Decoy Font: The AI-Resistant Font That Humans Can Read but AI Struggles to Understand (2026 Guide)

Imagine typing a sentence that reads perfectly clearly to any human and completely differently to ChatGPT or Gemini looking at the same image.

That’s the premise behind Decoy Font, a typeface that’s picked up a lot of attention since its release in mid-2026.

Decoy Font isn’t a hypothetical concept or a marketing gimmick; it’s a real, downloadable font built by an actual AI researcher, and it works by exploiting a genuine gap between how human eyes process images and how AI vision systems do.

This guide breaks down what it is, how it actually works, whether it holds up against today’s AI models, and where its real limits are.

What Is Decoy Font?

Decoy Font is a font that prints a decoy for every letter, making it harder for AI to read what someone has typed by using separate spatial frequencies to communicate two different letters in the same space.

It was created by Eric Lu, the founder of Mixfont and an AI researcher, who built Decoy Font along with an earlier related experiment called Ghost Font, which hides messages inside moving animations, both intended to explore the potential of “anti-AI” fonts for protecting text from being scraped or read by large language models.

Quick definition: Decoy Font is an experimental typeface built on the “hybrid image” illusion. Each character is actually two overlapping letterforms, one visible up close, one visible from a distance or when squinting, designed so humans and AI vision systems tend to lock onto different layers.

It went viral because it lands right at the intersection of two things people are increasingly anxious about in 2026: AI scraping their content, and AI vision models getting good enough to read text out of images that used to be considered “safe.”

Why Do People Want AI-Resistant Fonts?

The appeal isn’t abstract.

As multimodal AI models have gotten better at reading images, more people are looking for ways to keep written content readable by humans while making it harder for automated systems to extract, index, or act on it.

Common motivations include:

• AI scraping – preventing bots and crawlers from harvesting text for training data
• OCR resistance – blocking automated text extraction from scanned images or screenshots
• Content ownership – protecting original writing from being lifted wholesale
• Prompt injection defense – stopping hidden instructions in images from being interpreted the way plain text would be
• Digital privacy – keeping casual, human-facing messages out of automated pipelines

Industries where this resonates most: publishing (protecting article text), design (watermarking and provenance), research (studying AI limitations), and any organization wary of having its public-facing text quietly absorbed into a training set.

How Does Decoy Font Work?

This is the core of what makes Decoy Font interesting, and it comes down to a real, well-documented optical phenomenon rather than anything mystical.

The hybrid image technique

Decoy Font is built on the hybrid image technique, encoding a foreground message meant for a close read and a background message meant for a far read, both sitting inside the same glyphs.

This technique has been well studied through existing optical illusions, most famously, an image that blends Albert Einstein and Marilyn Monroe, where the image reads as one face up close and the other from a distance.

Decoy Font applies that same principle to typography instead of photography.

How the layers are built

The font layers two versions of an image on top of each other: one in thin, clear outlines in the foreground, and another in blurry, dark shapes in the background.

For every letter someone types, the algorithm adds two additional decoy letters, and the selection of each decoy is randomized rather than fixed, which makes the pattern harder to reverse-engineer automatically.

Why humans and AI tend to see different things

Humans can actually read both letterforms by shifting focus, squinting, or changing their distance from the screen, but they tend to perceive the dark background letters more vividly.

Current large language models, by contrast, typically read an image by analyzing pixels up close, which means they usually latch onto the sharper foreground outlines instead.

That mismatch, human eyes gravitating toward the low-frequency background shape, AI vision systems locking onto the high-frequency foreground edges, is the entire trick.

The Science Behind Decoy Font

The underlying science isn’t new; Decoy Font just applies it to a novel use case.

• Spatial frequency – every image contains a mix of low-frequency information (broad shapes, gradients, overall form) and high-frequency information (sharp edges, fine lines, texture). Human vision is naturally better at picking up low-frequency information from a distance.
• Hybrid images – a technique for layering a low-frequency version of one image with a high-frequency version of another, so perception of the result depends on viewing distance or focus.
• Edge detection – most computer vision and OCR systems are tuned to find crisp edges and outlines, which is exactly the layer Decoy Font puts in the foreground.
• OCR limitations – traditional optical character recognition expects clean, unambiguous glyph shapes, which makes it particularly susceptible to being pointed at the “wrong” layer.

This is also, notably, adjacent to the broader field of adversarial examples in machine learning, inputs deliberately crafted to cause a model to misclassify or misread something a human would interpret correctly.

Can ChatGPT and Other AI Models Actually Read Decoy Font?

This is the question most people actually want answered, and the honest answer is: it’s mixed, and it’s already shifting.

Mixfont tested Decoy Font against ChatGPT and Gemini 3.5 with Thinking, and both models failed to read the hidden message in a static image, latching onto the decoy text instead.

Testing has shown that these more advanced models struggle to decode the hidden messages and instead focus on the foreground decoy layer.

But that’s not the full story, and it’s important not to overstate it.

Why Decoy Font Isn’t Truly “AI-Proof”

This is where a lot of coverage gets sloppy, so it’s worth being precise: Decoy Font is not a security measure, and its own creator doesn’t claim it is.

Mixfont’s own creators have warned that AI agents with more advanced coding and vision capabilities could get around the illusion.

In other words, a plain chat-based AI reading a static screenshot is a very different test than an agentic system that can run code, apply its own image-processing filters (blur, frequency separation, contrast adjustment), and effectively “un-hybridize” the image before attempting to read it.

Once you give an AI system the ability to manipulate the pixels itself, the advantage largely disappears, because the trick relies on the default way a model looks at an image, not on any fundamental blind spot.

Myth vs. reality:

Myth	Reality
Decoy Font makes text unreadable by AI, period	It defeats the default reading behavior of several current chat-based models, not systems built specifically to defeat it
It’s a form of encryption	It’s an optical illusion technique, not cryptography; there’s no key, just a perceptual bias to exploit
No AI will ever read it	Mixfont itself flags that agentic or vision-tuned systems can likely bypass it, and this will only get easier as models improve
It’s foolproof against scraping	A determined scraper can apply basic image preprocessing (blur, frequency filtering) to recover the hidden layer

Real-World Use Cases

• Artists and designers experimenting with typography that behaves differently depending on who, or what, is looking at it
• Researchers studying the gap between human and machine perception as a live, ongoing demonstration
• Anti-scraping experiments for creators who want a lightweight, non-cryptographic way to make casual scraping harder
• AI safety and robustness testing, using it as a small, concrete adversarial example to probe how current vision models handle ambiguous input
• Security demonstrations, illustrating, in a very visual and intuitive way, why “the model can see the image” doesn’t mean “the model sees the image the way you do”

Benefits of Decoy Font

Benefit	Why It Matters
Privacy-by-friction	Raises the bar for casual, automated text extraction
Research value	Gives a concrete, visual demonstration of current AI vision limitations
Creative potential	Opens up new territory for typography that plays with perception
Free and accessible	Free to use in personal, commercial, and client projects, distributed as a standard TTF
Public awareness	Helps non-technical audiences intuitively grasp how differently AI “sees” versus how humans see

Limitations and Challenges

• Not encryption: there’s no secret key; anyone (human or machine) with the right processing can recover the hidden layer
• Doesn’t stop a determined actor: as noted above, agentic AI or basic image preprocessing can defeat it
• Accessibility concerns: a font designed to be perceptually ambiguous is, by nature, harder to read for some users, including those with visual impairments
• Practical readability: reading it typically requires the reader to move the screen away or squint for the hidden word to emerge, which isn’t ideal for normal reading conditions
• Printing and rendering: the illusion depends on specific rendering and viewing conditions; results can vary across screens, print, and zoom levels
• A moving target: as AI vision models improve, techniques like this have a limited shelf life by design

Decoy Font vs. Other AI-Resistant Techniques

Technique	Human Readability	AI Resistance	Practicality
Decoy Font	Easy (with slight adjustment)	Moderate, works on default model behavior, not agentic systems	High, free TTF, drop-in use
CAPTCHA	Easy	Moderate	Medium, disruptive to UX
Digital watermarking	Easy	Low (not meant to block reading)	High
Adversarial images	Hard	High against specific models	Low, brittle, model-specific
Basic image distortion/noise	Medium	Medium	Medium

The Future of AI-Resistant Typography

Decoy Font is part of a small but growing wave of “anti-AI” typography experiments; Mixfont’s earlier Ghost Font, for instance, obscures messages using motion rather than a static image.

The broader interest in this space is tied directly to how capable AI models have become at reading images, and a rising desire to keep human-facing text out of automated pipelines.

Realistically, this is likely to stay a cat-and-mouse dynamic rather than a solved problem: as vision models get better at frequency-aware or agentic image analysis, techniques like this will need to evolve, much like adversarial-example research in machine learning generally.

Don’t expect any single font to be a permanent fix; expect a continuing back-and-forth between perceptual tricks and model capability.

Should You Use Decoy Font?

Good fit for:

• Designers and artists exploring perception-based typography
• Researchers demonstrating AI vision limitations
• Casual anti-scraping friction on non-sensitive content
• Creative or experimental projects

Not a good fit for:

• Anything sensitive or confidential
• Legal or contractual documents
• Financial or banking information
• Authentication or security-critical use cases

If you need real security, this is not that tool; treat it as a perceptual novelty and a legitimate research artifact, not a privacy control.

Conclusion

Decoy Font became popular for a simple reason: it’s a hands-on, visual, and genuinely clever demonstration of the gap between how humans and AI vision systems process the same image.

It solves a very specific, narrow problem, nudging default AI image-reading behavior away from a message, without pretending to be a security solution.

What makes it worth understanding isn’t that it “beats AI.”

It reveals, in a very tangible way, where current AI vision has blind spots and how quickly those blind spots close as models get more capable.

Decoy Font isn’t about defeating AI forever; it’s about surfacing the fascinating differences between how humans and machines perceive the same visual information, and as AI vision keeps improving, this kind of experiment will keep shifting the conversation around privacy, typography, and human-centered design.

FAQ