Eric Lu’s Decoy Font can make a human read one sentence while a vision model reports another, using blurred and sharp letterforms at different spatial frequencies. The trick is real enough to expose a weakness in multimodal AI, but its deeper lesson is harsher: static visual obfuscation is likely to become an arms race, not durable privacy.
Table of Contents
Mixfont’s Decoy Font presents a compact and unsettling result: the same image can carry two legible messages, with a human tending toward one and an AI model toward the other. In Mixfont’s published demonstration, the human-facing phrase “sleep early” is paired with the decoy “binge shows”; independent reporting says GPT-5.6 Sol and Gemini 3.5 returned the decoy rather than the intended human reading. Mixfont itself describes the project more cautiously, saying the font makes text harder for AI to read rather than guaranteeing concealment.
That distinction is the story. Decoy Font is not a new cryptographic primitive, and it does not make the underlying information disappear. It is an adversarial visual interface built around a gap between human perception and current machine perception. The gap is useful precisely because it is temporary. The project shows that frontier models can still lock onto the wrong visual scale, but it also publishes the mechanism needed to reverse the trick. Mixfont explicitly predicts that improving frontier models will increasingly learn to decode both messages.
The experiment works because two messages occupy one glyph
Each Decoy Font character combines two visual signals. Mixfont describes a thin, sharp foreground outline and a darker, blurred low-frequency mass behind it. The sharp layer carries the decoy character; the broader blurred layer carries the letter intended for human readers. Move farther from the screen or squint and the low-frequency form becomes easier to integrate as a whole. Stay close and the crisp contours become more prominent. One glyph therefore encodes two competing answers.
The technique matters because it does not simply add random noise around letters. Random noise asks a reader to recover one obscured symbol. Decoy Font instead supplies a plausible alternative symbol at another spatial frequency, so a vision system is not merely uncertain; it can be confidently wrong. In the Mixfont demo, the model-facing layer forms coherent text rather than gibberish. That is a stronger adversarial design because the false reading has linguistic structure and can satisfy a model’s expectation that it is looking at normal text.
The downloadable version is a TrueType font derived from DejaVu Sans Mono letterforms, and Mixfont also provides a web playground that lets users pair hidden and decoy messages. But the installable font should be understood as a rendering device, not a secrecy layer. Mixfont’s own page allows the rendered text to be copied, and the browser’s document model exposes textual content independently of how a font makes those characters look. A scraper that can access the underlying page text does not need optical character recognition at all.
The human side of the equation is also conditional. Mixfont tells readers who struggle with the hidden message to move the screen farther away or squint, a reminder that the intended reading depends on viewing conditions rather than being unambiguously dominant. Any stronger machine resistance can impose a usability cost on people, especially at small sizes, low contrast or on displays that render blur differently. That trade-off is part of the mechanism, not an implementation detail.
An old hybrid-image trick meets frontier vision models
Decoy Font’s optical principle predates modern multimodal language models by decades. In 2006, Aude Oliva, Antonio Torralba and Philippe Schyns formalized “hybrid images,” combining low spatial frequencies from one image with high spatial frequencies from another so that interpretation changes with viewing distance. Their paper explicitly links the effect to multiscale processing in human vision. The famous Einstein–Marilyn Monroe example is a popular demonstration of the same family of effects. Decoy Font moves that construction from faces to typography.
That inheritance helps explain why the font can work without any secret model-specific exploit. The input is deliberately ambiguous across scales. A human observer integrates broad blurred mass differently from a model pipeline that may prioritize crisp local structure. Mixfont reports failures on GPT Sol and Gemini 3.5 with Thinking, while an independent account identifies the OpenAI model in the demo as GPT-5.6 Sol. Google’s own May 2026 announcement confirms Gemini 3.5 as a current model family, and OpenAI’s documentation confirms GPT-5.6 Sol accepts image input.
The result should not be generalized into “AI cannot read text in images.” Modern multimodal systems are already strong OCR engines. ICCV’s 2025 CC-OCR benchmark evaluated ten prominent large multimodal models across 7,058 annotated images and found substantial capability alongside persistent weaknesses in grounding, orientation and repetition. NeurIPS 2025’s OCRBench v2 likewise found that most tested models still scored below 50 out of 100 across a deliberately difficult suite. Decoy Font targets a remaining failure mode inside a capability that is otherwise advancing quickly.
Those benchmarks do not test Decoy Font directly, so they cannot establish its failure rate. Their value here is contextual: visual text reading is neither solved nor uniformly weak. Performance depends on scene type, layout, resolution and task. That makes a two-message font credible as an edge case without supporting the broader claim that ordinary image text is now inaccessible to AI.
The decisive weakness is scale selection rather than language skill
The interesting part of Decoy Font is not that language models lack enough vocabulary or reasoning to infer what “sleep early” means. The failure occurs earlier: the system must decide which visual features constitute the letters before language reasoning can operate on them. If that perceptual stage selects the sharp decoy contours, later reasoning can be perfectly coherent and still produce the wrong transcription. A smarter language layer cannot recover evidence that its visual front end has already misread.
Ben Swift and Jess Herrington’s 2026 work on occlusion-edge blur points to a related phenomenon. Swift describes experiments in which multimodal models misjudge which of two overlapping shapes is in front, tending to follow a “sharp means close” heuristic even when human depth perception favors a blurred occluding edge. His Decoy Font follow-up applies a similar crisp-versus-blurred conflict to text and reports a controlled experiment across six vision-language models in which the models flip toward the crisp stream as blur increases. That suggests a systematic perceptual bias, not a one-off typo.
This distinction also explains why prompting can matter. If a model is simply asked to “read the text,” it may choose the most salient high-frequency stream and stop. If it is told that the image contains two spatial-frequency layers, an agent can try crops, resizing, filtering or code-based image analysis. Mixfont warns that models with stronger agentic and coding abilities may see past the initial lettering and that basic prompting can tell an agent to search for the hidden letters. Knowledge of the trick changes the task from perception to signal separation.
Hybrid images make another consequence predictable: resizing is not neutral. Because the two readings live at different spatial frequencies, changing resolution or filtering can alter which stream dominates before the model ever reasons about the words. A Decoy Font score is therefore partly a score of the whole image-ingestion pipeline—preprocessing, scaling and visual encoding—not only of the language model named in the interface.
Static obfuscation creates friction rather than secrecy
For publishers worried about automated image scraping, that friction can still have economic value. A crawler that normally sends screenshots straight to a vision model may get a wrong answer on the first pass. Forcing it to detect the font, run alternative preprocessing, compare multiple scales and spend more compute raises the cost of extraction. That is a rate-limiting tactic, not confidentiality. It may deter casual bulk collection even when it cannot stop a determined operator.
The boundary becomes clearer when Decoy Font is used as actual web text. Browsers retain the underlying character data in the document tree; MDN documents that a node’s textContent exposes the text of that node and its descendants. If a scraper can read the Document Object Model, styling does not hide the string. The visual defense matters chiefly when the text has been rasterized into an image, screenshot, PDF page or other representation where the attacker must interpret pixels. The threat model therefore matters more than the typeface.
This is the same reason Decoy Font should not be treated as encryption for private messages. Encryption protects content by requiring a secret key or equivalent cryptographic capability to recover plaintext; Decoy Font publishes both the data and the decoding clue in the same image. An observer who knows to separate low and high spatial frequencies can try to recover both. Mixfont explicitly says the font is “not a guarantee” and frames it as an initial point of confusion for AI, useful against scraping or casual observation rather than determined analysis.
Distribution format changes the economics as well. A rasterized social image forces a collector into vision processing, while live HTML can expose text directly and a downloadable font gives an analyst a stable artifact to study. Converting ordinary text into images can also reduce searchability and accessibility for legitimate users. Obfuscation shifts costs on both sides, so its value depends on who bears more of them.
The arms race already has a working countermeasure
The most important evidence against permanence arrived almost immediately. On July 16, 2026, a public GitHub Gist described a “Decoy font reader” that crops the target text, creates downsampled and Gaussian low-pass variants, separates the blurred low-frequency message from the sharp decoy and checks agreement across filtered versions. The author says the script recovered “DAY DREAM” from Mixfont’s example while identifying “PAY BILLS” as the decoy. That is not a peer-reviewed benchmark, but it is a concrete proof of concept.
The countermeasure is unsurprising because the font’s design is deterministic. Once an analyst knows that the human message lives in the broad low-frequency component, downsampling and low-pass filtering are natural operations. The model does not necessarily need to become “more intelligent” in a general sense; a preprocessing pipeline can transform the image into a representation where the intended letters are easier to recognize. This is an editorial inference from the published construction and the public decoder, not evidence that every Decoy Font sample is already reliably solvable.
History gives the same warning. Sang Mun’s ZXX typeface was created in the early 2010s to confuse OCR using camouflage, false marks, noise and crossed strokes. The Walker Art Center documented it as a deliberate attempt to make text scanning harder. Mixfont’s newer Ghost Font page now says modern AI can read ZXX easily and presents that obsolescence as motivation for moving the hidden signal into motion. Anti-machine typography has already shown that yesterday’s blind spot can become tomorrow’s routine input.
A natural response is to randomize the glyph pairings or vary blur, spacing and shape so that an attacker cannot learn one fixed codebook. That can increase work, but it does not remove the published invariant that one message is concentrated in lower frequencies and another in sharper structure. Randomness can harden an instance while leaving the attack class recognizable. The stronger defense must change the signal, not merely shuffle the alphabet.
Scrapers and CAPTCHA systems have stronger options
The CAPTCHA idea is therefore more interesting as research than as a deployment recommendation. Traditional visual CAPTCHAs are built on exactly the assumption Decoy Font exploits: a task is easy enough for humans but difficult for automation. The W3C’s CAPTCHA accessibility work notes both that many popular CAPTCHA techniques have lost security effectiveness and that interactive visual tests can exclude people with disabilities. Making letters harder for machines can also make them harder for legitimate users.
Modern bot defenses have been moving away from distorted-text puzzles for that reason. Cloudflare’s Turnstile, for example, says it can distinguish users from automated traffic without showing a traditional CAPTCHA, using browser and request signals plus non-interactive challenges. Its documentation describes proof-of-work, proof-of-space, browser API probes and other signals, with server-side token validation completing the flow. The stronger architectural principle is to combine signals rather than bet security on one perceptual gap.
For anti-scraping, the same logic applies. A publisher can use access controls, rate limits, robots policies where honored, authentication, watermarking, contractual controls and anomaly detection in combination. Decoy Font can sit on top as one layer that increases machine-reading cost, but it cannot replace controls that govern access to the underlying content. Its strongest practical niche is likely where the content must remain visually available to humans yet the operator wants to make commodity screenshot extraction less reliable. That is narrower than “AI-proof text,” but it is also more defensible.
CAPTCHA also changes the adversary. A benchmark asks whether a general-purpose model fails on an unfamiliar input; a security challenge assumes attackers will observe the mechanism, automate retries and tune specifically for it. A visual trick that succeeds zero-shot can still be a weak authentication primitive once millions of identical challenges provide training and debugging material. W3C’s long-running critique of visual CAPTCHA security makes that distinction especially relevant.
Newer models will help but more tokens alone will not
The user’s intuition that this may be “a matter of time” is well supported by the project’s own author. Mixfont says Decoy Font could serve as a benchmark whose difficulty changes as frontier models improve, and predicts those models will increasingly understand the illusion and decode both messages. The pace of model replacement reinforces that expectation: Google’s API documentation already lists Gemini 3.6 Flash and Gemini 3.7 Flash after the May 2026 release of Gemini 3.5 Flash. The target is moving on a timescale of months, not years.
But “more tokens” is not the clean explanation. OpenAI’s current image-capable model documentation confirms GPT-5.6 Sol accepts image input and supports higher reasoning effort, while OpenAI’s July launch emphasizes better performance from fewer tokens in several non-vision benchmarks. Image understanding also depends on how the image is encoded, resized, tiled and routed through the vision stack. Giving a model a longer reasoning budget can help it test hypotheses, but the decisive improvement may come from better visual representations or tool use rather than raw token volume.
Research on adversarial image protection points to the same arms-race structure. An ACL 2026 paper on ImageProtector showed that carefully constructed visual perturbations could push six multimodal models toward refusal responses, while Gaussian noise, DiffPure and adversarial training partially reduced the attack’s effect at a cost in accuracy or efficiency. The lesson is not that defenses always fail instantly; it is that attack and countermeasure co-evolve. Decoy Font belongs in that adversarial-robustness conversation, not in the category of permanent secrecy tools.
Agentic capability accelerates that cycle because the system can spend its budget on experiments rather than one transcription. More reasoning tokens may buy additional hypotheses, but a tool-enabled model can also write a filter, inspect several rescaled copies and compare candidate readings. In that setting, the important resource is not just token count; it is the number and diversity of perceptual transformations the system can try before committing to an answer.
Designers should treat Decoy Font as a benchmark not a lock
For designers, researchers and publishers, the most productive use of Decoy Font is to measure where a model breaks. A serious test should vary font size, blur radius, contrast, foreground thickness, compression, screenshot resolution, viewing scale and prompt wording, then report both the human reading rate and the machine reading rate. A single successful screenshot proves existence, not robustness. The benchmark becomes useful when the failure boundary is measured. This recommendation follows from the controlled blur sweeps reported by Swift and from OCR benchmark practice.
Model comparisons also need version labels and dates. “Gemini” or “ChatGPT” is too broad when families change quickly and hosted systems can update. Google’s deprecation page records multiple Gemini 3-series releases during 2026, while OpenAI’s GPT-5.6 documentation exposes model-specific capabilities and snapshots. Reproducible testing should record the exact model, image resolution, prompt, reasoning setting and whether tools or code were available. Without that metadata, a viral demo ages faster than the font itself.
There is also value in testing adaptive attacks rather than only naive transcription. The public low-pass decoder is one example. Another is to ask an agent to inspect the image at several scales or to generate filtered variants before answering. If the font survives those conditions while humans still read it comfortably, that is stronger evidence. If it fails, the result is still useful because it identifies which step closed the human-machine gap. This is the difference between an artful demonstration and a robustness evaluation that can teach model builders something.
Human performance belongs in the same dataset. If people need to squint, step back or retry while the machine fails instantly, the font may still be interesting but its usability penalty must be counted. A useful benchmark would measure accuracy and reading time for people alongside model transcription, then identify settings that maximize the gap without making the “human” channel impractical. Mixfont’s own viewing advice shows why that baseline cannot be assumed.
Its lasting value may be the blind spot it exposes
Decoy Font is unlikely to remain an effective barrier against capable, informed AI systems in its present static form. The creator says as much, public filtering code already demonstrates a route to recover the low-frequency message, and the history of ZXX shows how quickly anti-OCR typography can be overtaken. The defensible forecast is temporary advantage, not lasting immunity.
That does not make the experiment trivial. It reveals that machine vision can be highly competent while still making a different perceptual commitment from a human observer. Swift and Herrington’s related work suggests blur and edge structure can trigger systematic biases in multimodal models; OCRBench v2 and CC-OCR show that text-rich visual understanding still contains difficult edge cases even as average capability rises. Those are exactly the kinds of gaps that adversarial benchmarks are designed to expose.
The next durable step is unlikely to be a single “better anti-AI font.” Mixfont’s Ghost Font already shifts from static spatial frequency to temporal motion, which raises the cost of decoding but also invites new temporal-analysis countermeasures. The broader pattern is more important than any one design: human-readable, machine-resistant media will keep migrating toward whatever perceptual dimension models handle least reliably. Once that dimension becomes standardized training data or routine preprocessing, the advantage moves again. Decoy Font may become obsolete; the benchmark it represents will not.
That is the reason the project can matter after its “protection” stops working. Once a model reliably reads both layers, the former exploit becomes a regression test: future systems should preserve that capability across resizing, compression and tool settings. The useful artifact then changes from a defensive font into a record of a perceptual failure that model builders learned to close. In adversarial AI, obsolescence can be evidence of progress rather than proof that the experiment was pointless.
Questions readers are asking about Decoy Font
Decoy Font is an experimental typeface from Mixfont that overlays a blurred low-frequency letter with a sharper decoy letter. Depending on how the image is processed, a human can read one message while an AI vision model may transcribe another. Mixfont also offers a downloadable TTF version and a web playground.
Mixfont credits the project to Eric Lu. Independent reporting identifies Lu as the founder of the type studio Mixfont and describes the public demonstration released in July 2026.
The published demonstration says GPT Sol and Gemini 3.5 with Thinking failed to recover the hidden message, and independent reporting identifies the OpenAI model shown as GPT-5.6 Sol. That is evidence for the specific examples tested, not a universal benchmark across prompts, settings or later model versions.
The image carries information at different spatial frequencies. Humans can integrate the broader blurred letterforms, especially at greater viewing distance, while a model may prioritize sharper high-frequency contours. Hybrid-image research has long shown that perception can change when low- and high-frequency components are combined.
Sometimes, especially when the technique is known. A public proof-of-concept posted in July 2026 used downsampling and Gaussian low-pass filtering to recover the hidden low-frequency text from a Mixfont example. Mixfont also warns that agentic models with coding tools may overcome the initial deception.
No evidence supports treating it as a secure privacy mechanism. Mixfont explicitly says it is not a guarantee. If the underlying text exists in a webpage’s document structure, it can also be extracted independently of the font’s appearance. Sensitive communication still requires established security controls such as encryption and access control.
That is plausible, but model size alone is not the decisive variable. Better visual preprocessing, multi-scale perception, explicit knowledge of the trick and tool use can all improve decoding. Mixfont itself expects frontier models to get better at understanding the illusion over time.
It could be tested experimentally, and Mixfont mentions CAPTCHA as a possible direction. For production security, however, visual puzzles have accessibility and durability problems. W3C documents those limitations, while services such as Cloudflare Turnstile use multiple browser and risk signals instead of requiring users to decipher distorted text.
Its strongest use is as an adversarial benchmark and a source of temporary friction against naive image-reading pipelines. It gives researchers and designers a controllable way to test where human and machine perception diverge, while its limitations make clear why it should not be marketed as permanent AI-proofing.
Author:
Jan Bielik
CEO & Founder of Webiano Digital & Marketing Agency
This article is an original analysis supported by the sources cited below
Decoy Font: A TTF font that hides what you type
Established Decoy Font’s construction, downloadable TTF, published model demonstrations, stated limitations and the creator’s expectation that future models will decode it.
A typeface that tells the human one thing and the machine another
Independently documented the “sleep early” and “binge shows” example and identified the tested systems as GPT-5.6 Sol and Gemini 3.5.
Supported the distinction between visual font rendering and underlying text exposed through a webpage’s document structure.
Provided the original peer-reviewed basis for combining low- and high-spatial-frequency content so perception changes with viewing distance.
Gemini 3.5: frontier intelligence with action
Confirmed Google’s May 2026 launch of the Gemini 3.5 model family used in the Decoy Font demonstration.
Confirmed GPT-5.6 Sol’s image-input capability, reasoning settings, model identity and current API characteristics.
Provided benchmark evidence that modern multimodal models are strong visual readers but retain failures in grounding, orientation and repetition.
Established that difficult OCR-centered tasks still expose broad weaknesses across state-of-the-art multimodal models.
A typeface for humans, not machines
Supplied Ben Swift’s controlled blur experiments and the connection between Decoy Font and measured crisp-versus-blurred perceptual bias in vision-language models.
Grounded the security and accessibility limits of visual CAPTCHA systems and the case for non-interactive alternatives.
Provided a public, non-peer-reviewed proof of concept using downsampling and low-pass filtering to recover a hidden Decoy Font message.
Making Democracy Legible: A Defiant Typeface
Documented Sang Mun’s ZXX anti-OCR typeface and its original goal of frustrating automated text scanning.
Ghost Font: The Anti-AI Font Only Humans Can Read
Showed Mixfont’s move from static glyph obfuscation toward motion and its own demonstration that modern AI can now read older ZXX typography.
Documented a current CAPTCHA alternative that combines browser-side signals and non-interactive challenges rather than requiring users to decipher text.
Get started with Cloudflare Turnstile
Supported the server-side token-validation architecture used to separate bot defense from a single visual puzzle.
Established the rapid cadence of Gemini 3-series model releases during 2026, including 3.6 and 3.7 after Gemini 3.5.
GPT-5.6: Frontier intelligence that scales with your ambition
Provided OpenAI’s current account of GPT-5.6’s efficiency, reasoning modes and emphasis on getting more capability from fewer tokens.
Provided peer-reviewed 2026 evidence that adversarial image protections and their countermeasures trade effectiveness against model accuracy and efficiency.
| Citing this article? Brief excerpts are welcome. Please credit Webiano.digital, name the author where stated, and include a link to https://webiano.digital and to this original article. Full or substantial republication requires prior written permission. Read our Copyright and Content Use Policy. |
This article was prepared with the assistance of artificial intelligence tools. The content underwent expert human review, and Webiano Digital & Marketing Agency assumes editorial responsibility for its final version and publication.
