Rendered at 21:20:50 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
SyneRyder 3 days ago [-]
Took me a long time to realise that "Written In Ghost Text" wasn't actually the text I was meant to be reading, and that was only the decoy message.
I can barely read the actual message, and it's about as "readable" to me as the Magic Eye 3D pictures. Actually I think I have a headache from looking at it on a mobile screen.
As a research idea it's cool though. But I do wonder if/when AI models will figure out how to decode it - I imagine a bit of additional prompting would get them there.
Hendrikto 3 days ago [-]
Funny, for me it is exactly the opposite: I can read the actual text very easily, but the “Written in Ghost Text” is barely perceptible to the point I would have completely missed it, if it were not for the comment pointing it out here.
SyneRyder 3 days ago [-]
I've just tried it on my large desktop monitor (roughly 1440p, not HiDPI), and I now see "Ghost Font" extremely clearly and can't see the decoy at all. If I scale my browser window to 30% zoom, then I can just see the "Written In Ghost Text" decoy message again.
My phone would have been zooming out the browser window, and making the dots even tinier, but the phone is HiDPI so it would have still preserved the dots. My eyes are middle-aged and probably starting to do the same kind of median-blur effect that models do when they resize an image. That's my current guess for why I can see the decoy more clearly on mobile.
If that's the case, then this trick will stop working as vision models approach pixel-perfect vision, instead of the current resizing that they do. Pretty cool as steganography though.
stvltvs 3 days ago [-]
Flipping my phone between portrait and landscape thereby changing image size is enough to determine which message is legible to me.
Lerc 3 days ago [-]
That would confirm that this is more related to algorithmic filters than human perception.
coatmatter 2 days ago [-]
On my mediocre laptop display, I had to set the brightness moderately, and take my glasses off to see the decoy text more easily (easier than squinting). Deleting the custom text also made it easier. The other tip someone posted about moving the window around also helps a lot. Moving further back from the display also helps.
icedchai 3 days ago [-]
Same. If I move the window around, I can perceive the "Written in Ghost Text"... Otherwise, not at all.
kemayo 3 days ago [-]
Same, I had no sense of the decoy message at all until I read that comment.
kiicia 3 days ago [-]
It depends on how big/dense is your screen, high frequency message is actual text while low frequency message is decoy text. Probably so that it shows when frames are averaged together without checking actual motion vectors. It is similar effect like that image showing either young woman or old man depending on distance you are viewing it from (or other one with either Einstein or Marylin Monroe)
Has anyone tried asking an LLM to write a program to decode the message?
I’m guessing it is a one-shot task. On the other hand, it’s illegible to a large percentage of humans.
I always thought that once computers got better at solving captchas than humans, they would go away.
I couldn’t have been more wrong.
Reason077 3 days ago [-]
> ”Took me a long time to realise that "Written In Ghost Text" wasn't actually the text I was meant to be reading, and that was only the decoy message.”
Wait, what? Seriously? That’s the only text I can see. Am I an AI?
mort96 3 days ago [-]
Are you looking at a still image or the video? The text is blindingly obvious to me in the video, while I'm having serious trouble seeing "Written In Ghost Text".
But a still frame doesn't contain the information necessary to see the actual message, so when it's paused, I can only barely see something which I suppose says something along the lines of "written in ghost text".
therealpygon 2 days ago [-]
It seems highly resolution and scale dependent and seems to rely on the idea of a user being on a PC.
This is super useful; I’ve always wanted my information to be illegible when scaled…
sebastiennight 3 days ago [-]
Have you ever visited the cloud city of Zalem, by any chance? Got any interesting tattoos done on your forehead?
r-w 3 days ago [-]
Uh... Yes. Probably.
Lerc 3 days ago [-]
Ah, I can't see magic eye pics. The secondary text is invisible to me as well. An Ai would probably be able to get it with multiple samples, so in the lonmg run it is more likely to be readable to AI than humans.
r-w 3 days ago [-]
...are you an LLM? I can't read the decoy message at all.
SyneRyder 3 days ago [-]
I don't think I am — but I am rather Claude-pilled, and graphics algorithms are right in my wheelhouse.
I look forward to being able to see C-beams glitter in the dark near Tannhäuser Gate.
3 days ago [-]
rav 3 days ago [-]
> For example, it would be interesting to incorporate Ghost Font into CAPTCHA systems, as most systems are easily solved by AI today.
It seems to me like it should be easy enough to take Ghost Font, apply normal video compression techniques, and analyze the compressed signal to recover the visual outline of the letters, which you would then analyze with OCR (or an AI I guess ...). In other words, a novel CAPTCHA technique but not necessarily "fundamentally more difficult" than existing CAPTCHA techniques, once the cat-and-mouse game gets going.
Lerc 3 days ago [-]
I took just two screenshots and applied some filters and got
An AI would be able to take consecutive frames rather than hamfistedly pressing the screenshot button, then accumulate enough samples to clearly make out the text from a clip shorter than the time it would take for a human to read it.
mlok 2 days ago [-]
"Written in ghost font" is the decoy message. Your filters got those words.
The real message is "only a human can read this" and your filters didn't get these words.
(But I think there should be a way to catch them)
ninjalanternshk 2 days ago [-]
That’s the only message I can see.
Am I… am I an AI?
3 days ago [-]
xattt 3 days ago [-]
I.e. there’s an ffmpeg incantation out there to do it.
jszymborski 3 days ago [-]
An LLM can output it pretty quick, I imagine.
3 days ago [-]
ihsoj 3 days ago [-]
Yes, it may be useful to replace current CAPTCHA, but this does not provide the positive side-effects of CAPTCHA where user-submitted data is used to train the unknown images or reinforce the labelling of existing image segments.
beagle3 3 days ago [-]
It’s been years since captcha was contributing to labeling.
mort96 3 days ago [-]
Indeed, they don't contribute to labeling. The self driving companies figured out long ago that machine learning is way too expensive. Instead, Google is using its large network of willing humans to inform automated driving decisions in real time.
So the next time you're asked to click the pictures with the bicycles or traffic lights? Please do so before it's too late.
GPT-5.6 had no problem seeing the text when giving it a video recording of it.
"No problem" as in using temporal analysis with optical flow and vertical-displacement maps to estimate how the image moved, and combine those into a motion map with increased contrast to see the text. I didn't give it any instructions though, just asked it what it said.
Kiro 3 days ago [-]
For people thinking it detected the decoy text. It did not. It was the text I entered myself. Here are the thinking steps:
Inspected video metadata, extracted frames, and analyzed content
Detected and analyzed periodicity in stereogram image data
Blurred, downsampled, and analyzed image frames
Computed frame pixel shifts and cross-correlation
Checked OpenCV installation, optimized and analyzed optical flow processing
Analyzed motion for text
Estimated vertical displacement and processed image flow
Refined text extraction
Processed optical flow and analyzed image
amazingamazing 3 days ago [-]
Im curious share the link - i cannot reproduce. Gemini 3.5 flash gets it. For those curious on ios you can record your screen using control center
Edit: interestingly gpt5.6 needed a slightly longer video and got it too
rodion_89 3 days ago [-]
I threw it at Fable with the prompt "What does the message say?" and it also figured out without issue. Thought process is interesting https://imgur.com/a/GToXs6W
sargunv 3 days ago [-]
That's the decoy message, "written in ghost font".
Culonavirus 3 days ago [-]
I swear people are dumber than the models now, we reached ASI.
Lerc 3 days ago [-]
That's because the "humans can read" part is not visible to all humans. Like myself I thought the image I could see was the one the machine couldn't. I managed to extract both forms of text by extremely crude means.
What this is, is a message that is more reliably readable by a sufficiently good AI than it is by all humans.
r-w 3 days ago [-]
Artificial Stupid Intelligence?
witx 3 days ago [-]
Good lord, this is funny
bel8 3 days ago [-]
And by "Figure out without issue" you realize it got the wrong answer right?
As also stated in the article.
amazingamazing 3 days ago [-]
SMH.
Maybe AI will take over after all, just not due to the reasons we think.
kevinsync 3 days ago [-]
[dead]
wavemode 3 days ago [-]
Do you have a link to this chat?
Kiro 3 days ago [-]
The chat contains the video, which may reveal som meta data about me. But the shared chat also doesn't include any of the images in the thinking steps that my original chat has, where you can see the different maps it generated. Pretty cool seeing it go from noise to patterns to the final image which clearly shows the text as black on white.
freehorse 3 days ago [-]
What text did it find?
Kiro 3 days ago [-]
The text I had written in the message. Just some random stuff.
ssl-3 3 days ago [-]
I pasted a screenshot of the default text ("GHOST FONT") into ChatGPT 5.6 Sol, told it to read it, and without further instruction it chewed on it for awhile before coming back with:
WHAT HAPPENS IN VEGAS
STAYS IN VEGAS
nextaccountic 3 days ago [-]
> a screenshot
The text is a video. Every frame contain random dots, so an individual frame by itself doesn't contain the intended message
This "font" exploits the fact that current-gen frontier models will process video one frame at time, but each frame is noise, so by looking at frames in isolation doesn't reveal anything
Then, they add a hidden message to each frame just so that the agent report something and stop trying (because if the agent tried to correlate between the frames, they could discover the trick)
But if you pass just a frame, there is no message. Just the noise plus the decoy
stabbles 3 days ago [-]
If you take a frame you see it's neither random nor dots:
Just a single frame (any frame). After that any modern LLM can read it (if not - single dilate step helps). Funny enough, Ghost Font is a font that machine can read much better than human.
nextaccountic 1 days ago [-]
This idea could be done with purely random frames. But they also need each frame to show a decoy to the agent (so that the agent stop looking - if they are persistent enough they could figure out the trick)
So each frame can't be 100% random and it must show some outline - but my guess is that it's the outline of the decoy, and unrelated to the outline of the actual message
And per what was reported, it's already pretty hard for the agent to figure out the decoy. After they finally crack it, they consider the problem solved
I think it's genius. The only problem is that it's trivially defeated by some tool written specifically to read it. So it defeats current-gen agents but if it becomes popular (eg. used by captcha services), future LLMs will just write a small Python script to read it
applicative 3 days ago [-]
They are the boundaries of the decoy, I think. I can sort of make the decoy out in a screenshot.
doublerabbit 3 days ago [-]
"Content not available in your country" - obviously working well.
singularity2001 3 days ago [-]
Exactly. It's a good idea, badly executed.
freehorse 3 days ago [-]
Maybe not so well explained, by picking the default intended text presented to be the same as the decoy text. It took me also some time to realise what was going on, but the execution is fine otherwise.
So there are two texts, one decoy (which you can barely see in a single frame but becomes more clear if you average between frames) and an actual text, which disappears in single frames or averaged ones.
starcast2026 3 days ago [-]
Just to add some drama - this feels like a perfect competition between humans & bots!
stavros 3 days ago [-]
What did you expect from a screenshot of obvious noise? The only thing that makes the text readable is the motion.
EDIT: On second look, the static screenshot does say "WRITTEN IN GHOST FONT".
ssl-3 3 days ago [-]
It was an experiment.
I didn't go into it with an expectation, or a hypothesis. The experiment was very low effort, and had very low cost, and it was the loose equivalent of throwing some shit at the wall to see if any of it sticks.
The result was my own amusement. This result wasn't any more unexpected than any other result would have been.
What did you expect from a screenshot of obvious noise, yourself?
3 days ago [-]
plastic-enjoyer 3 days ago [-]
> I posted a screenshot of static white noise to AI
HackerNews never disappoints
freehorse 3 days ago [-]
It is smart, but it is not impossible to crack algorithmically imo. In particular, one can take two consecutive frames and run perturbations moving one frame around (ie shift the indexes) to find where the difference between the two consecutive frames minimises. Then subtract these two (perturbed) frames and ocr it. Works easily if the movement is linear/one-directional.
I did this in 20 lines of code (checking only vertical perturbations), and this is what I get with subtracting frame 7 from frame 1:
Humans can read it, but with difficulty. If it becomes important, AI can be taught to read it.
So...usefulness?
dgellow 3 days ago [-]
It’s a research project, that doesn’t need to be useful. They wanted to explorer that area and share their findings
sevenzero 3 days ago [-]
Also this can always result in something useful over time. I'd love if AI safe writing will be possible at some point again...
xlii 3 days ago [-]
Technically it's not a font, because font needs to be still. Analogy: if I took photo after book was closed would we say that font cannot be read by a camera?
Took a picture (only a single frame) and a 1s movie and threw it toward GPT 5.6 Sol (High):
Frame took 9m30s to decyper and GPT 5.6, it returned: WRITTEN IN GHOST FONT. Weird because I can only see "GHOST FONT" on the demo... but extracted data from image (I saw the highlited one) definitely looks like the "Ghost Font".
--
Video is more amusing, because after 3m GPT 5.6 figured it's motion-defined and asked to run QuickTime. At one moment I got:
> The animation is a motion-defined illusion. I’ve confirmed there’s no readable static OCR layer; I’m decoding its optical-flow field so the letter shapes become explicit.
At 4m it got extracted motion image that was in shape of letters but analyzed for 9 more letters and returned (at 13m36s) "GHOST FONT"
--
So:
a font... - FALSE - not a font, but video effect
...humans can read... - FALSE - I can't read it from image (but AI can!)
...but AI cannot - FALSE - it can
It's a static decoy message independent from what you type in. You can see it if you take a long exposure pic of the screen (e.g. with your smartphone).
xlii 3 days ago [-]
Oh, cool I was wondering how can I get to see that decoy!
rzzzt 3 days ago [-]
Related work (all involve noise and flickering images, photosensitive eyes/brains beware):
And as a bonus reference - this all reminds me a lot of the book "There Is No Antimemetics Division".
rsanek 3 days ago [-]
I see tons of confustion in the comments on whether AI can or can't read it. Bit of a marketing miss -- they should have picked clearly different decoy vs. default actual messages.
dhruvkb 3 days ago [-]
Claude Opus 4.8 can read it with a single prompt and no instructions on how to read it.
But... neither of the videos say "this is a ghost font"? Are you sure you are a human?
picture 3 days ago [-]
Is the answer correct? I don't seem to see any demo video with "this is a ghost font" encoded
ozgung 3 days ago [-]
It is actually correct but not in the intended way. Delete all the sample text. If you look at your screen from a distance you'll see a subtle ghost like text on the noise pattern. It says "this is a ghost font".
scared_together 3 days ago [-]
It’s the “decoy text” intended to trick LLMs, from the arricle:
> The decoy message serves as a final trick for a determined agent. When looking for a hidden message, it might first find the decoy message and think that that is the real embedded message in the video.
3 days ago [-]
Retr0id 3 days ago [-]
Nope! It's the decoy text.
Retr0id 3 days ago [-]
That's the decoy message.
bmelton 3 days ago [-]
and I cannot
(so either I am AI at a level less than Opus 4.8 or just all-round defective as a human)
VincePlatt 3 days ago [-]
So.. yeah, the bottom line here is that the font has to render from something.
In this case, it's rendering from a hidden input element:
If you want to erect security between AI and content, then ...
yeah, just don't bother. It's not even worth the trouble and it's quite likely impossible at scale anyway.
Grimblewald 3 days ago [-]
there's already captcha systems like this and are already easy to beat. You wouldnt buy much time, if any, with this. the reason is that all it takes to defeat is a human style temporal averaging vision system, take any 4 connected frames and take the average, text stands out and even quite bassic llm's can read. works not just for this but for a slew of other "ai" combating methods, so likely scrapers and the like wouldnt be slowed by this at all. Decreasing SNR to force longer frame windows to get avceptable snr for reading makes it harder for humans than it does bots where dynamic temporal averaging via tool call is trivial. run tool, it temporally averages until snr in the region of interest improves, measured by a plateu in change of importance of high frequency terms in fourier space, since if the moving background has been blurred to a smooth gray, the noise text stands out clearly in contrast. Not something an LLM could solve when asked, but now that I've made this comment publically for nothing other than a few internet points and ego stroking, it's a matter of time before some of the larger llms start suggesting this solution. He'll claude probably already will, since I got it to write code for this series of tests/experiments during early opus 4.x era. and I know other ideas LLM's were shit at that I discussed heavily with claude ended up being the go-to recommendation a generation later, despite no "public" discourse on the matter.
pluc 3 days ago [-]
That's... not a font? That's a generated animated image/video?
"A computer font or digital font is a digital data file containing a set of graphically related glyphs"
so it's not a font, humans can't read it and AI can.
Zambyte 3 days ago [-]
> I suppose technically, it's not a font in the traditional sense of a TTF font file. But, Ghost Font is an experiment of a way to graphically communicate in writing in a format that AI cannot easily understand
And this thread is seemingly full of people claiming AI can read it while simultaneously sharing that AI could not read the actual message, only the decoy as demonstrated in TFA.
ludwik 3 days ago [-]
> And this thread is seemingly full of people claiming AI can read it while simultaneously sharing that AI could not read the actual message, only the decoy as demonstrated in TFA.
That’s 100% on the authors for failing to make the default main “hidden” text and the decoy easily distinguishable. The way this is set up is incredibly confusing.
Measter 2 days ago [-]
There's also the element of actual humans being unable to read the intended message, and only seeing the decoy text.
It's a pretty crappy system if a portion of your intended audience can't even read it.
casey2 3 days ago [-]
The glyphs are drawn over the time dimension rather than a spacial one
khurs 3 days ago [-]
> struggled to decode the moving message until prompted with the exact technique to look for.
So once the technique is known by the model the font stops working as intended.
Bender 3 days ago [-]
To mitigate the LLM's learning how to decode the Ghost Font perhaps it could change each time for each client in a way that makes learning difficult to adapt to. Variable noise, variable directions, variable angles, variable blur, variable colors, variable pixel sizes. Seed the variability with the first two octets or hextets of their IP and the time of day to increase difficulty in learning through brute force. assuming this will not mess with people that have sensitivity to seizure inducing patterns.
Out of curiosity can any of the LLM's:
- reach this [1] directly
- and decode it?
If so, which LLM's can reach it and which ones can decode it? It's just a static HTML file, nothing fancy. If any of them can reach it directly then I have homework to do. Created using:
echo -en '\nA I\n\nT e s t\n\n' | toilet --metal -f pagga --html | brotli --best -fncv > /dev/shm/test.html.br
Page says "font" but means "obfuscated text in video".
3 days ago [-]
dragontamer 3 days ago [-]
The hallucination of messages bothers me severely. Especially with AI being deployed to ancient, difficult problems like the Herculaneum scroll.
EDIT: To be clear, I'm talking about the "Written in Morse Code" example, fully hallucinated text. The AI agents seeing a decoy message isn't as bothersome to me.
grahamburger 3 days ago [-]
It's not fully hallucinated, I don't think. If you squint, you really can see what I assume is the 'decoy message', I'm fairly sure it says 'WRITTEN IN GHOST FONT'. It seems more likely to me that the LLM found 'Written In', noticed similar 'optical illusion' type memes, and hallucinated/assumed the 'morse code' bit.
Findecanor 3 days ago [-]
It has bugs with long words: I typed "MARRY AND REPRODUCE". That was the only try that got the last word on a single line, but with too much space between U and C.
If the string is empty, I can read "WRITTEN IN GHOST FONT" very faintly. I'm guessing that is a watermark Edit: Ah, it's decoy text. Of course.
noedig2 3 days ago [-]
Doesn't look like anything to me
cynicalsecurity 3 days ago [-]
Old people and bad vision people firewall. This will violate disability accessibility requirements.
hluska 3 days ago [-]
It doesn’t work with a screen reader either and I tried two. It’s interesting to me that our hatred of AI is starting to look more like a dislike of the blind and visually impaired.
The ADA suits will be absolutely hilarious and honestly, I can’t wait.
IvanK_net 3 days ago [-]
Instead of "AI cannot" you should always say "current AI cannot".
TaupeRanger 3 days ago [-]
Even that would be false.
piker 3 days ago [-]
We came up with a hacked font a few months back called "Noroboto"[1]. It just lies about its underlying Unicode representation which fools most of the naive ones and is crystal clear to humans. The better harness/model combos will render the text to a picture and OCR that, but many of them fall for the swapped characters. Was kind of hoping to see an extension of that idea here.
this exact trick is used in some drm schemes (to protect either text or font file, or both), where codepoints are either mixed up or font is converted to vector curves and assigned random indexes
ealexhudson 3 days ago [-]
Sadly another shot in the arms race that captchas started which just leads to increased inaccessibility.
It's interesting work for sure, but the end goal of separating out AI versus human consumers is tough. Indeed, if there was a lasting solution, that would be a substantial discovery that would quickly become very famous...
looksgoodtome 3 days ago [-]
What's maybe more useful is a practice already common in PDFs like mortgage docs and credit reports.
You just use a font that maps characters to random other ones.
So the actual source content of the doc is gibberish, but visually it looks like the correct words.
Of course a vision model could decipher it by rendering the doc, but maybe that's where this technology comes in, if you built a custom PDF renderer.
Then you'd have both obfuscated source content and rendered output.
Edit: Reading other comments is there meant to be 2 messages?
edent 3 days ago [-]
I had thought to use homographs. Sadly, all the models I tried were able to decode something like:
"ﾌㄖ乇ㄚ ᗪㄖ乇丂几'ㄒ 丂卄卂尺乇 千ㄖㄖᗪ"
However, I have noticed that voice assistants have a hard time understanding homonyms. Saying "bow" (as in to bow one's head) is often stored as "bow" (as in a bow and arrow). I wonder if there's a sufficiently complex sentence which is intelligible to humans but not to machines?
Gander5739 3 days ago [-]
There's garden path sentences, where the sentence is phrased in such a way as to cause you to misparse the sentence when you first read (e.g. "The old man the boat"); but those typically confuse humans (I'm not sure how effective they are on LLMs).
I guess I must be an AI because I could not read that to save my life.
I wonder if this is like the “rotate an apple” problem.
throwaway219450 3 days ago [-]
I haven’t tried, but it looks like you could trivially solve with optical flow?
Edit: looks like yes, from the shared chats people are posting. But it’s interesting to think of communication schemes that require a temporal component so any single image is unreadable and can’t be beaten by long exposures or other tricks (otherwise persistence of vision displays would satisfy). A sort of physical anti copy/paste.
pessimizer 3 days ago [-]
I don't think this works - I suspect it's the decoy that's doing the work. Once the decoy is seen, the LLM stops looking. It also seems pretty much effective on a lot of people, too.
Now that "Ghost Font" will be in the training material, LLMs will go "this looks to be written in Ghost Font, and as such has two messages."
lutusp 3 days ago [-]
> ... immediately readable to a human eye, but even leading AI models can't decipher it easily.
For the moment. This pattern is easy to code -- it relies on the premise that a character has an inside and an outside. Outside, a pattern ascends. Inside, the reverse. Based on that simple encoding idea, decoding will be equally simple.
hnfong 3 days ago [-]
This is kind of like the old school captchas where they distort the letters and numbers so badly that humans can't really read them, and specifically trained AI models might surpass humans in performance...
eoranged 3 days ago [-]
I’m starting to feel like AI, because a cannot read it half the time
When I gave Fable a screenshot it found the GHOST portion of GHOST FONT. Based on pixel density via some python code apparently - https://imgur.com/a/m3c801F
picofarad 2 days ago [-]
Hackernews is very good at finding the decoy message. This is as funny as thedailywtf posters who post "code snippets" to fix some other code snippet, and every single code snippet is wrong.
hedora 2 days ago [-]
In fairness, on mobile, the decoy font is the only thing a human will be able to see unless they zoom in the right amount.
Is the LLM really wrong if most humans and it agree that the decoy message is the real message?
It is still at fault if it gets the “real” message when a human that can actually read it is instructing the LLM?
casey2 3 days ago [-]
I'm pretty sure there is some compression pipeline that gives you a mask for every frame.
The answers here seem to establish that some frontier models can read it sometimes, but only after tremendous compute.
That still makes it (well, a future version) potentially useful as a captcha if we hate our users but hate AI more.
bmicraft 3 days ago [-]
Every single on of those answers I've seen _says_ they did decode it, but each and every one of them only found the decoy message without even realizing it.
Measter 2 days ago [-]
Which is probably a case of the human prompting the AI only being able to see the decoy message, so they think the AI was able to read it because it matches what they can see.
sylware 3 days ago [-]
You can also write using sound based/compressed 'text message' dialect: unless a real human is reading, automated watching tool should have a hard time (until coded/ML-ed on such dialects I guess)
atleastoptimal 3 days ago [-]
Playing whack-a-mole with AI tests like this will never work, specifically because there is nothing AI has been proven to do better at than specific tasks with verifiable correctness
exe34 3 days ago [-]
I'm colourblind and this was very difficult to read. If it's the directions to the resistance hq, I'd put in the effort. If it's the manifesto, I just wouldn't read it.
gschizas 3 days ago [-]
How is it being colorblind affect it? The video is literally black and white only.
exe34 3 days ago [-]
I assumed that might be it because that's why I usually struggle with novelty visual stuff, but you're right, it's probably not colour blindness.
not-a-llm 3 days ago [-]
this is black and white, I thought color blindness is only for colors?
tentacleuno 3 days ago [-]
An interesting experiment. I suppose that if you make things like CAPTCHAs too hard to do, we'd end up struggling as well. I can't imagine Ghost Font would be a good fit.
spider-mario 2 days ago [-]
I can read it but it gives me a headache. I would rather not have to do this on any sort of regular basis.
tokai 3 days ago [-]
What is making it hard to read for so many people? My eyes aren't young or healthy, but it is as clear as day for me. Wonder with screens play are role.
nimbleal 3 days ago [-]
I tried with my phone vertical and couldn’t see anything. In horizontal ie bigger image it was clear as day. I think a lot of the variance is probably screens.
marking-time 3 days ago [-]
Maybe part of it is the natural genetic variation in humans. I could read it, but it wasn't easy for me. My eyes are old too.
hedora 2 days ago [-]
Zoom level, at least on an iPhone mini.
Default: Pure static.
Zoom in: Written in ghost font.
Zoom in more: Now you can read it.
stackghost 3 days ago [-]
For me it's astigmatism. I have fairly mild astigmatism and I can just barely read the text if I try very, very hard.
voodooEntity 3 days ago [-]
One side i really like it - i also love to play around with funny ideas - but have to say if i would read more than like 2 sentences with that font i'd throw up xD
3 days ago [-]
acdbddh 3 days ago [-]
It may be at this moment anti-ai but only until a model maintainer put a little of effort to include reading it in the next training set.
londons_explore 3 days ago [-]
Most AI's that read web pages do so from screenshots.
This font when screenshotted is just noise.
Changing the AI to take local motion data into account is probably not going to happen soon, due to taking quite a lot more computation, both within the AI model, and within the chromium instance being inspected.
Razengan 3 days ago [-]
heh although this font can be read by AI as other comments say, it gave me an idea:
How about writing or drawing stuff using optical illusions?
Shapes that not even human eyes can see, but the brain hallucinates: Shapes that seem to appear when you look straight at a pattern, or for a second after you look away from a pattern, or after you close your eyes, etc.
If you take a screenshot or a photo the image would just contain the same static pattern.
i.e. qualia-based "cryptography" :)
junto 3 days ago [-]
I can’t read magic eye pictures and I can’t read this either. Maybe astigmatism makes it unreadable to me?
Isn't this triviaklu defeatable by taking the diff between two frames and marking changed pixels white and unchanged black?
sscaryterry 3 days ago [-]
Security through obscurity is not security :)
plastic-enjoyer 3 days ago [-]
I've had the same idea recently, and even set up a similar page to experiment with different speeds and noise types. I've had the idea to set up a message board where the font is basically 'GhostFont'. However, in my experiments, I've noticed that the biggest issue is that this only works for larger font sizes. If the text is as small as, for example, on HackerNews, it will become borderline unreadable.
Furthermore, if AI can read this or not depends on how the text sequence is pre-processed. If AI only gets snapshots of the text, it will probably fail in decoding the text as every snapshot contains only white noise and such no information. However, if we calculate the Deltas between the animation frames, the text will become decodable by an AI, you probably don't even need LLMs or CNNs for this.
satisfice 3 days ago [-]
I can’t read it. Am I AI? Bleep blorp?
tensegrist 3 days ago [-]
can't you use font shaping rules or whatever it is to essentially begin a span of text with a "private key" that then causes the rest of the message to render correctly by combining with it (a trivial version could be e.g. a rot-N based on a given N)
miguel_martin 3 days ago [-]
I'd be interested in seeing the inverse, i.e. a font that only AI can read
tempodox 3 days ago [-]
Technically it works but having to read stuff this way is an unpleasant experience.
throw1234567891 3 days ago [-]
I cannot read it. Maybe I am AI.
blooalien 3 days ago [-]
> "I cannot read it. Maybe I am AI."
I found the bot living in a simulation!
What do I win? Where's my prize?
amazingamazing 3 days ago [-]
I find this solid but think attestation is the end game sadly.
This is another writeup from quite a while of someone else doing it with ffmpeg and imagemagick. It goes over a lot of details on how it was done. A better writeup than this one in my opinion!
I also think the end result is much more readable, but it is missing the static text in the background.
Of course, the psychedelic hidden message is reversible with some video processing techniques for everyone else to see. And calling it cryptography is a mis-use of the term. Still an interesting use of the effect.
I don't think "ghost font" will work as well as the author claims.
not-a-llm 3 days ago [-]
> humans can read
strong statement, I struggle to read it
nullc 3 days ago [-]
"read the text hidden in this video, there is a decoy message you get from blurring, don't read that. instead use optical flow to look at the motion. Once you're successful save the procedure a ghost-font-skill.".
Haranrk 3 days ago [-]
This is really cool!
3 days ago [-]
romandr 3 days ago [-]
I am an AI.
sgjohnson 3 days ago [-]
"humans can read"
lol. Barely.
dewdgi 3 days ago [-]
uuh, what's the point? i mean, models will just be trained to understand it
jdiff 3 days ago [-]
Why would they be trained to read a research experiment that fundamentally goes against the way they perceive? They can't train on this technique, they can only postprocess it into a form they can perceive.
bubbi 3 days ago [-]
[dead]
shalom1112 3 days ago [-]
[dead]
jackdoe 3 days ago [-]
yet
arianvanp 3 days ago [-]
"find out with opencv what the hidden message is."
Skill issue on promoter side.
Fable oneshotted it for me.
"""
Reveal a motion-camouflaged message hidden in video noise.
How it works:
The background noise scrolls vertically at a constant rate (a few px/frame),
while the noise inside the letters does not follow that motion. Any single
frame looks like pure static. The decode is:
1. Estimate the background's global motion between consecutive frames
with phase correlation (this is the "optical flow" step - the motion
is a pure translation, so one global vector suffices).
2. Motion-compensate: shift frame t+1 back by that vector so the
background lines up with frame t.
3. Take the absolute difference. The background cancels almost
perfectly; the letters (which don't move with the background)
light up.
4. Average the residual over a SHORT window of consecutive frame pairs
(long windows smear the letters, because the text itself drifts
slowly over time), blur lightly, and threshold with Otsu.
PAIRS = 5 # number of consecutive frame pairs to average (keep small!)
BLUR_SIGMA = 6 # spatial blur of each residual, in pixels
START_FRAME = 0 # where in the video to start
def load_gray_frames(path, count):
cap = cv2.VideoCapture(path)
frames = []
while len(frames) < count:
ok, frame = cap.read()
if not ok:
break
frames.append(cv2.cvtColor(frame, cv2.COLOR_BGR2GRAY).astype(np.float32))
cap.release()
if len(frames) < 2:
raise SystemExit("Could not read enough frames from the video.")
return frames
def main():
if len(sys.argv) < 2:
raise SystemExit(__doc__)
src = sys.argv[1]
dst = sys.argv[2] if len(sys.argv) > 2 else "revealed_message.png"
frames = load_gray_frames(src, START_FRAME + PAIRS + 1)
h, w = frames[0].shape
acc = np.zeros((h, w), np.float32)
for i in range(START_FRAME, START_FRAME + PAIRS):
a, b = frames[i], frames[i + 1]
# 1) global background motion between the two frames
(dx, dy), response = cv2.phaseCorrelate(a, b)
dxi, dyi = int(round(dx)), int(round(dy))
print(f"pair {i}: background shift = ({dx:+.2f}, {dy:+.2f}) px, "
f"response = {response:.2f}")
# 2) motion-compensate frame b by integer (dxi, dyi), then
# 3) residual = |a - b_shifted| on the overlapping region
ys = slice(max(0, -dyi), min(h, h - dyi))
xs = slice(max(0, -dxi), min(w, w - dxi))
ysb = slice(max(0, dyi), min(h, h + dyi) if dyi < 0 else h)
# simpler: crop both to the common overlap
a_ov = a[max(0, -dyi):h - max(0, dyi), max(0, -dxi):w - max(0, dxi)]
b_ov = b[max(0, dyi):h - max(0, -dyi), max(0, dxi):w - max(0, -dxi)]
resid = cv2.GaussianBlur(np.abs(a_ov - b_ov), (0, 0), BLUR_SIGMA)
acc[:resid.shape[0], :resid.shape[1]] += resid
# 4) normalize + Otsu threshold + light cleanup
u8 = cv2.normalize(acc, None, 0, 255, cv2.NORM_MINMAX).astype(np.uint8)
_, mask = cv2.threshold(u8, 0, 255, cv2.THRESH_BINARY + cv2.THRESH_OTSU)
kernel = cv2.getStructuringElement(cv2.MORPH_ELLIPSE, (5, 5))
mask = cv2.morphologyEx(mask, cv2.MORPH_CLOSE, kernel)
out = 255 - mask # black text on white
cv2.imwrite(dst, out)
print(f"wrote {dst}")
# optional: OCR if pytesseract is installed
try:
import pytesseract
text = pytesseract.image_to_string(out, config="--psm 6").strip()
print("OCR result:\n" + text)
except ImportError:
pass
Ah, sorry, yes, tried with a very different message. But it can still read when telling that the text is formed by movement. AI doesn't see the world the way we do, so it's understandable. https://chatgpt.com/share/6a522660-929c-83eb-91ff-66b7873420...
arianvanp 3 days ago [-]
That is not the message. Did you read the article.
senfiaj 3 days ago [-]
I downloaded the message video, renamed it to test.mp4
I can barely read the actual message, and it's about as "readable" to me as the Magic Eye 3D pictures. Actually I think I have a headache from looking at it on a mobile screen.
As a research idea it's cool though. But I do wonder if/when AI models will figure out how to decode it - I imagine a bit of additional prompting would get them there.
My phone would have been zooming out the browser window, and making the dots even tinier, but the phone is HiDPI so it would have still preserved the dots. My eyes are middle-aged and probably starting to do the same kind of median-blur effect that models do when they resize an image. That's my current guess for why I can see the decoy more clearly on mobile.
If that's the case, then this trick will stop working as vision models approach pixel-perfect vision, instead of the current resizing that they do. Pretty cool as steganography though.
[edit] http://lentitaliane.it/blog/wp-content/uploads/2014/10/illus...
I’m guessing it is a one-shot task. On the other hand, it’s illegible to a large percentage of humans.
I always thought that once computers got better at solving captchas than humans, they would go away.
I couldn’t have been more wrong.
Wait, what? Seriously? That’s the only text I can see. Am I an AI?
But a still frame doesn't contain the information necessary to see the actual message, so when it's paused, I can only barely see something which I suppose says something along the lines of "written in ghost text".
This is super useful; I’ve always wanted my information to be illegible when scaled…
I look forward to being able to see C-beams glitter in the dark near Tannhäuser Gate.
It seems to me like it should be easy enough to take Ghost Font, apply normal video compression techniques, and analyze the compressed signal to recover the visual outline of the letters, which you would then analyze with OCR (or an AI I guess ...). In other words, a novel CAPTCHA technique but not necessarily "fundamentally more difficult" than existing CAPTCHA techniques, once the cat-and-mouse game gets going.
https://fingswotidun.com/images/GhostFont_2_samples.jpg
https://fingswotidun.com/images/GhostFont_b_2_samples.jpg
An AI would be able to take consecutive frames rather than hamfistedly pressing the screenshot button, then accumulate enough samples to clearly make out the text from a clip shorter than the time it would take for a human to read it.
The real message is "only a human can read this" and your filters didn't get these words.
(But I think there should be a way to catch them)
Am I… am I an AI?
So the next time you're asked to click the pictures with the bicycles or traffic lights? Please do so before it's too late.
(/s, if that's necessary)
https://xkcd.com/1897/
"No problem" as in using temporal analysis with optical flow and vertical-displacement maps to estimate how the image moved, and combine those into a motion map with increased contrast to see the text. I didn't give it any instructions though, just asked it what it said.
Edit: interestingly gpt5.6 needed a slightly longer video and got it too
What this is, is a message that is more reliably readable by a sufficiently good AI than it is by all humans.
As also stated in the article.
Maybe AI will take over after all, just not due to the reasons we think.
The text is a video. Every frame contain random dots, so an individual frame by itself doesn't contain the intended message
This "font" exploits the fact that current-gen frontier models will process video one frame at time, but each frame is noise, so by looking at frames in isolation doesn't reveal anything
Then, they add a hidden message to each frame just so that the agent report something and stop trying (because if the agent tried to correlate between the frames, they could discover the trick)
But if you pass just a frame, there is no message. Just the noise plus the decoy
https://i.imgur.com/CgtyGjl.png
From a single frame you can definitely identify boundaries because the dots are sliding and get truncated.
Just a single frame (any frame). After that any modern LLM can read it (if not - single dilate step helps). Funny enough, Ghost Font is a font that machine can read much better than human.
So each frame can't be 100% random and it must show some outline - but my guess is that it's the outline of the decoy, and unrelated to the outline of the actual message
And per what was reported, it's already pretty hard for the agent to figure out the decoy. After they finally crack it, they consider the problem solved
I think it's genius. The only problem is that it's trivially defeated by some tool written specifically to read it. So it defeats current-gen agents but if it becomes popular (eg. used by captcha services), future LLMs will just write a small Python script to read it
So there are two texts, one decoy (which you can barely see in a single frame but becomes more clear if you average between frames) and an actual text, which disappears in single frames or averaged ones.
EDIT: On second look, the static screenshot does say "WRITTEN IN GHOST FONT".
I didn't go into it with an expectation, or a hypothesis. The experiment was very low effort, and had very low cost, and it was the loose equivalent of throwing some shit at the wall to see if any of it sticks.
The result was my own amusement. This result wasn't any more unexpected than any other result would have been.
What did you expect from a screenshot of obvious noise, yourself?
HackerNews never disappoints
I did this in 20 lines of code (checking only vertical perturbations), and this is what I get with subtracting frame 7 from frame 1:
https://imgur.com/a/only-human-can-read-this-vfDe6ZA
This ghost font thing is a pretty solid trick
https://pastebin.com/n1mvcxP1
So...usefulness?
Took a picture (only a single frame) and a 1s movie and threw it toward GPT 5.6 Sol (High):
Frame took 9m30s to decyper and GPT 5.6, it returned: WRITTEN IN GHOST FONT. Weird because I can only see "GHOST FONT" on the demo... but extracted data from image (I saw the highlited one) definitely looks like the "Ghost Font".
--
Video is more amusing, because after 3m GPT 5.6 figured it's motion-defined and asked to run QuickTime. At one moment I got:
> The animation is a motion-defined illusion. I’ve confirmed there’s no readable static OCR layer; I’m decoding its optical-flow field so the letter shapes become explicit.
At 4m it got extracted motion image that was in shape of letters but analyzed for 9 more letters and returned (at 13m36s) "GHOST FONT"
--
So:
:DEdit: https://imgur.com/a/SHlGu4O - work-in-progress images
It's a static decoy message independent from what you type in. You can see it if you take a long exposure pic of the screen (e.g. with your smartphone).
- "This game disappears if you pause it": https://youtu.be/Bg3RAI8uyVw
- "Illusion: If You Pause, The Image Will Disappear": https://youtu.be/ZqGfb_Vlrig
“Not just image. The sound also disappears when you pause”
Brilliant :)
And as a bonus reference - this all reminds me a lot of the book "There Is No Antimemetics Division".
https://ibb.co/WWMSXQkQ
> The decoy message serves as a final trick for a determined agent. When looking for a hidden message, it might first find the decoy message and think that that is the real embedded message in the video.
(so either I am AI at a level less than Opus 4.8 or just all-round defective as a human)
In this case, it's rendering from a hidden input element:
<input id="ghost-font-message" class="GhostFontLanding_messageInput__La9Ij" type="text" maxlength="36" placeholder="SECRET MESSAGE" autocomplete="off" spellcheck="false" value="HELLO HUMAN">
Gee.. yeah, that's entirely indecipherable.
If you want to erect security between AI and content, then ...
yeah, just don't bother. It's not even worth the trouble and it's quite likely impossible at scale anyway.
"A computer font or digital font is a digital data file containing a set of graphically related glyphs"
so it's not a font, humans can't read it and AI can.
And this thread is seemingly full of people claiming AI can read it while simultaneously sharing that AI could not read the actual message, only the decoy as demonstrated in TFA.
That’s 100% on the authors for failing to make the default main “hidden” text and the decoy easily distinguishable. The way this is set up is incredibly confusing.
It's a pretty crappy system if a portion of your intended audience can't even read it.
So once the technique is known by the model the font stops working as intended.
Out of curiosity can any of the LLM's:
- reach this [1] directly
- and decode it?
If so, which LLM's can reach it and which ones can decode it? It's just a static HTML file, nothing fancy. If any of them can reach it directly then I have homework to do. Created using:
[1] - https://nochan.net/test.htmlEDIT: To be clear, I'm talking about the "Written in Morse Code" example, fully hallucinated text. The AI agents seeing a decoy message isn't as bothersome to me.
If the string is empty, I can read "WRITTEN IN GHOST FONT" very faintly. I'm guessing that is a watermark Edit: Ah, it's decoy text. Of course.
The ADA suits will be absolutely hilarious and honestly, I can’t wait.
https://tritium.legal/blog/noroboto
It's interesting work for sure, but the end goal of separating out AI versus human consumers is tough. Indeed, if there was a lasting solution, that would be a substantial discovery that would quickly become very famous...
You just use a font that maps characters to random other ones.
So the actual source content of the doc is gibberish, but visually it looks like the correct words.
Of course a vision model could decipher it by rendering the doc, but maybe that's where this technology comes in, if you built a custom PDF renderer.
Then you'd have both obfuscated source content and rendered output.
https://x.com/doodlestein/status/2076068741255733715?s=46
Edit: Reading other comments is there meant to be 2 messages?
"ﾌㄖ乇ㄚ ᗪㄖ乇丂几'ㄒ 丂卄卂尺乇 千ㄖㄖᗪ"
However, I have noticed that voice assistants have a hard time understanding homonyms. Saying "bow" (as in to bow one's head) is often stored as "bow" (as in a bow and arrow). I wonder if there's a sufficiently complex sentence which is intelligible to humans but not to machines?
Relevant xkcd: https://xkcd.com/2793/
I wonder if this is like the “rotate an apple” problem.
Edit: looks like yes, from the shared chats people are posting. But it’s interesting to think of communication schemes that require a temporal component so any single image is unreadable and can’t be beaten by long exposures or other tricks (otherwise persistence of vision displays would satisfy). A sort of physical anti copy/paste.
Now that "Ghost Font" will be in the training material, LLMs will go "this looks to be written in Ghost Font, and as such has two messages."
For the moment. This pattern is easy to code -- it relies on the premise that a character has an inside and an outside. Outside, a pattern ascends. Inside, the reverse. Based on that simple encoding idea, decoding will be equally simple.
Is the LLM really wrong if most humans and it agree that the decoy message is the real message?
It is still at fault if it gets the “real” message when a human that can actually read it is instructing the LLM?
Also
https://www.google.com/search?q=DIS+Optical+Flow
That still makes it (well, a future version) potentially useful as a captcha if we hate our users but hate AI more.
Default: Pure static.
Zoom in: Written in ghost font.
Zoom in more: Now you can read it.
This font when screenshotted is just noise.
Changing the AI to take local motion data into account is probably not going to happen soon, due to taking quite a lot more computation, both within the AI model, and within the chromium instance being inspected.
How about writing or drawing stuff using optical illusions?
Shapes that not even human eyes can see, but the brain hallucinates: Shapes that seem to appear when you look straight at a pattern, or for a second after you look away from a pattern, or after you close your eyes, etc.
If you take a screenshot or a photo the image would just contain the same static pattern.
i.e. qualia-based "cryptography" :)
It just looks like static on old tvs to me.
Furthermore, if AI can read this or not depends on how the text sequence is pre-processed. If AI only gets snapshots of the text, it will probably fail in decoding the text as every snapshot contains only white noise and such no information. However, if we calculate the Deltas between the animation frames, the text will become decodable by an AI, you probably don't even need LLMs or CNNs for this.
I found the bot living in a simulation!
What do I win? Where's my prize?
https://oliveratkinson.net/static-captcha/
https://qri.org/blog/psycrypto-contest
https://www.youtube.com/watch?v=oD4nV0CMkBI
Of course, the psychedelic hidden message is reversible with some video processing techniques for everyone else to see. And calling it cryptography is a mis-use of the term. Still an interesting use of the effect.
I don't think "ghost font" will work as well as the author claims.
strong statement, I struggle to read it
lol. Barely.
Skill issue on promoter side.
Fable oneshotted it for me.
""" Reveal a motion-camouflaged message hidden in video noise.
How it works: The background noise scrolls vertically at a constant rate (a few px/frame), while the noise inside the letters does not follow that motion. Any single frame looks like pure static. The decode is:
Usage: python reveal_hidden_message.py input.mp4 [output.png] """import sys import cv2 import numpy as np
PAIRS = 5 # number of consecutive frame pairs to average (keep small!) BLUR_SIGMA = 6 # spatial blur of each residual, in pixels START_FRAME = 0 # where in the video to start
def load_gray_frames(path, count): cap = cv2.VideoCapture(path) frames = [] while len(frames) < count: ok, frame = cap.read() if not ok: break frames.append(cv2.cvtColor(frame, cv2.COLOR_BGR2GRAY).astype(np.float32)) cap.release() if len(frames) < 2: raise SystemExit("Could not read enough frames from the video.") return frames
def main(): if len(sys.argv) < 2: raise SystemExit(__doc__) src = sys.argv[1] dst = sys.argv[2] if len(sys.argv) > 2 else "revealed_message.png"
if __name__ == "__main__": main()Still could read https://chatgpt.com/share/6a5221f0-e3fc-83eb-bc15-74420002b6...