunky shapes in the background.
Computer vision models are trained to focus on sharp pixel edges (high spatial frequencies). So the algorithms instantly read the fake text. The human brain, on the other hand, filters out the thin lines when you step back from the screen a bit, and reads the hidden message with no effort.
Ghost Font: temporal blindness in models
A prototype by researcher Eric Lu. Not a static font — it's a video illusion where the message is formed purely through the motion of many dots.
Human perception effortlessly integrates motion, building readable shapes out of noise. Most multimodal AI systems still analyze video not as a stream but by extracting static frames. In any individual frame, Ghost Font contains only noise and the static decoy the author planted. In tests, flagship models spent a long time analyzing frames and ultimately hallucinated with full confidence.
Image protection: Glaze and Nightshade
Text illusions are part of a broader field — adversarial design. Similar vulnerabilities are actively exploited to protect visual data from being parsed.
Tools like Glaze and Nightshade apply mathematical noise to images. To a normal viewer the art looks unchanged, but computer vision reads a different style or completely misclassifies objects (seeing a bag instead of a dog, for instance).
These projects go well beyond concept demos for next-gen CAPTCHAs (even though current agents can't reliably solve a regular one). They're the first real mechanisms that let creators protect their content from automated algorithmic scraping.
They also highlight a serious problem with current systems. Machine vision still can't achieve holistic understanding of context and dynamics — it remains stuck on straightforward statistical pixel analysis.