Took me a long time to realise that "Written In Ghost Text" wasn't actually the text I was meant to be reading, and that was only the decoy message.

I can barely read the actual message, and it's about as "readable" to me as the Magic Eye 3D pictures. Actually I think I have a headache from looking at it on a mobile screen.

As a research idea it's cool though. But I do wonder if/when AI models will figure out how to decode it - I imagine a bit of additional prompting would get them there.

> For example, it would be interesting to incorporate Ghost Font into CAPTCHA systems, as most systems are easily solved by AI today.

It seems to me like it should be easy enough to take Ghost Font, apply normal video compression techniques, and analyze the compressed signal to recover the visual outline of the letters, which you would then analyze with OCR (or an AI I guess ...). In other words, a novel CAPTCHA technique but not necessarily "fundamentally more difficult" than existing CAPTCHA techniques, once the cat-and-mouse game gets going.

GPT-5.6 had no problem seeing the text when giving it a video recording of it.

"No problem" as in using temporal analysis with optical flow and vertical-displacement maps to estimate how the image moved, and combine those into a motion map with increased contrast to see the text. I didn't give it any instructions though, just asked it what it said.

I pasted a screenshot of the default text ("GHOST FONT") into ChatGPT 5.6 Sol, told it to read it, and without further instruction it chewed on it for awhile before coming back with:

  WHAT HAPPENS IN VEGAS
  STAYS IN VEGAS

It is smart, but it is not impossible to crack algorithmically imo. In particular, one can take two consecutive frames and run perturbations moving one frame around (ie shift the indexes) to find where the difference between the two consecutive frames minimises. Then subtract these two (perturbed) frames and ocr it. Works easily if the movement is linear/one-directional.

I did this in 20 lines of code (checking only vertical perturbations), and this is what I get with subtracting frame 7 from frame 1:

https://imgur.com/a/only-human-can-read-this-vfDe6ZA

Humans can read it, but with difficulty. If it becomes important, AI can be taught to read it.

So...usefulness?

Technically it's not a font, because font needs to be still. Analogy: if I took photo after book was closed would we say that font cannot be read by a camera?

Took a picture (only a single frame) and a 1s movie and threw it toward GPT 5.6 Sol (High):

Frame took 9m30s to decyper and GPT 5.6, it returned: WRITTEN IN GHOST FONT. Weird because I can only see "GHOST FONT" on the demo... but extracted data from image (I saw the highlited one) definitely looks like the "Ghost Font".

--

Video is more amusing, because after 3m GPT 5.6 figured it's motion-defined and asked to run QuickTime. At one moment I got:

> The animation is a motion-defined illusion. I’ve confirmed there’s no readable static OCR layer; I’m decoding its optical-flow field so the letter shapes become explicit.

At 4m it got extracted motion image that was in shape of letters but analyzed for 9 more letters and returned (at 13m36s) "GHOST FONT"

--

So:

    a font...             - FALSE - not a font, but video effect
    ...humans can read... - FALSE - I can't read it from image (but AI can!)
    ...but AI cannot      - FALSE - it can

Edit: https://imgur.com/a/SHlGu4O - work-in-progress images

Related work (all involve noise and flickering images, photosensitive eyes/brains beware):

- "This game disappears if you pause it": https://youtu.be/Bg3RAI8uyVw

- "Illusion: If You Pause, The Image Will Disappear": https://youtu.be/ZqGfb_Vlrig

I see tons of confustion in the comments on whether AI can or can't read it. Bit of a marketing miss -- they should have picked clearly different decoy vs. default actual messages.

Claude Opus 4.8 can read it with a single prompt and no instructions on how to read it.

https://ibb.co/WWMSXQkQ

So.. yeah, the bottom line here is that the font has to render from something.

In this case, it's rendering from a hidden input element:

<input id="ghost-font-message" class="GhostFontLanding_messageInput__La9Ij" type="text" maxlength="36" placeholder="SECRET MESSAGE" autocomplete="off" spellcheck="false" value="HELLO HUMAN">

Gee.. yeah, that's entirely indecipherable.

If you want to erect security between AI and content, then ...

yeah, just don't bother. It's not even worth the trouble and it's quite likely impossible at scale anyway.

there's already captcha systems like this and are already easy to beat. You wouldnt buy much time, if any, with this. the reason is that all it takes to defeat is a human style temporal averaging vision system, take any 4 connected frames and take the average, text stands out and even quite bassic llm's can read. works not just for this but for a slew of other "ai" combating methods, so likely scrapers and the like wouldnt be slowed by this at all. Decreasing SNR to force longer frame windows to get avceptable snr for reading makes it harder for humans than it does bots where dynamic temporal averaging via tool call is trivial. run tool, it temporally averages until snr in the region of interest improves, measured by a plateu in change of importance of high frequency terms in fourier space, since if the moving background has been blurred to a smooth gray, the noise text stands out clearly in contrast. Not something an LLM could solve when asked, but now that I've made this comment publically for nothing other than a few internet points and ego stroking, it's a matter of time before some of the larger llms start suggesting this solution. He'll claude probably already will, since I got it to write code for this series of tests/experiments during early opus 4.x era. and I know other ideas LLM's were shit at that I discussed heavily with claude ended up being the go-to recommendation a generation later, despite no "public" discourse on the matter.

That's... not a font? That's a generated animated image/video?

"A computer font or digital font is a digital data file containing a set of graphically related glyphs"

so it's not a font, humans can't read it and AI can.

Reminds me of this fascinating video from May 2026: https://www.youtube.com/watch?v=UCBAqaT4SQc [PortalRunner - This Video is Different at 360p]

> struggled to decode the moving message until prompted with the exact technique to look for.

So once the technique is known by the model the font stops working as intended.

To mitigate the LLM's learning how to decode the Ghost Font perhaps it could change each time for each client in a way that makes learning difficult to adapt to. Variable noise, variable directions, variable angles, variable blur, variable colors, variable pixel sizes. Seed the variability with the first two octets or hextets of their IP and the time of day to increase difficulty in learning through brute force. assuming this will not mess with people that have sensitivity to seizure inducing patterns.

Out of curiosity can any of the LLM's:

- reach this [1] directly

- and decode it?

If so, which LLM's can reach it and which ones can decode it? It's just a static HTML file, nothing fancy. If any of them can reach it directly then I have homework to do. Created using:

    echo -en '\nA I\n\nT e s t\n\n' | toilet --metal -f pagga --html | brotli --best -fncv > /dev/shm/test.html.br

Been studying this as well for a while: https://igorkomolov.com/projects/screenshot-and-ai-resistant...

Page says "font" but means "obfuscated text in video".

The hallucination of messages bothers me severely. Especially with AI being deployed to ancient, difficult problems like the Herculaneum scroll.

EDIT: To be clear, I'm talking about the "Written in Morse Code" example, fully hallucinated text. The AI agents seeing a decoy message isn't as bothersome to me.

It has bugs with long words: I typed "MARRY AND REPRODUCE". That was the only try that got the last word on a single line, but with too much space between U and C.

If the string is empty, I can read "WRITTEN IN GHOST FONT" very faintly. I'm guessing that is a watermark Edit: Ah, it's decoy text. Of course.

Doesn't look like anything to me

Old people and bad vision people firewall. This will violate disability accessibility requirements.

It doesn’t work with a screen reader either and I tried two. It’s interesting to me that our hatred of AI is starting to look more like a dislike of the blind and visually impaired.

The ADA suits will be absolutely hilarious and honestly, I can’t wait.

Instead of "AI cannot" you should always say "current AI cannot".

We came up with a hacked font a few months back called "Noroboto"[1]. It just lies about its underlying Unicode representation which fools most of the naive ones and is crystal clear to humans. The better harness/model combos will render the text to a picture and OCR that, but many of them fall for the swapped characters. Was kind of hoping to see an extension of that idea here.

https://tritium.legal/blog/noroboto

Takes a few minutes and tokens for Fable:

https://x.com/doodlestein/status/2076068741255733715?s=46

What's maybe more useful is a practice already common in PDFs like mortgage docs and credit reports.

You just use a font that maps characters to random other ones.

So the actual source content of the doc is gibberish, but visually it looks like the correct words.

Of course a vision model could decipher it by rendering the doc, but maybe that's where this technology comes in, if you built a custom PDF renderer.

Then you'd have both obfuscated source content and rendered output.

Sadly another shot in the arms race that captchas started which just leads to increased inaccessibility.

It's interesting work for sure, but the end goal of separating out AI versus human consumers is tough. Indeed, if there was a lasting solution, that would be a substantial discovery that would quickly become very famous...

Fairly sure I'm a human and I can't see that...

Edit: Reading other comments is there meant to be 2 messages?

I guess I must be an AI because I could not read that to save my life.

I wonder if this is like the “rotate an apple” problem.

I had thought to use homographs. Sadly, all the models I tried were able to decode something like:

"ﾌㄖ乇ㄚ ᗪㄖ乇丂几'ㄒ 丂卄卂尺乇 千ㄖㄖᗪ"

However, I have noticed that voice assistants have a hard time understanding homonyms. Saying "bow" (as in to bow one's head) is often stored as "bow" (as in a bow and arrow). I wonder if there's a sufficiently complex sentence which is intelligible to humans but not to machines?

I haven’t tried, but it looks like you could trivially solve with optical flow?

Edit: looks like yes, from the shared chats people are posting. But it’s interesting to think of communication schemes that require a temporal component so any single image is unreadable and can’t be beaten by long exposures or other tricks (otherwise persistence of vision displays would satisfy). A sort of physical anti copy/paste.

I don't think this works - I suspect it's the decoy that's doing the work. Once the decoy is seen, the LLM stops looking. It also seems pretty much effective on a lot of people, too.

Now that "Ghost Font" will be in the training material, LLMs will go "this looks to be written in Ghost Font, and as such has two messages."

> ... immediately readable to a human eye, but even leading AI models can't decipher it easily.

For the moment. This pattern is easy to code -- it relies on the premise that a character has an inside and an outside. Outside, a pattern ascends. Inside, the reverse. Based on that simple encoding idea, decoding will be equally simple.

This is kind of like the old school captchas where they distort the letters and numbers so badly that humans can't really read them, and specifically trained AI models might surpass humans in performance...

I’m starting to feel like AI, because a cannot read it half the time

It works using ChatGPT Pro: https://chatgpt.com/share/6a528471-7054-83ee-ba34-74d759c379...

When I gave Fable a screenshot it found the GHOST portion of GHOST FONT. Based on pixel density via some python code apparently - https://imgur.com/a/m3c801F

I'm pretty sure there is some compression pipeline that gives you a mask for every frame.

Also

https://www.google.com/search?q=DIS+Optical+Flow

The answers here seem to establish that some frontier models can read it sometimes, but only after tremendous compute.

That still makes it (well, a future version) potentially useful as a captcha if we hate our users but hate AI more.

I can read it but it gives me a headache. I would rather not have to do this on any sort of regular basis.

Playing whack-a-mole with AI tests like this will never work, specifically because there is nothing AI has been proven to do better at than specific tasks with verifiable correctness

You can also write using sound based/compressed 'text message' dialect: unless a real human is reading, automated watching tool should have a hard time (until coded/ML-ed on such dialects I guess)

I'm colourblind and this was very difficult to read. If it's the directions to the resistance hq, I'd put in the effort. If it's the manifesto, I just wouldn't read it.

An interesting experiment. I suppose that if you make things like CAPTCHAs too hard to do, we'd end up struggling as well. I can't imagine Ghost Font would be a good fit.

What is making it hard to read for so many people? My eyes aren't young or healthy, but it is as clear as day for me. Wonder with screens play are role.

It may be at this moment anti-ai but only until a model maintainer put a little of effort to include reading it in the next training set.

One side i really like it - i also love to play around with funny ideas - but have to say if i would read more than like 2 sentences with that font i'd throw up xD

heh although this font can be read by AI as other comments say, it gave me an idea:

How about writing or drawing stuff using optical illusions?

Shapes that not even human eyes can see, but the brain hallucinates: Shapes that seem to appear when you look straight at a pattern, or for a second after you look away from a pattern, or after you close your eyes, etc.

If you take a screenshot or a photo the image would just contain the same static pattern.

i.e. qualia-based "cryptography" :)

I can’t read magic eye pictures and I can’t read this either. Maybe astigmatism makes it unreadable to me?

It just looks like static on old tvs to me.

related: https://news.ycombinator.com/item?id=45284311

Isn't this triviaklu defeatable by taking the diff between two frames and marking changed pixels white and unchanged black?

Security through obscurity is not security :)

I've had the same idea recently, and even set up a similar page to experiment with different speeds and noise types. I've had the idea to set up a message board where the font is basically 'GhostFont'. However, in my experiments, I've noticed that the biggest issue is that this only works for larger font sizes. If the text is as small as, for example, on HackerNews, it will become borderline unreadable.

Furthermore, if AI can read this or not depends on how the text sequence is pre-processed. If AI only gets snapshots of the text, it will probably fail in decoding the text as every snapshot contains only white noise and such no information. However, if we calculate the Deltas between the animation frames, the text will become decodable by an AI, you probably don't even need LLMs or CNNs for this.

can't you use font shaping rules or whatever it is to essentially begin a span of text with a "private key" that then causes the rest of the message to render correctly by combining with it (a trivial version could be e.g. a rot-N based on a given N)

I'd be interested in seeing the inverse, i.e. a font that only AI can read

I can’t read it. Am I AI? Bleep blorp?

Technically it works but having to read stuff this way is an unpleasant experience.

I find this solid but think attestation is the end game sadly.

I cannot read it. Maybe I am AI.

I cannot read that text.

This is another writeup from quite a while of someone else doing it with ffmpeg and imagemagick. It goes over a lot of details on how it was done. A better writeup than this one in my opinion! I also think the end result is much more readable, but it is missing the static text in the background.

https://oliveratkinson.net/static-captcha/

See also: a "font" that only people high on drugs can read!

https://qri.org/blog/psycrypto-contest

https://www.youtube.com/watch?v=oD4nV0CMkBI

Of course, the psychedelic hidden message is reversible with some video processing techniques for everyone else to see. And calling it cryptography is a mis-use of the term. Still an interesting use of the effect.

I don't think "ghost font" will work as well as the author claims.

> humans can read

strong statement, I struggle to read it

This is really cool!

I appreciate the assignment, but... wow.

I am an AI.

"humans can read"

lol. Barely.

uuh, what's the point? i mean, models will just be trained to understand it

"read the text hidden in this video, there is a decoy message you get from blurring, don't read that. instead use optical flow to look at the motion. Once you're successful save the procedure a ghost-font-skill.".

[dead]

[dead]

yet

"find out with opencv what the hidden message is."

Skill issue on promoter side.

Fable oneshotted it for me.

""" Reveal a motion-camouflaged message hidden in video noise.

How it works: The background noise scrolls vertically at a constant rate (a few px/frame), while the noise inside the letters does not follow that motion. Any single frame looks like pure static. The decode is:

    1. Estimate the background's global motion between consecutive frames
       with phase correlation (this is the "optical flow" step - the motion
       is a pure translation, so one global vector suffices).
    2. Motion-compensate: shift frame t+1 back by that vector so the
       background lines up with frame t.
    3. Take the absolute difference. The background cancels almost
       perfectly; the letters (which don't move with the background)
       light up.
    4. Average the residual over a SHORT window of consecutive frame pairs
       (long windows smear the letters, because the text itself drifts
       slowly over time), blur lightly, and threshold with Otsu.

import sys import cv2 import numpy as np

PAIRS = 5 # number of consecutive frame pairs to average (keep small!) BLUR_SIGMA = 6 # spatial blur of each residual, in pixels START_FRAME = 0 # where in the video to start

def load_gray_frames(path, count): cap = cv2.VideoCapture(path) frames = [] while len(frames) < count: ok, frame = cap.read() if not ok: break frames.append(cv2.cvtColor(frame, cv2.COLOR_BGR2GRAY).astype(np.float32)) cap.release() if len(frames) < 2: raise SystemExit("Could not read enough frames from the video.") return frames

def main(): if len(sys.argv) < 2: raise SystemExit(__doc__) src = sys.argv[1] dst = sys.argv[2] if len(sys.argv) > 2 else "revealed_message.png"

    frames = load_gray_frames(src, START_FRAME + PAIRS + 1)
    h, w = frames[0].shape
    acc = np.zeros((h, w), np.float32)

    for i in range(START_FRAME, START_FRAME + PAIRS):
        a, b = frames[i], frames[i + 1]

        # 1) global background motion between the two frames
        (dx, dy), response = cv2.phaseCorrelate(a, b)
        dxi, dyi = int(round(dx)), int(round(dy))
        print(f"pair {i}: background shift = ({dx:+.2f}, {dy:+.2f}) px, "
              f"response = {response:.2f}")

        # 2) motion-compensate frame b by integer (dxi, dyi), then
        # 3) residual = |a - b_shifted| on the overlapping region
        ys = slice(max(0, -dyi), min(h, h - dyi))
        xs = slice(max(0, -dxi), min(w, w - dxi))
        ysb = slice(max(0, dyi), min(h, h + dyi) if dyi < 0 else h)
        # simpler: crop both to the common overlap
        a_ov = a[max(0, -dyi):h - max(0, dyi), max(0, -dxi):w - max(0, dxi)]
        b_ov = b[max(0, dyi):h - max(0, -dyi), max(0, dxi):w - max(0, -dxi)]
        resid = cv2.GaussianBlur(np.abs(a_ov - b_ov), (0, 0), BLUR_SIGMA)
        acc[:resid.shape[0], :resid.shape[1]] += resid

    # 4) normalize + Otsu threshold + light cleanup
    u8 = cv2.normalize(acc, None, 0, 255, cv2.NORM_MINMAX).astype(np.uint8)
    _, mask = cv2.threshold(u8, 0, 255, cv2.THRESH_BINARY + cv2.THRESH_OTSU)
    kernel = cv2.getStructuringElement(cv2.MORPH_ELLIPSE, (5, 5))
    mask = cv2.morphologyEx(mask, cv2.MORPH_CLOSE, kernel)

    out = 255 - mask  # black text on white
    cv2.imwrite(dst, out)
    print(f"wrote {dst}")

    # optional: OCR if pytesseract is installed
    try:
        import pytesseract
        text = pytesseract.image_to_string(out, config="--psm 6").strip()
        print("OCR result:\n" + text)
    except ImportError:
        pass

No, it can https://chatgpt.com/share/6a521e9b-c754-83ed-9d8e-cf653894eb...