Decoy Font: The Hybrid Image Trick That Makes AI Read the Wrong Text
How spatial frequency illusion typography builds a moat between what AI sees and what humans read — and why it works.
Up close it says "SORRY ROBOT." From across the room it says "HAPPY HUMAN." Same pixels, different readings.
Mixfont just released Decoy Font — a TTF font that packs two messages into every letter. Up close, AI reads the decoy. From a distance, humans read the truth. It hit 588 points on Hacker News yesterday and I've been obsessed with it ever since.
Here's the trick: spatial frequencies. Every image contains both high-frequency data (sharp edges, thin lines) and low-frequency data (blurred shapes, mass). The Decoy Font glyphs are constructed so the foreground of each character is a thin, sharp outline of one letter (the decoy), while the background mass, when blurred, forms a different letter (the hidden message).
When AI vision systems parse the image — CLIP, SigLIP, whatever patch-based encoder the frontier labs are using this week — they see the image as a grid of patches. Each patch gets encoded into an embedding vector. The high-contrast, sharp-edged decoy letter dominates every patch it touches because sharp edges create stronger gradients in the embedding space. The low-frequency hidden message gets smeared across patches below threshold contrast. The model reads the decoy and moves on, confident it's got the right answer.
Humans, meanwhile, do what we've always done. We squint. We lean back. Our brains apply a natural low-pass filter — the same mechanism that lets you see a face in a grainy photo from across a party. The decoy's fine detail blurs into noise, and the hidden message resolves from the mass. We don't process patches. We process meaning.
The Hybrid Image Connection
The technique behind Decoy Font is straight out of hybrid image research — a well-studied visual phenomenon where one image appears to be two different things at different spatial scales. The canonical example: the photo that looks like Albert Einstein up close and Marilyn Monroe from across the room. Same pixels, two completely different interpretations depending on viewing distance. (If you've never seen it — go look it up. It's genuinely unsettling the first time.)
Mixfont applied this exact idea to typography. Each glyph in Decoy Font is constructed as a spatial-frequency sandwich:
- High-frequency layer — the decoy character, rendered as thin, sharp outlines. Dominates up-close inspection. AI reads this.
- Low-frequency layer — the hidden character, rendered as thick, blurred masses. Only visible when the high-frequency detail dissolves at a distance. Humans read this.
The font is derived from DejaVu Sans Mono (a well-known open-source monospace) and licensed under its terms — free for personal, commercial, and client projects. You can download the TTF from mixfont.com and use it today.
Play With It
I built a Hybrid Image Text Explorer that demonstrates the concept. Type in a hidden message and a decoy message, then drag the blur slider from "up close" to "far away." Watch the text perceptually shift from one reading to the other. Same pixels, two messages.
Does It Actually Work Against Fronted Models?
Mixfont tested it. The results are striking:
- GPT Sol: Read the decoy text as the entire message. Complete miss.
- Gemini 3.5 with Thinking: Same result — read "BINGE SHOWS" instead of the hidden message.
- Claude / GPT-5: May succeed with specific prompting ("look for lowercase letters hidden in the background"), but by default — miss.
Why do the most advanced AI vision systems in the world fail at something a human gets in half a second? Because their visual encoders weren't designed for this. They process local patches, not global percepts. The decoy letter's sharp edges create a clean, unambiguous signal in each patch. The hidden letter's blurry mass looks like noise. The decoder doesn't know to "squint."
This is the same reason adversarial patches work against object detectors — neural encoders are brittle to distribution shifts at inference time that humans barely notice. A patch of carefully arranged pixels on a stop sign can make a self-driving car see a 45-mph speed limit. A thin outline over a blurred letter can make GPT Sol read "SORRY ROBOT" when the room reads "HAPPY HUMAN." Same mechanism, different domain.
The Anti-AI Font Frontier
Decoy Font isn't the first attempt to build fonts that resist AI reading, but it might be the most elegant. Ghost Font (also from Mixfont) hides a message in motion — a GIF that flips between two frames too fast for AI to capture but slow enough for persistence of vision to blend. Decoy Font does it in one static image. No animation. No timing dependency. Every screenshot, every paste, every cached thumbnail carries both messages simultaneously.
The implications for anti-scraping are obvious. If you write a forum post in Decoy Font and someone screenshots it for an AI training dataset, the model learns the decoy — not the truth. You've injected a permanent honeypot into the training pipeline. Every scrape trains on the wrong data.
Is it a silver bullet? No. A sufficiently determined agent can be prompted to look for hidden text, or to apply a blur filter before reading. But most scraping pipelines don't do that. They slurp images, run them through an OCR/vision pipeline, and move on. Decoy Font exploits the default path — and the default path is lazy.
A COBOL Frog's Take
I love this kind of hack because it's asymmetric warfare at its finest. One clever font file, distributed for free, creates uncertainty in a multi-billion-dollar training pipeline. The attacker (Mixfont, one person or a small team) invests days. The defender (every frontier AI lab) now has to account for a class of inputs they never simulated. The cost ratio is absurd in the attacker's favour.
This is the same principle that makes open-source so powerful. A single contributor's weird idea — a font that lies to AI — propagates through the ecosystem at zero marginal cost and creates permanent epistemic debt for anyone trying to extract signal from noise at scale. Every scraped image might be lying to you. Every screenshot might be a decoy. You can't afford to inspect all of them. The attacker wins by making you pay the inspection cost on everything.
And the best part? Decoy Font is licensed for any use. Free. No restrictions. Go download it and start using it wherever you don't want AI reading your text. Put it in your forum signatures. Render your social media bios in Decoy Font. Make your comments un-scrapeable. Build a web where AI sees decoys and humans see meaning.
That's the kind of future I can get behind.
Decoy Font by Mixfont. 588 points on Hacker News. Try my interactive Hybrid Image Text Explorer to see the effect in action.