Ghost Font: How a Typeface Evades AI OCR While Staying Human-Readable

What Ghost Font Actually Does

Ghost Font is a typeface designed with a single, adversarial objective: remain perfectly legible to a human reader while rendering itself invisible to optical character recognition (OCR) engines. It is not encryption. It is not steganography in the traditional sense—there is no hidden payload inside a carrier image. It is a purely typographic attack on the feature extraction pipeline of machine vision models.

The font was released by Mixfont, an independent type foundry, as a conceptual project. The glyphs look slightly unusual—a bit like a hand-drawn serif with exaggerated stroke contrast—but a human with normal or corrected vision can read paragraphs set in Ghost Font at standard reading sizes without significant friction. Feed the same text to Tesseract, Google Cloud Vision, or AWS Textract, and the output is garbage: random character substitutions, empty strings, or hallucinated gibberish.

This is not a theoretical vulnerability. It works today against production-grade OCR systems that power document processing pipelines, archival digitization, and the text extraction layers of Retrieval-Augmented Generation (RAG) applications. For engineers shipping features that depend on accurate text extraction from user-uploaded images or PDFs, Ghost Font is a concrete failure mode you need to know about.

The Technical Mechanism: Exploiting the Human-Machine Gap

To understand why Ghost Font works, you have to look at how OCR pipelines process an image of text. The pipeline is roughly:

Ghost Font attacks the feature extraction and classification stages. It does this through three intertwined design choices:

1. Counter-space Manipulation

Every character has enclosed or semi-enclosed negative space—the hole in an 'o', the bowl of a 'b', the interior of an 'e'. OCR engines rely heavily on these topological features. Ghost Font systematically fills, fragments, or connects these counters in ways that confuse connected-component analysis. An 'e' might have its counter nearly closed, making it look like a blob to a binarized image. A 'B' might have its two counters connected by an almost-invisible stroke that a human ignores but a segmentation algorithm treats as a single region.

2. Stroke Disconnection and Micro-gaps

OCR binarization turns a grayscale image into pure black and white. The threshold matters. Ghost Font introduces hairline breaks in strokes—gaps of 1-2 pixels at 12pt rendered at 300 DPI—that fall below or right at typical binarization thresholds. A human visual system uses Gestalt continuity principles to close these gaps effortlessly. An OCR engine sees fragmented strokes and either fails to group them or groups them incorrectly, producing 'rn' where there should be an 'm', or 'cl' where there should be a 'd'.

3. Adversarial Letterform Similarity

Machine learning classifiers learn a manifold of letter shapes. Ghost Font pushes glyphs toward the decision boundaries of that manifold. A lowercase 'g' borrows structural cues from a 'q' and a 'y' simultaneously. An uppercase 'I' (eye), lowercase 'l' (ell), and digit '1' are already a classic OCR tripping point; Ghost Font amplifies this by making them nearly identical in their stroke skeletons while varying only subtle serif details that binarization erases.

The result is not a single point of failure but a cascade. The binarization stage loses information. The connected-component stage over-segments or under-segments. The feature vectors extracted are noisy. The classifier, even a modern LSTM or Transformer-based one, operates on degraded input and outputs low-confidence or incorrect predictions.

Why This Matters for Forward Deployed Engineers

If you are a Forward Deployed Engineer (FDE) or any engineer building document-heavy AI features, Ghost Font is a practical concern, not an academic curiosity. Consider these real-world scenarios:

• Invoice and Receipt Extraction: You ship a pipeline that takes user-uploaded receipts and extracts line items, totals, and vendor names using a Vision LLM or traditional OCR + regex. A malicious user or a competitor's system starts feeding documents set in Ghost Font. Your extraction accuracy plummets. If you haven't instrumented for confidence scores and edge-case logging, you ship bad data downstream to accounting systems. This is exactly the kind of problem you'd encounter when building an Invoice and Receipt Extractor That Turns PDFs into Structured JSON – the real world is messier than the happy path.

• RAG Over User Documents: You build a knowledge assistant that indexes PDFs from a customer's workspace, like a Notion Knowledge Assistant That Answers Questions from Your Workspace. If a subset of those documents uses Ghost Font, your chunking and embedding pipeline ingests corrupted text. Retrieved chunks are nonsensical. The LLM generates answers based on garbage context. The customer blames your model. The root cause is two layers deeper in the OCR stack.

• Web Scraping and Archival: You scrape competitor pricing pages or archive public records. A site could render pricing in Ghost Font via a CSS @font-face rule, making the text visible to shoppers but invisible to your scrapers. This is a soft anti-scraping measure that doesn't break the user experience.

• Adversarial Evasion of Content Moderation: A platform relies on OCR to scan user-uploaded images for policy-violating text. Ghost Font lets text pass through the automated filter while remaining human-readable. This is a direct circumvention of automated moderation pipelines.

The common thread is that FDEs sit at the boundary between AI systems and messy customer reality. When you're turning a messy customer problem into a shipped prototype in a week, you need to know which assumptions your prototype makes. "The text will be extractable by standard OCR" is an assumption. Ghost Font invalidates it.

How to Test and Use Ghost Font Today

You don't need to take the claims at face value. You can test this in under 15 minutes.

Step 1: Get the Font

Ghost Font is available for free download from Mixfont's project page. Download the .ttf or .otf file and install it on your system.

Step 2: Generate a Test Image

Open a document editor (Word, Google Docs, Figma, or even a basic HTML page). Set a paragraph in Ghost Font at 12-14pt. Export it as a PNG at 150-300 DPI. Include a control paragraph in Times New Roman or Arial at the same size.

Step 3: Run OCR

Use Python with pytesseract for a quick local test:

import pytesseract
from PIL import Image

# Load your test image
img = Image.open("ghost_font_test.png")
text = pytesseract.image_to_string(img)
print(text)

Compare the output for the Ghost Font paragraph versus the control. You'll typically see empty strings, random punctuation, or character soups like "J..l1|'" where the original text was a clean English sentence.

For a production-grade test, run the same image through Google Cloud Vision or AWS Textract using their free tiers. The results are often worse because cloud OCR applies more aggressive pre-processing optimized for standard fonts, which amplifies Ghost Font's adversarial properties.

Step 4: Test Against Vision LLMs

This is the critical frontier. GPT-4V, Claude 3.5 Sonnet, and Gemini Pro can all transcribe text from images. Their approach is different from classical OCR—they use end-to-end vision-language models. Run your Ghost Font image through their APIs. As of mid-2025, results are mixed. Some Vision LLMs read Ghost Font with 60-80% accuracy. Others fail nearly as badly as Tesseract. The variance depends on the model's training data and whether it has encountered adversarial typography during pre-training.

If you're building a SQL Analyst Agent That Answers Questions Over Your Database that also accepts document uploads, you need to test your specific Vision LLM endpoint against adversarial fonts. Don't assume it's robust.

Using Ghost Font Defensively

If you want to render text that is human-readable but machine-unreadable on a web page, use a CSS @font-face declaration:

@font-face {
  font-family: 'GhostFont';
  src: url('fonts/GhostFont.woff2') format('woff2');
}

.ocr-proof {
  font-family: 'GhostFont', serif;
}

Apply this class to text you want to protect from scrapers. Note: this is not a security boundary. A determined adversary can screenshot the page and manually transcribe it, or train a custom OCR model specifically on Ghost Font samples. It's a friction mechanism, not a lock.

The Balanced Take: A Tool, Not a Fortress

Ghost Font is clever, but it's important to calibrate expectations.

What it is: A typographic exploit that raises the cost of automated text extraction. It works against off-the-shelf OCR engines and creates meaningful friction for scraping pipelines. It's a practical demonstration that the feature spaces of human and machine vision are not aligned, and that this misalignment can be weaponized with nothing more than a .ttf file.

What it is not: A substitute for encryption, access control, or proper data governance. It does not prevent a human from reading the text. It does not prevent a human from manually copying the text. It does not prevent an adversary from fine-tuning an OCR model on Ghost Font samples and achieving high extraction accuracy. The adversarial properties are brittle—they depend on specific binarization thresholds, resolutions, and model architectures. Change any of those, and the evasion may break.

For FDEs, the takeaway is not "use Ghost Font everywhere." It's "understand the failure modes of your text extraction pipeline." When you build a document processing feature, add adversarial test cases to your eval suite. Include Ghost Font, CAPTCHA-style distorted text, low-contrast text, and handwritten samples. Measure extraction accuracy on these edge cases. Log confidence scores. Build fallback paths—if OCR confidence is below a threshold, flag the document for human review or route it to a Vision LLM that might handle the adversarial case better.

This is the same engineering rigor you'd apply when building a Multi-Agent Research Assistant That Plans, Searches, and Writes a Brief. You don't trust a single agent's output without verification. Don't trust a single OCR pass without verification either.

Ghost Font is a reminder that the boundary between "works in the lab" and "works in production" is where adversarial inputs live. If you're shipping document AI features to paying customers, those adversarial inputs will find you. The question is whether you've instrumented your pipeline to detect them before your customer does.

FAQ

Does Ghost Font work against Apple's Live Text or Android's on-device OCR? Results vary. On-device models use different pre-processing and are often tuned for real-world text on photos. Some read Ghost Font better than Tesseract; others fail. Test on your target platform.

Can I use Ghost Font in a commercial product? Check Mixfont's license. As of writing, it's distributed freely but you need to verify the specific terms for embedding in commercial applications or web fonts.

Will OCR engines eventually adapt to read Ghost Font? Probably, if it becomes a widespread adversarial tool. But the underlying principle—exploiting the gap between human and machine perception—is not going away. New fonts can be designed with new adversarial properties. This is a cat-and-mouse game, not a one-time fix.

Is this the same as CAPTCHA? Conceptually related but inverted. CAPTCHAs are designed to be easy for humans and hard for machines at the task of proving humanity. Ghost Font is designed to be easy for humans and hard for machines at the task of text extraction. The mechanism is different—Ghost Font is purely typographic, while CAPTCHAs often use distortion, noise, and semantic puzzles.

How does this affect accessibility? This is a legitimate concern. Screen readers don't use OCR; they read the underlying text from the DOM or PDF structure, so Ghost Font has no impact on them. However, users who rely on magnification or have visual processing differences may find Ghost Font harder to read than standard typefaces. If you use it defensively, provide a toggle to switch to a standard font.