Ghost Font: Text That Humans Can Read But AI Cannot

What if you could send a message that no AI could read - but any human could? That's the premise behind Ghost Font, an experimental project from the team at Mixfont that shot to the top of Hacker News this week.

The concept is clever: encode text into video in a way that exploits fundamental differences between how humans and AI models perceive visual information. Individual frames show nothing but static noise. But when played back, the human eye perceives the hidden message through motion.

How Ghost Font Works#

Ghost Font isn't a font in the traditional sense - there's no TTF file you can install. Instead, it's a browser-based tool that generates video files encoding your message through three mechanisms:

Motion-based encoding: The text is composed of dots that move in patterns humans can perceive but that remain invisible when any single frame is captured. Each frame contains only random noise, so screenshotting reveals nothing.

Decoy messages: Every video includes a false message embedded in a way that AI models can detect. When a model analyzes the video frame-by-frame (as most current multimodal models do), it finds and reports the decoy rather than the real message.

Local processing: Everything runs client-side - you type your message in the browser playground, preview it live, and download the resulting video. No data hits any server.

The technical approach exploits a key limitation in how current AI vision models work: they analyze video one frame at a time rather than perceiving continuous motion the way humans do. As one HN commenter noted:

This 'font' exploits the fact that current-gen frontier models will process video one frame at a time, but each frame is noise, so looking at frames in isolation doesn't reveal anything.

What HN Is Saying#

The thread generated over 90 comments with predictable splits between skepticism, technical curiosity, and accessibility concerns.

The skeptics pointed out this is likely a temporary measure:

If it becomes important, AI can be taught to read it. So... usefulness?

This is accurate. Within the thread, multiple users demonstrated that with the right prompting or preprocessing, models could be coaxed toward breaking the encoding. One commenter shared that Anthropic's Claude Opus 4.8 could read the decoy message from a single frame, though it couldn't decode the actual hidden message from video.

The technically curious started breaking it immediately. One user posted a complete Python script using OpenCV's phase correlation to detect the background motion and extract the hidden message:

# Estimate background motion between frames with phase correlation
(dx, dy), response = cv2.phaseCorrelate(a, b)
# Motion-compensate frame b, then take absolute difference
# The background cancels; the letters light up

The key insight: the background noise scrolls vertically at a constant rate, while the noise inside the letters doesn't follow that motion. Average the residuals over a few frame pairs, and the text emerges.

The accessibility advocates raised valid concerns. Multiple users reported struggling to read Ghost Font:

I'm colourblind and this was very difficult to read. If it's the directions to the resistance hq, I'd put in the effort. If it's the manifesto, I just wouldn't read it.

Another noted:

"humans can read" - lol. Barely.

This echoes a broader pattern with adversarial anti-AI techniques: they often degrade the human experience too. CAPTCHAs became harder for humans as AI got better at solving them.

The Arms Race Continues#

Ghost Font sits in a long tradition of adversarial techniques trying to separate human and machine perception. The CAPTCHAs of the 2000s. The "AI-generated content" watermarks we're starting to see. The endless cat-and-mouse between spam filters and spammers.

Several commenters drew this connection:

Sadly another shot in the arms race that captchas started which just leads to increased inaccessibility. It's interesting work for sure, but the end goal of separating out AI versus human consumers is tough.

The fundamental problem is that any technique humans can decode, AI can eventually learn to decode too - especially with enough training data. Ghost Font works today because multimodal models weren't trained to correlate motion across video frames in this specific way. That could change.

Practical Applications?#

Despite the skepticism, there are plausible use cases:

Short-term communication privacy: For messages where you need temporary secrecy from automated scanning (think: protest coordination, whistleblower tips), a technique that buys even a few months before AI catches up might be valuable.

Research value: Understanding the gaps between human and machine perception helps both AI development and AI safety. As the Mixfont team notes, this is "a research project" - exploring the boundaries of machine vision is worthwhile even if the specific technique doesn't last.

Creative/artistic applications: Several commenters mentioned video games and art that exploit similar perceptual tricks. The "game that disappears when you pause it" uses related techniques. There's a genre of motion-dependent visual art waiting to be explored.

Steganography in plain sight: Embedding hidden messages in seemingly innocent video has obvious applications in scenarios where communication itself might be monitored.

The Bigger Picture#

Ghost Font is a clever hack that exploits current AI limitations. It won't work forever. But it raises interesting questions about the future of human-machine communication.

As AI perception improves, will there always be perceptual gaps we can exploit? Or will AI eventually perceive everything humans can perceive - and more?

For now, Ghost Font is a fun demonstration of where today's AI still falls short. The human visual system, with its motion-based perception evolved over millions of years, can still do things that billion-parameter models trained on internet-scale data cannot.

That window is probably closing. Enjoy it while it lasts.

Try It Yourself#

You can experiment with Ghost Font at mixfont.com/ghost-font. Type your message, download the video, and see if your favorite AI model can decode it. Based on the HN thread, results vary significantly by model and prompting strategy.

Continue Reading#

• Flipper Zero Shifts to Community-Driven Development
• GitHub Malware Advisories Now Cover Eight Package Ecosystems
• GitLost: How Researchers Tricked GitHub's AI Agent Into Leaking Private Repos

Sources#

• Ghost Font - Mixfont
• Hacker News Discussion