Mixfont's Decoy Font embeds two characters into one glyph, showing humans one message and AI vision models another. The font exploits a blind spot in how ChatGPT and Gemini tokenize rendered text.
Key facts
- Decoy Font layers two characters into one glyph
- Fools ChatGPT and Gemini image recognition
- No adversarial noise or image manipulation required
- Exploits patch-based vision encoder tokenization
- Deployable in physical-world printed documents
Mixfont, a typography studio known for experimental font design, released the Decoy Font that renders one textual message to human readers and a different one to AI image recognition models. According to @_vmlops, the font works by layering two characters into a single glyph — the dominant visual shape is legible to humans, while a secondary, often smaller or differently-styled character is encoded in a way that vision models prioritize.
The technique exploits a fundamental blind spot in how vision-language models parse rendered text. Models like GPT-4V and Gemini Pro process images through patch-based vision encoders (e.g., CLIP-style ViTs) that tokenize the image into fixed-size patches. When a glyph contains two overlapping characters, the encoder may latch onto the less salient but visually distinct features of the secondary character, misreading the intended message. Early tests shared by Mixfont show the font fooling ChatGPT and Gemini in controlled scenarios, though the company did not disclose the exact success rate or the number of test cases.
This is not the first time adversarial typography has targeted AI vision. In 2023, researchers at ETH Zurich showed that adding subtle perturbations to road signs could cause models to misclassify them — but those required digital noise. The Decoy Font achieves the same effect with clean, printable glyphs, making it deployable in physical-world contexts like posters, signage, or printed documents without any post-processing. [According to prior work by Athalye et al. 2018], adversarial patches can survive real-world transformations; the Decoy Font extends that principle to the character level.
The commercial or adversarial use cases are immediate. A protest sign could display "PEACE" to human eyes but "PROTEST" to an AI surveillance system scanning the crowd. A CAPTCHA variant could show a different string to bots than to humans. Conversely, the technique could be used to watermark AI-generated images with hidden text that only models can read, or to hide instructions in AI-training data that are invisible to human reviewers.
Why this matters more than a novelty font
The Decoy Font reveals a structural weakness in how vision-language models handle text — they lack character-level supervision during pretraining. Most models learn to map image patches to semantic concepts via contrastive learning (CLIP) or autoregressive next-token prediction, but they never explicitly learn to segment individual characters. This means any font that breaks the standard single-character-per-glyph assumption can create a persistent blind spot. The font does not require adversarial noise or image manipulation, making it harder to defend against without fundamentally changing the vision encoder architecture.
Broader implications for multimodal safety
This technique adds to a growing list of adversarial attacks on multimodal models. In 2025, researchers at Carnegie Mellon demonstrated that adding specific Unicode characters to text prompts could jailbreak vision-language models. The Decoy Font is the inverse — it works through the image input channel. As companies deploy AI vision models in safety-critical settings like autonomous driving, content moderation, and surveillance, attacks that exploit text-rendering blind spots become harder to ignore. Defenses would likely require training with synthetic data that includes multi-character glyphs, or adding a dedicated OCR head to the vision pipeline.
What to watch
Watch for whether OpenAI or Google release a patch or model update to handle dual-character glyphs. Also watch for Mixfont releasing a public demo or benchmark dataset that quantifies the fooling rate across different vision models.
