Background & Context§
In an era where AI systems can effortlessly read and interpret static text—even heavily obfuscated fonts—a new experiment called Ghost Font aims to flip the script. Created by designer and researcher Eric Lu, Ghost Font is not a traditional TrueType font but a motion-based approach to graphical communication. It embeds a message in a video where the letters are formed by dots moving across a noisy background. When paused, the dots blend into the noise, rendering the text invisible. This design exploits the gap between human perception—which can integrate motion over time—and current multimodal AI models, which typically analyze video frame by frame without tracking object trajectories.
The significance of Ghost Font extends beyond a curious demo. It highlights fundamental limitations in how today's AI processes temporal visual data and raises questions about robustness in visual CAPTCHAs and AI benchmarks. As models like GPT-5.5 and Claude Fable (themselves hypothetical future models referenced in the experiment) continue to improve, Ghost Font provides a stress test for their ability to reason about dynamic scenes—a capability still in its infancy.
The News: What Happened Exactly§
Eric Lu released Ghost Font via an interactive web playground at mixfont.com where users can type a short message, preview it as a moving dot animation, and download a video clip. The core mechanism is deceptively simple: each letter is represented by a set of dots that move in a specific pattern. The dots are rendered in a color identical to the background, so a single frame appears as a random scatter of indistinguishable points. Only when the dots are in motion does a human eye perceive the letter shapes. This means that screenshotting the video yields no information—an immediate barrier for any AI that relies on static image input.
To test its resilience, Lu fed Ghost Font videos to several leading multimodal AI models, specifically naming Claude Fable and GPT Sol 5.6 Ultra (likely pseudonyms for cutting-edge systems). The results were striking: even after 19 minutes of analysis, one model hallucinated a completely false message. However, Lu acknowledges that a determined agent with a local code execution environment could theoretically track dot motion across frames to reconstruct the text. To counter this, Ghost Font includes a decoy message embedded in the video—a plausible text that appears as the true output when extracted via motion analysis. The real message is hidden elsewhere in the dot trajectories, requiring human-level contextual understanding to identify the decoy. This layered obfuscation proved effective: even advanced reasoning models failed to find the real message without explicit hints about the technique.
The playground operates entirely client-side; no data is sent to servers, ensuring privacy. Lu has also announced plans to open-source the video generation code, inviting further experimentation. He envisions applications in CAPTCHA systems (where motion-based challenges could replace easily cracked image puzzles) and as a benchmark for AI video perception. Currently, multimodal models process video as a sequence of frames; Ghost Font exploits this by making each frame uninformative. Future video-native models that integrate temporal continuity might solve Ghost Font, making it a moving target for AI progress.
Interestingly, the Ghost Font page includes a retrospective on ZXX, a 2013 font by Sang Mun designed to thwart OCR. ZXX camouflaged letters with noise, cross-outs, and false marks. While ZXX defeated OCR software of its time, modern AI models—like ChatGPT 5.5 (hypothetical)—can read ZXX text easily from a single screenshot. Ghost Font's motion-based approach is a direct evolution, resisting not only OCR but also the latest multimodal models.
Historical Parallels & Similar Incidents§
Ghost Font is not the first attempt to create AI-resistant text. In 2013, designer Sang Mun released ZXX, a typeface family with four variants: Bold, Camo, Noise, and X-Ray. Each variant added layered visual noise: strikethroughs, random dots, and false letter shapes. ZXX was hailed as "surveillance-proof," intended to prevent automated monitoring of printed documents and signs. At that time, OCR technology relied on clear, high-contrast letters; ZXX's noise patterns confused the heuristic algorithms. However, modern AI models, particularly those based on convolutional neural networks (CNNs) and transformer architectures, are far more robust to such noise. As Lu demonstrated, GPT-5.5 could read ZXX text in a single prompt, extracting even fine details. This illustrates a key lesson: adversarial techniques based purely on static image obfuscation have a short shelf life against rapidly improving AI.
Another relevant parallel is the CAPTCHA arms race. Early CAPTCHAs used distorted text that humans could decipher but machines struggled with. Over time, AI models using deep learning (e.g., Google's reCAPTCHA) broke these text-based CAPTCHAs, leading to the development of image-based challenges (e.g., "select all squares with traffic lights"). However, those too have been increasingly solved by AI, prompting a shift to more complex tasks like video or behavior analysis. Ghost Font's motion-based approach echoes the idea of leveraging temporal cognition—a dimension where AI currently lags. The implication is that moving targets may be more effective than static noise for keeping ahead of AI perception.
A third parallel comes from the field of steganography—concealing messages within other media. Techniques like hiding text in the least significant bits of an image have been used for decades. AI has advanced to detect such hidden messages through statistical analysis. Ghost Font bears similarity to steganography but adds a temporal component: the message is only visible in motion, and the decoy serves as a red herring. This multi-layered approach is reminiscent of modern anti-forensic methods that combine obfuscation, camouflage, and deception.
What all these parallels share is that they are reactive—designed to exploit current AI weaknesses. As Lu notes, the ultimate solution for communication privacy is encryption with a human-only key. However, for public-facing challenges like CAPTCHAs or AI benchmarks, Ghost Font offers a novel paradigm: using motion and decoys to create a gap between human and machine perception that may hold longer than static approaches. The historical lesson is clear: each past obfuscation technique eventually fell to AI improvements. Ghost Font's hope is that by adding motion and cognitive decoys, it buys more time—and inspires future research into truly human-centric communication.