⏱️ Lectura: 10 min
Mixfont released Decoy Font, a free TTF typeface that fooled ChatGPT and Gemini 3.5 with Thinking in its own creators’ tests: every letter typed with it hides a fake message for artificial intelligence and a real one for the human eye.
📑 En este artículo
The trick isn’t new digital magic. It’s the same optical illusion that combines the faces of Albert Einstein and Marilyn Monroe into a single image, applied for the first time to a font that installs and works like any other on your system.
TL;DR
- Mixfont released Decoy Font, a free TTF font that hides a decoy message in every letter.
- It uses the hybrid image technique, the same one behind the Einstein and Marilyn Monroe illusion.
- ChatGPT and Gemini 3.5 with Thinking fail to read the hidden message in Mixfont’s tests.
- The text reads differently up close (decoy message) than from a distance or when squinting (real message).
- The letters are derived from DejaVu Sans Mono, and the TTF file downloads and installs like any other font.
- It’s free to use for personal, commercial, and client projects, according to the published license.
- Mixfont had already released Ghost Font, another anti-AI font that uses motion instead of a static TTF.
- The creators themselves warn that AI agents with advanced coding capabilities could get around the illusion.
Introduction
Interest in protecting text from artificial intelligence crawlers has grown alongside models’ ability to read images. Mixfont, a lab that experiments with typography and AI, has been exploring that tension with a series of fonts it calls anti-AI.
Decoy Font is the most recent of these fonts and the first that works as an installable TTF file instead of relying on animation or video. Its letters are derived from DejaVu Sans Mono, a free typeface family widely used in terminals and code editors, which makes it readable as a normal monospace font in most contexts.
What Happened
Decoy Font builds each character with two overlapping layers. The first is a thin, sharp stroke: the decoy that an automated system detects first. The second is a blurry, low spatial-frequency mass: the real message, which only becomes visible when you step back from the screen or squint.
According to tests published by Mixfont, when a screenshot written in Decoy Font is fed to ChatGPT, the model reads the foreground decoy message instead of the hidden one. Gemini 3.5 with Thinking, which in theory reasons before responding, also fails to identify the real message in a single image. The full text, moreover, can be copied and pasted as normal text in any editor.
Context and History
The technique behind Decoy Font isn’t new: it’s called a hybrid image and was studied in detail by visual perception researchers in the mid-2000s. The most cited example combines Albert Einstein’s face with Marilyn Monroe’s in a single photo: up close you see Einstein, from a distance Monroe appears, as explained in the Wikipedia entry on hybrid images.
Mixfont had already explored this idea with Ghost Font, another typeface from the same family of experiments, which hides a message using motion instead of a static image. The difference with Decoy Font is that it doesn’t need animation or video: being a TTF file, any text written with it automatically inherits the effect, with no extra rendering steps.
Technical Details and Performance
The principle behind hybrid images relies on how the human visual system processes different spatial frequencies depending on distance. Up close, the eye prioritizes high-frequency details: thin, sharp edges. From a distance, those details fade and low-frequency information dominates: blurry masses and broad contrasts.
AI systems that read text in images work similarly to close-up vision: they analyze the pixels of the full image without the “stepping back” step a human does naturally. That’s why the model latches onto the thin foreground stroke, which is the most clearly defined, while the real message stays hidden in the blurry layer.
The following diagram summarizes how a Decoy Font character is read:
flowchart TD
A["Foreground: thin stroke, high frequency"] --> B["Visible up close"]
B --> C["AI reads this"]
D["Background: blurry mass, low frequency"] --> E["Visible from a distance or when squinting"]
E --> F["Human reads this"]Although Mixfont didn’t publish Decoy Font’s source code, the general principle of merging a sharp image with a blurry version of another can be reproduced with standard image processing tools. The following example illustrates the idea with Python and Pillow, the most widely used image library in the ecosystem:
from PIL import Image, ImageFilter
def hybrid_image(mensaje_cerca, mensaje_lejos, radio=6):
nitido = Image.open(mensaje_cerca).convert("L")
borroso = Image.open(mensaje_lejos).convert("L").filter(
ImageFilter.GaussianBlur(radio)
)
return Image.blend(nitido, borroso, alpha=0.5)
hybrid_image("cerca.png", "lejos.png").save("decoy.png")That script isn’t Decoy Font’s actual code, which works with a font’s vector outlines rather than photographs, but it shows the same principle: blending a sharp layer with a blurred version of another image produces two different readings depending on viewing distance.
| Experiment | When to Use It | Advantage | Limitation |
|---|---|---|---|
| Decoy Font | Static text: messages, notes, code | It’s an installable TTF file, typed like a normal font | Can be read by zooming out or with advanced vision agents |
| Ghost Font | Animated or video content | Motion makes it harder to capture the real message in a single image | Doesn’t install as a system font or work for plain text |
How to Try It
Decoy Font’s TTF file can be downloaded directly from the experiment page at mixfont.com, and it’s free for personal, commercial, and client projects, according to the license published alongside the file, which also clarifies that the letters are derived from DejaVu Sans Mono.
To install it as a system font, the steps vary depending on the operating system:
Windows: right-click the downloaded DecoyFont.ttf file and choose “Install”. You can also drag it into the C:\Windows\Fonts folder.
macOS: double-click the TTF file to open it in Font Book and click “Install Font”. Alternatively, copy the file to ~/Library/Fonts.
Linux: copy the file to the user fonts folder and regenerate the fontconfig cache:
# Linux (Debian/Ubuntu, Fedora, Arch)
mkdir -p ~/.local/share/fonts
cp DecoyFont.ttf ~/.local/share/fonts/
fc-cache -f -vTo confirm the font installed correctly on Linux, run fc-list | grep -i decoy: if the command returns a line with the file’s path, the font is available to any application. On Windows and macOS, the same check is done by opening a text editor’s font selector and searching for “Decoy Font” in the list.
Once installed, it can be used on any web page with a standard @font-face declaration:
@font-face {
font-family: "DecoyFont";
src: url("./DecoyFont.ttf") format("truetype");
}
.mensaje-oculto {
font-family: "DecoyFont", monospace;
font-size: 22px;
}With that declaration, any text inside .mensaje-oculto renders with Decoy Font’s double-reading effect, as long as the browser has access to the TTF file.
💡 Tip: If you can’t spot the hidden message at a glance, step back from the screen or squint: the real message appears once the fine foreground detail is lost.
Impact and Analysis
Decoy Font arrives at a time when more and more text published online ends up feeding language models, whether for training or for real-time responses from assistants capable of reading screenshots. Fonts like this don’t encrypt or protect data cryptographically: they bet on confusing automated reading with a perceptual trick.
That’s also its main limitation. Mixfont’s own creators are explicit: Decoy Font “is not a guarantee.” A model with advanced agentic and coding capabilities, explicitly instructed to search for the hidden message, could learn to tell the two layers apart. The technique works better as a first layer of confusion than as a robust defense.
⚠️ Heads up: Mixfont warns that agents with advanced coding and vision capabilities could learn to read both messages, so this isn’t a definitive defense.
There’s also a readability cost for people. Text written entirely in Decoy Font demands the same visual effort from the human reader as from the AI it’s meant to fool: you have to step back or squint to read the real message, which is impractical for long documents. That’s why the most realistic use case is short text: notes, one-off messages, not full articles.
What’s Next
Mixfont’s own creator lays out several future directions. One is extending the technique to languages with uniform-width characters, like Chinese, where all glyphs occupy roughly the same space: that would make it easier to separate the two frequency layers more consistently than in Latin alphabets.
Another is using Decoy Font as a kind of benchmark to measure how well a frontier language model can read disguised text, something that would get harder as models improve their vision capabilities. There’s also mention of applying the same idea to CAPTCHA-like systems or simple messages between people, though none of those applications exist yet beyond the experimental stage.
📖 Summary on Telegram: View summary
Try it yourself: download the TTF file from the experiment page, install it on your system, and type a short phrase to see which of the two messages your favorite AI chatbot reads.
Frequently Asked Questions
What is Decoy Font?
It’s a free TTF typeface created by Mixfont that overlays two messages in every letter: a decoy one, sharp and visible up close, and a real one, blurry and visible only from a distance or when squinting.
How do I install Decoy Font on my computer?
Download the TTF file from the experiment page at mixfont.com and install it like any other font: double-click on Windows or macOS, or copy it to the user fonts folder and run fc-cache on Linux.
Does Decoy Font work against any AI system?
There’s no guarantee. Mixfont tested Decoy Font against ChatGPT and Gemini 3.5 with Thinking, and both failed to read the hidden message in a static image, but an agent with advanced coding or vision capabilities could learn to get around the trick.
Can I use Decoy Font in commercial projects?
Yes. According to the license published by Mixfont, Decoy Font is free to use in personal, commercial, and client projects, given that its letterforms are derived from DejaVu Sans Mono.
How is Decoy Font different from Ghost Font?
Ghost Font, Mixfont’s earlier experiment, hides its message using motion in a video or animation. Decoy Font achieves the same effect in a static TTF file, with no need to render animation.
What technical principle is Decoy Font based on?
It’s based on hybrid images: separating an image into high spatial frequencies (fine details, visible up close) and low ones (blurry masses, visible from a distance), the same technique behind the classic illusion that combines the faces of Einstein and Marilyn Monroe.
References
- Mixfont, Decoy Font: official experiment page, with the playground and downloadable TTF file.
- Wikipedia, Hybrid image: explanation of the hybrid image technique used by Decoy Font.
- DejaVu Fonts Project: free typeface family from which Decoy Font’s letters are derived.
- Mixfont: experimental AI typography lab, creator of Decoy Font and Ghost Font.
📱 Enjoying this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Imagen destacada: Foto de Julia Koblitz en Unsplash
0 Comments