Ghost Font Claims to Hide Text From AI While Humans Can Still Read It

A new visual experiment called Ghost Font poses a wonderfully simple question: can a written message be obvious to a person yet effectively invisible to an artificial intelligence system?

The answer, according to its creator, is sometimes. But the more revealing answer is that the boundary between human and machine perception is neither stable nor clean.

Ghost Font is a browser-based prototype from Mixfont that turns a short message into an animated field of dots. The letters appear through motion rather than through a conventional contrast between foreground and background. Pause the animation and the message seems to disappear into a static pattern. Let it move and a human viewer can often pick out the letterforms. The downloadable video also contains a decoy message intended to distract an automated system that tries to recover hidden content.

Mixfont describes the project as an anti-AI font, although it also acknowledges that this is not a font in the usual sense. There is no ordinary typeface file that a writer installs and selects in a document. Ghost Font is closer to a small visual encoding system that generates video. It combines moving dots, noise, and a false signal to exploit assumptions in current multimodal AI pipelines.

That distinction matters. Ghost Font is an intriguing demonstration of a perceptual gap, not evidence of a durable private communication channel. It says something useful about how today's AI systems inspect media. It says much less about what tomorrow's systems, or a determined analyst with the right tools, will be able to recover.

A message that exists in motion

Ordinary text can be read from one image. A letter remains a letter whether the page is still, photographed, or sampled as a single frame. Ghost Font changes that relationship by distributing the useful signal over time.

In the prototype, dots associated with the message move in a coordinated way while visually similar dots obscure them. Human vision is highly sensitive to common motion. When a group of elements travels together, the eye tends to perceive it as a shape even when any individual frame contains too much clutter to reveal that shape clearly. The animation effectively asks the viewer's visual system to separate a moving figure from a noisy ground.

This gives Ghost Font its central trick. A screenshot can remove the feature that carries the message. An AI system that samples a video sparsely, sends isolated frames to an image model, and then asks a language model to interpret the results may never receive the right evidence. The model can be capable of excellent optical character recognition and still fail because its input pipeline has discarded the temporal relationship a person sees.

The project page reports tests in which named AI configurations failed to recover the intended words, sometimes returning a decoy or inventing a message. It also says that models performed better when given a precise hint about the technique. That is an important admission. The result depends not only on model capability, but also on prompts, tools, frame rate, video handling, compute limits, and prior knowledge of the encoding.

There is a broader lesson here. People often speak about an AI model as if it directly sees a file. In practice, a system may resize it, compress it, select frames, extract text, call separate vision components, or summarize one stage before another stage reasons about it. A failure attributed to intelligence can instead be a failure of sampling or orchestration. Ghost Font is effective when it finds the weakest link in that chain.

Why the prototype should not be called secure

The project's own explanation is admirably direct on this point: encryption, not perceptual confusion, is the proper way to keep a message secret. Ghost Font raises the cost of automated reading under certain conditions. It does not establish confidentiality.

Once an observer knows that coherent motion carries the real message, several standard analysis techniques become plausible. A program could compare consecutive frames, estimate optical flow, subtract static or differently moving layers, cluster dots by velocity, or accumulate trajectories over time. A person could also record the animation and adjust playback speed, contrast, and compositing. The decoy may frustrate a general-purpose agent, but it is less useful once the decoder knows that a decoy exists.

This puts the experiment in the neighborhood of adversarial machine learning. An input is deliberately constructed so a machine system makes an error while a person still recognizes the intended content. The NIST taxonomy for adversarial machine learning treats evasion as a broad class of attacks in which inputs are manipulated at deployment time to change a system's behavior. Ghost Font is not presented as a formal attack study, but the same cat-and-mouse dynamic applies.

An evasion method is always judged against a threat model. Who is trying to read the message? What tools do they possess? Do they know how it was produced? Can they run local code? How much time can they spend? Does success mean perfect transcription, a probable keyword, or merely knowing that hidden text is present?

Ghost Font does not yet publish a threat model with those boundaries. Nor does the page provide a reproducible benchmark, a corpus of generated samples, blinded human results, error rates, model versions that independent researchers can verify, or tests against dedicated video analysis. The creator says the generation code is planned for release, which could make more rigorous evaluation possible. Until then, the reported trials are best understood as demonstrations, not comparative research.

The language of an anti-AI font can also imply a universal property that no visual trick can reasonably promise. Models change. Video-native systems are improving. Agents can write analysis code. A technique that survives a default chatbot upload today may fail after a pipeline update, or after one successful reverse-engineering effort is packaged into a reusable decoder.

For security-sensitive use, the conclusion is simple. Do not place passwords, confidential plans, personal data, or access instructions in Ghost Font and assume machines cannot read them. Obfuscation can be an artistic effect or a speed bump. It is not a substitute for authenticated encryption, access control, retention policies, or careful sharing.

The human side of “human-readable”

The phrase “humans can read it” compresses a very diverse population into one imagined viewer. Ghost Font's moving letters may be apparent to some people and difficult or impossible for others. Visual acuity, contrast sensitivity, attention, motion perception, reading ability, display quality, viewing distance, and cognitive load can all affect the result.

Motion itself creates accessibility concerns. Some users reduce animation because it causes distraction, nausea, or other symptoms. Others need more time to inspect text, magnify it, change its colors, increase spacing, or hear it through a screen reader. A message that disappears when paused conflicts with several of those needs. If a user must preserve motion to access the words, pausing is not an equivalent control.

The format also presents a fundamental tension with text alternatives. The W3C guidance on images of text recommends real, styleable text where possible and says that an image carrying words should provide the same words in its text alternative. That is good accessibility practice. Yet a correct text alternative would also make the supposedly hidden message immediately available to crawlers, assistive software, and AI agents.

This is not a minor implementation bug. It is a conflict between the product's proposed objective and inclusive communication. Hiding semantic content from machines also hides it from many tools people use to read, search, translate, quote, enlarge, or navigate information. Screen readers are machines. OCR can be an accessibility aid. Automated captions, indexing, and text extraction often benefit people as much as bots.

A public deployment would therefore need to decide what matters more in each context. An art piece can intentionally demand a particular kind of perception. A puzzle can provide an optional accessible solution. A security gate, workplace memo, public notice, or essential instruction carries a higher obligation. Using Ghost Font for consequential information without an accessible alternative would exclude readers and could undermine the reliability of the message itself.

The CAPTCHA suggestion on the project page illustrates the dilemma. A motion challenge might inconvenience automated solvers, but it could also block people with visual, cognitive, or motor disabilities. Modern accessibility practice generally favors risk signals and multiple paths over a single perceptual test. If the system offers an accessible alternative containing the answer, an agent may find that path too. The hard problem is not merely inventing a challenge that machines fail. It is distinguishing legitimate people from automation without making humans prove that they perceive the world in one specific way.

What remains unclear

The prototype makes a strong visual impression, but several basic facts remain open.

First, there is no measured human baseline. The page notes that the text is less legible than ordinary writing, yet it does not report how accurately people read it across ages, languages, devices, speeds, font sizes, or visual conditions. A claim about a human advantage needs both sides of the comparison. If AI accuracy falls sharply but human accuracy also falls, the useful gap may be narrower than the demo suggests.

Second, the AI testing method is not sufficiently specified for replication. The page shows examples and describes long reasoning attempts, but model names, access modes, prompts, sampling behavior, source video settings, and evaluation criteria would need exact documentation. Even a small change in whether a service accepts native video or extracts frames can determine the outcome.

Third, the limits of the decoy mechanism are unknown. It is unclear whether the decoy is generated in a predictable position or motion pattern, whether it can be separated statistically, and whether longer messages produce more recoverable structure. A decoy that fools an agent once may become a useful label for a supervised detector after enough samples exist.

Fourth, the prototype currently supports short messages. That keeps the visual demonstration manageable, but it leaves unanswered how the approach scales to paragraphs, punctuation, multiple lines, different scripts, or compressed social media uploads. Video platforms routinely alter resolution, frame rate, color, and bitrate. Those transformations could erase the human-readable signal or, conversely, make the motion layer easier for a machine to isolate.

Fifth, the local-processing claim should be understood narrowly. The page says typed data is not sent to a server and that generation happens locally. That is a useful privacy characteristic of the tool itself. It does not control what happens after a user uploads the resulting clip to a messaging service, cloud drive, social network, or AI assistant. Distribution creates a new set of data-handling rules.

None of these uncertainties invalidate the project. They identify the work required to turn a clever prototype into a defensible technical claim. An open implementation, a published sample set, preregistered tests, independent replication, and accessibility studies would make the experiment much more informative.

A warning for AI search and knowledge workflows

Ghost Font is also a compact demonstration of what organizations lose when information is readable only at the presentation layer.

Modern work produces context-rich output: meeting notes, decision records, research summaries, customer feedback, project updates, proposals, and operating instructions. Their value often comes later, when someone searches across them, traces a decision to its source, extracts an action item, or reuses a well-supported explanation. AI search and knowledge tools depend on machine-readable structure to do that work.

Put important text into a hostile visual encoding and the immediate audience may still understand it, but the organizational memory degrades. The message may not be indexed. A colleague may not find it months later. A meeting summary may omit it. A translation workflow may skip it. A compliance review may not detect it. A writer assembling a new brief may reuse the visible material around it while missing the concealed qualification.

That is not always undesirable. A temporary puzzle or a creative campaign may value ephemerality. But in business writing, hiding content from machines can produce a misleading split between what a person saw and what the record contains. Imagine a moving disclaimer inside a shared presentation, an exception embedded in a video meeting note, or a key condition that disappears from an exported transcript. Human reviewers may remember the point, while downstream systems operate on an incomplete version.

The issue runs both ways. If visual tricks become common, AI-generated summaries should disclose which portions of a source they could not parse. A confident summary of partially unreadable material is more dangerous than an explicit failure. Search systems should preserve links to original artifacts, expose extraction confidence, and let a human inspect the source in context. Human review works best when reviewers can see both the original and the machine-readable representation, not when one silently replaces the other.

Teams can reduce this risk with mundane but effective practices. Keep substantive text as text. Attach transcripts to videos. Store decisions and their rationale in searchable records. Preserve source files alongside derivatives. Mark extraction failures. Use visual styling to support meaning rather than as the only carrier of meaning. These habits make knowledge reusable without assuming that any model has perfect perception.

Provenance is a better question than invisibility

Ghost Font arrives at a moment when many creators are looking for ways to resist indiscriminate scraping, automated interpretation, and synthetic reuse. The emotional appeal is understandable. If machines can consume almost any ordinary text, a medium that reserves a message for human eyes feels like a reclaimed private space.

Yet invisibility is a fragile basis for trust. A recipient still needs to know who made the clip, whether it was altered, when it was created, and whether the visible message is the original one. Ghost Font does not answer those questions. Anyone who can generate a clip can place any words inside it. The perceptual difficulty may even make rapid verification harder.

Provenance systems pursue a different goal. The C2PA Content Credentials specification describes signed claims and assertions that can record aspects of an asset's creation and editing history. Such credentials do not declare that a message is true, and they do not stop a machine from reading it. They can, however, provide tamper-evident information about where an asset came from and what happened to it.

For real workflows, provenance and human review are usually more durable than attempts at machine blindness. A signed source, a traceable edit history, and a reviewer who can compare the artifact with its extracted text create multiple trust signals. The system remains useful even when AI perception improves. By contrast, an anti-recognition method loses its defining property as soon as a decoder catches up.

There may still be productive combinations. A creative visual treatment could carry a signed provenance record. An archive could retain an accessible transcript while presenting the animation as the primary experience. A review system could flag a video whose visible motion has no corresponding text extraction. The important move is to treat perceptual novelty, accessibility, security, and authenticity as separate dimensions rather than allowing one dramatic label to stand in for all four.

A useful experiment, not a settled boundary

Ghost Font succeeds most clearly as a provocation. It makes an abstract limitation of multimodal AI visible in a few seconds. People perceive continuity and common motion, while many deployed AI systems still encounter video as a stack of selected images. The demo exploits that mismatch with wit, then adds a decoy to expose how readily an automated reasoner can settle on a plausible wrong answer.

It also reveals why “for humans, not AI” is a difficult product promise. Humans do not share one perceptual interface. Machines are not limited to one model or one input pipeline. Accessibility tools and AI tools overlap. Attackers adapt. Useful knowledge depends on searchability, while trustworthy media depends on provenance and review rather than obscurity alone.

The right response is neither to dismiss Ghost Font because it can eventually be decoded nor to treat it as surveillance-proof typography. It is a prototype that identifies a temporary gap and invites better experiments. Its next phase should measure that gap: human reading accuracy, model performance under documented conditions, resistance to dedicated temporal analysis, behavior after platform compression, and outcomes for people using assistive technology.

If that evidence arrives, Ghost Font could become a valuable benchmark for video perception or a memorable teaching tool for adversarial media. Even if AI systems quickly learn to read it, the project will have made its point. Machine perception is shaped by pipelines and assumptions, and any workflow that relies on AI to understand human communication needs visible uncertainty, accessible source material, and a human path back to the original context.