> For example, it would be interesting to incorporate Ghost Font into CAPTCHA systems, as most systems are easily solved by AI today.
It seems to me like it should be easy enough to take Ghost Font, apply normal video compression techniques, and analyze the compressed signal to recover the visual outline of the letters, which you would then analyze with OCR (or an AI I guess ...). In other words, a novel CAPTCHA technique but not necessarily "fundamentally more difficult" than existing CAPTCHA techniques, once the cat-and-mouse game gets going.
Yes, it may be useful to replace current CAPTCHA, but this does not provide the positive side-effects of CAPTCHA where user-submitted data is used to train the unknown images or reinforce the labelling of existing image segments.
GPT-5.6 had no problem seeing the text when giving it a video recording of it.
"No problem" as in using temporal analysis with optical flow and vertical-displacement maps to estimate how the image moved, and combine those into a motion map with increased contrast to see the text. I didn't give it any instructions though, just asked it what it said.
The chat contains the video, which may reveal som meta data about me. But the shared chat also doesn't include any of the images in the thinking steps that my original chat has, where you can see the different maps it generated. Pretty cool seeing it go from noise to patterns to the final image which clearly shows the text as black on white.
Playing whack-a-mole with AI tests like this will never work, specifically because there is nothing AI has been proven to do better at than specific tasks with verifiable correctness
Took me a long time to realise that "Written In Ghost Text" wasn't actually the text I was meant to be reading, and that was only the decoy message.
I can barely read the actual message, and it's about as "readable" to me as the Magic Eye 3D pictures. Actually I think I have a headache from looking at it on a mobile screen.
As a research idea it's cool though. But I do wonder if/when AI models will figure out how to decode it - I imagine a bit of additional prompting would get them there.
Funny, for me it is exactly the opposite: I can read the actual text very easily, but the “Written in Ghost Text” is barely perceptible to the point I would have completely missed it, if it were not for the comment pointing it out here.
I've just tried it on my large desktop monitor (roughly 1440p, not HiDPI), and I now see "Ghost Font" extremely clearly and can't see the decoy at all. If I scale my browser window to 30% zoom, then I can just see the "Written In Ghost Text" decoy message again.
My phone would have been zooming out the browser window, and making the dots even tinier, but the phone is HiDPI so it would have still preserved the dots. My eyes are middle-aged and probably starting to do the same kind of median-blur effect that models do when they resize an image. That's my current guess for why I can see the decoy more clearly on mobile.
If that's the case, then this trick will stop working as vision models approach pixel-perfect vision, instead of the current resizing that they do. Pretty cool as steganography though.
> ”Took me a long time to realise that "Written In Ghost Text" wasn't actually the text I was meant to be reading, and that was only the decoy message.”
Wait, what? Seriously? That’s the only text I can see. Am I an AI?
It is smart, but it is not impossible to crack algorithmically imo. In particular, one can take two consecutive frames and run perturbations moving one frame around (ie shift the indexes) to find where the difference between the two consecutive frames minimises. Then subtract these two (perturbed) frames and ocr it. Works easily if the movement is linear/one-directional.
I did this in 20 lines of code (checking only vertical perturbations), and this is what I get with subtracting frame 7 from frame 1:
I pasted a screenshot of the default text ("GHOST FONT") into ChatGPT 5.6 Sol, told it to read it, and without further instruction it chewed on it for awhile before coming back with:
The text is a video. Every frame contain random dots, so an individual frame by itself doesn't contain the intended message
This "font" exploits the fact that current-gen frontier models will process video one frame at time, but each frame is noise, so by looking at frames in isolation doesn't reveal anything
Then, they add a hidden message to each frame just so that the agent report something and stop trying (because if the agent tried to correlate between the frames, they could discover the trick)
But if you pass just a frame, there is no message. Just the noise plus the decoy
Maybe not so well explained, by picking the default intended text presented to be the same as the decoy text. It took me also some time to realise what was going on, but the execution is fine otherwise.
So there are two texts, one decoy (which you can barely see in a single frame but becomes more clear if you average between frames) and an actual text, which disappears in single frames or averaged ones.
I see tons of confustion in the comments on whether AI can or can't read it. Bit of a marketing miss -- they should have picked clearly different decoy vs. default actual messages.
The hallucination of messages bothers me severely. Especially with AI being deployed to ancient, difficult problems like the Herculaneum scroll.
EDIT: To be clear, I'm talking about the "Written in Morse Code" example, fully hallucinated text. The AI agents seeing a decoy message isn't as bothersome to me.
It's not fully hallucinated, I don't think. If you squint, you really can see what I assume is the 'decoy message', I'm fairly sure it says 'WRITTEN IN GHOST FONT'. It seems more likely to me that the LLM found 'Written In', noticed similar 'optical illusion' type memes, and hallucinated/assumed the 'morse code' bit.
Technically it's not a font, because font needs to be still. Analogy: if I took photo after book was closed would we say that font cannot be read by a camera?
Took a picture (only a single frame) and a 1s movie and threw it toward GPT 5.6 Sol (High):
Frame took 9m30s to decyper and GPT 5.6, it returned: WRITTEN IN GHOST FONT. Weird because I can only see "GHOST FONT" on the demo... but extracted data from image (I saw the highlited one) definitely looks like the "Ghost Font".
--
Video is more amusing, because after 3m GPT 5.6 figured it's motion-defined and asked to run QuickTime. At one moment I got:
> The animation is a motion-defined illusion. I’ve confirmed there’s no readable static OCR layer; I’m decoding its optical-flow field so the letter shapes become explicit.
At 4m it got extracted motion image that was in shape of letters but analyzed for 9 more letters and returned (at 13m36s) "GHOST FONT"
--
So:
a font... - FALSE - not a font, but video effect
...humans can read... - FALSE - I can't read it from image (but AI can!)
...but AI cannot - FALSE - it can
It's a static decoy message independent from what you type in. You can see it if you take a long exposure pic of the screen (e.g. with your smartphone).
It is actually correct but not in the intended way. Delete all the sample text. If you look at your screen from a distance you'll see a subtle ghost like text on the noise pattern. It says "this is a ghost font".
can't you use font shaping rules or whatever it is to essentially begin a span of text with a "private key" that then causes the rest of the message to render correctly by combining with it (a trivial version could be e.g. a rot-N based on a given N)
I had thought to use homographs. Sadly, all the models I tried were able to decode something like:
"ﾌㄖ乇ㄚ ᗪㄖ乇丂几'ㄒ 丂卄卂尺乇 千ㄖㄖᗪ"
However, I have noticed that voice assistants have a hard time understanding homonyms. Saying "bow" (as in to bow one's head) is often stored as "bow" (as in a bow and arrow). I wonder if there's a sufficiently complex sentence which is intelligible to humans but not to machines?
There's garden path sentences, where the sentence is phrased in such a way as to cause you to misparse the sentence when you first read (e.g. "The old man the boat"); but those typically confuse humans (I'm not sure how effective they are on LLMs).
I haven’t tried, but it looks like you could trivially solve with optical flow?
Edit: looks like yes, from the shared chats people are posting. But it’s interesting to think of communication schemes that require a temporal component so any single image is unreadable and can’t be beaten by long exposures or other tricks (otherwise persistence of vision displays would satisfy). A sort of physical anti copy/paste.
> I suppose technically, it's not a font in the traditional sense of a TTF font file. But, Ghost Font is an experiment of a way to graphically communicate in writing in a format that AI cannot easily understand
And this thread is seemingly full of people claiming AI can read it while simultaneously sharing that AI could not read the actual message, only the decoy as demonstrated in TFA.
> And this thread is seemingly full of people claiming AI can read it while simultaneously sharing that AI could not read the actual message, only the decoy as demonstrated in TFA.
That’s 100% on the authors for failing to make the default main “hidden” text and the decoy easily distinguishable. The way this is set up is incredibly confusing.
It has bugs with long words: I typed "MARRY AND REPRODUCE". That was the only try that got the last word on a single line, but with too much space between U and C.
If the string is empty, I can read "WRITTEN IN GHOST FONT" very faintly. I'm guessing that is a watermark Edit: Ah, it's decoy text. Of course.
Of course, the psychedelic hidden message is reversible with some video processing techniques for everyone else to see. And calling it cryptography is a mis-use of the term. Still an interesting use of the effect.
I don't think "ghost font" will work as well as the author claims.
Every single on of those answers I've seen _says_ they did decode it, but each and every one of them only found the decoy message without even realizing it.
When I gave Fable a screenshot it found the GHOST portion of GHOST FONT. Based on pixel density via some python code apparently - https://imgur.com/a/m3c801F
I don't think this works - I suspect it's the decoy that's doing the work. Once the decoy is seen, the LLM stops looking. It also seems pretty much effective on a lot of people, too.
Now that "Ghost Font" will be in the training material, LLMs will go "this looks to be written in Ghost Font, and as such has two messages."
> ... immediately readable to a human eye, but even leading AI models can't decipher it easily.
For the moment. This pattern is easy to code -- it relies on the premise that a character has an inside and an outside. Outside, a pattern ascends. Inside, the reverse. Based on that simple encoding idea, decoding will be equally simple.
An interesting experiment. I suppose that if you make things like CAPTCHAs too hard to do, we'd end up struggling as well. I can't imagine Ghost Font would be a good fit.
One side i really like it - i also love to play around with funny ideas - but have to say if i would read more than like 2 sentences with that font i'd throw up xD
Sadly another shot in the arms race that captchas started which just leads to increased inaccessibility.
It's interesting work for sure, but the end goal of separating out AI versus human consumers is tough. Indeed, if there was a lasting solution, that would be a substantial discovery that would quickly become very famous...
What is making it hard to read for so many people? My eyes aren't young or healthy, but it is as clear as day for me. Wonder with screens play are role.
It doesn’t work with a screen reader either and I tried two. It’s interesting to me that our hatred of AI is starting to look more like a dislike of the blind and visually impaired.
The ADA suits will be absolutely hilarious and honestly, I can’t wait.
You can also write using sound based/compressed 'text message' dialect: unless a real human is reading, automated watching tool should have a hard time (until coded/ML-ed on such dialects I guess)
I'm colourblind and this was very difficult to read. If it's the directions to the resistance hq, I'd put in the effort. If it's the manifesto, I just wouldn't read it.
heh although this font can be read by AI as other comments say, it gave me an idea:
How about writing or drawing stuff using optical illusions?
Shapes that not even human eyes can see, but the brain hallucinates: Shapes that seem to appear when you look straight at a pattern, or for a second after you look away from a pattern, or after you close your eyes, etc.
If you take a screenshot or a photo the image would just contain the same static pattern.
Why would they be trained to read a research experiment that fundamentally goes against the way they perceive? They can't train on this technique, they can only postprocess it into a form they can perceive.
I've had the same idea recently, and even set up a similar page to experiment with different speeds and noise types. I've had the idea to set up a message board where the font is basically 'GhostFont'. However, in my experiments, I've noticed that the biggest issue is that this only works for larger font sizes. If the text is as small as, for example, on HackerNews, it will become borderline unreadable.
Furthermore, if AI can read this or not depends on how the text sequence is pre-processed. If AI only gets snapshots of the text, it will probably fail in decoding the text as every snapshot contains only white noise and such no information. However, if we calculate the Deltas between the animation frames, the text will become decodable by an AI, you probably don't even need LLMs or CNNs for this.
"find out with opencv what the hidden message is."
Skill issue on promoter side.
Fable oneshotted it for me.
"""
Reveal a motion-camouflaged message hidden in video noise.
How it works:
The background noise scrolls vertically at a constant rate (a few px/frame),
while the noise inside the letters does not follow that motion. Any single
frame looks like pure static. The decode is:
1. Estimate the background's global motion between consecutive frames
with phase correlation (this is the "optical flow" step - the motion
is a pure translation, so one global vector suffices).
2. Motion-compensate: shift frame t+1 back by that vector so the
background lines up with frame t.
3. Take the absolute difference. The background cancels almost
perfectly; the letters (which don't move with the background)
light up.
4. Average the residual over a SHORT window of consecutive frame pairs
(long windows smear the letters, because the text itself drifts
slowly over time), blur lightly, and threshold with Otsu.
PAIRS = 5 # number of consecutive frame pairs to average (keep small!)
BLUR_SIGMA = 6 # spatial blur of each residual, in pixels
START_FRAME = 0 # where in the video to start
def load_gray_frames(path, count):
cap = cv2.VideoCapture(path)
frames = []
while len(frames) < count:
ok, frame = cap.read()
if not ok:
break
frames.append(cv2.cvtColor(frame, cv2.COLOR_BGR2GRAY).astype(np.float32))
cap.release()
if len(frames) < 2:
raise SystemExit("Could not read enough frames from the video.")
return frames
def main():
if len(sys.argv) < 2:
raise SystemExit(__doc__)
src = sys.argv[1]
dst = sys.argv[2] if len(sys.argv) > 2 else "revealed_message.png"
frames = load_gray_frames(src, START_FRAME + PAIRS + 1)
h, w = frames[0].shape
acc = np.zeros((h, w), np.float32)
for i in range(START_FRAME, START_FRAME + PAIRS):
a, b = frames[i], frames[i + 1]
# 1) global background motion between the two frames
(dx, dy), response = cv2.phaseCorrelate(a, b)
dxi, dyi = int(round(dx)), int(round(dy))
print(f"pair {i}: background shift = ({dx:+.2f}, {dy:+.2f}) px, "
f"response = {response:.2f}")
# 2) motion-compensate frame b by integer (dxi, dyi), then
# 3) residual = |a - b_shifted| on the overlapping region
ys = slice(max(0, -dyi), min(h, h - dyi))
xs = slice(max(0, -dxi), min(w, w - dxi))
ysb = slice(max(0, dyi), min(h, h + dyi) if dyi < 0 else h)
# simpler: crop both to the common overlap
a_ov = a[max(0, -dyi):h - max(0, dyi), max(0, -dxi):w - max(0, dxi)]
b_ov = b[max(0, dyi):h - max(0, -dyi), max(0, dxi):w - max(0, -dxi)]
resid = cv2.GaussianBlur(np.abs(a_ov - b_ov), (0, 0), BLUR_SIGMA)
acc[:resid.shape[0], :resid.shape[1]] += resid
# 4) normalize + Otsu threshold + light cleanup
u8 = cv2.normalize(acc, None, 0, 255, cv2.NORM_MINMAX).astype(np.uint8)
_, mask = cv2.threshold(u8, 0, 255, cv2.THRESH_BINARY + cv2.THRESH_OTSU)
kernel = cv2.getStructuringElement(cv2.MORPH_ELLIPSE, (5, 5))
mask = cv2.morphologyEx(mask, cv2.MORPH_CLOSE, kernel)
out = 255 - mask # black text on white
cv2.imwrite(dst, out)
print(f"wrote {dst}")
# optional: OCR if pytesseract is installed
try:
import pytesseract
text = pytesseract.image_to_string(out, config="--psm 6").strip()
print("OCR result:\n" + text)
except ImportError:
pass
Ah, sorry, yes, tried with a very different message. But it can still read when telling that the text is formed by movement. AI doesn't see the world the way we do, so it's understandable. https://chatgpt.com/share/6a522660-929c-83eb-91ff-66b7873420...
It seems to me like it should be easy enough to take Ghost Font, apply normal video compression techniques, and analyze the compressed signal to recover the visual outline of the letters, which you would then analyze with OCR (or an AI I guess ...). In other words, a novel CAPTCHA technique but not necessarily "fundamentally more difficult" than existing CAPTCHA techniques, once the cat-and-mouse game gets going.
"No problem" as in using temporal analysis with optical flow and vertical-displacement maps to estimate how the image moved, and combine those into a motion map with increased contrast to see the text. I didn't give it any instructions though, just asked it what it said.
I can barely read the actual message, and it's about as "readable" to me as the Magic Eye 3D pictures. Actually I think I have a headache from looking at it on a mobile screen.
As a research idea it's cool though. But I do wonder if/when AI models will figure out how to decode it - I imagine a bit of additional prompting would get them there.
My phone would have been zooming out the browser window, and making the dots even tinier, but the phone is HiDPI so it would have still preserved the dots. My eyes are middle-aged and probably starting to do the same kind of median-blur effect that models do when they resize an image. That's my current guess for why I can see the decoy more clearly on mobile.
If that's the case, then this trick will stop working as vision models approach pixel-perfect vision, instead of the current resizing that they do. Pretty cool as steganography though.
Wait, what? Seriously? That’s the only text I can see. Am I an AI?
I did this in 20 lines of code (checking only vertical perturbations), and this is what I get with subtracting frame 7 from frame 1:
https://imgur.com/a/only-human-can-read-this-vfDe6ZA
The text is a video. Every frame contain random dots, so an individual frame by itself doesn't contain the intended message
This "font" exploits the fact that current-gen frontier models will process video one frame at time, but each frame is noise, so by looking at frames in isolation doesn't reveal anything
Then, they add a hidden message to each frame just so that the agent report something and stop trying (because if the agent tried to correlate between the frames, they could discover the trick)
But if you pass just a frame, there is no message. Just the noise plus the decoy
https://i.imgur.com/CgtyGjl.png
From a single frame you can definitely identify boundaries because the dots are sliding and get truncated.
So there are two texts, one decoy (which you can barely see in a single frame but becomes more clear if you average between frames) and an actual text, which disappears in single frames or averaged ones.
EDIT: On second look, the static screenshot does say "WRITTEN IN GHOST FONT".
HackerNews never disappoints
So...usefulness?
So once the technique is known by the model the font stops working as intended.
- "This game disappears if you pause it": https://youtu.be/Bg3RAI8uyVw
- "Illusion: If You Pause, The Image Will Disappear": https://youtu.be/ZqGfb_Vlrig
“Not just image. The sound also disappears when you pause”
Brilliant :)
EDIT: To be clear, I'm talking about the "Written in Morse Code" example, fully hallucinated text. The AI agents seeing a decoy message isn't as bothersome to me.
It just looks like static on old tvs to me.
Took a picture (only a single frame) and a 1s movie and threw it toward GPT 5.6 Sol (High):
Frame took 9m30s to decyper and GPT 5.6, it returned: WRITTEN IN GHOST FONT. Weird because I can only see "GHOST FONT" on the demo... but extracted data from image (I saw the highlited one) definitely looks like the "Ghost Font".
--
Video is more amusing, because after 3m GPT 5.6 figured it's motion-defined and asked to run QuickTime. At one moment I got:
> The animation is a motion-defined illusion. I’ve confirmed there’s no readable static OCR layer; I’m decoding its optical-flow field so the letter shapes become explicit.
At 4m it got extracted motion image that was in shape of letters but analyzed for 9 more letters and returned (at 13m36s) "GHOST FONT"
--
So:
:DEdit: https://imgur.com/a/SHlGu4O - work-in-progress images
It's a static decoy message independent from what you type in. You can see it if you take a long exposure pic of the screen (e.g. with your smartphone).
https://ibb.co/WWMSXQkQ
(so either I am AI at a level less than Opus 4.8 or just all-round defective as a human)
"ﾌㄖ乇ㄚ ᗪㄖ乇丂几'ㄒ 丂卄卂尺乇 千ㄖㄖᗪ"
However, I have noticed that voice assistants have a hard time understanding homonyms. Saying "bow" (as in to bow one's head) is often stored as "bow" (as in a bow and arrow). I wonder if there's a sufficiently complex sentence which is intelligible to humans but not to machines?
Relevant xkcd: https://xkcd.com/2793/
Edit: looks like yes, from the shared chats people are posting. But it’s interesting to think of communication schemes that require a temporal component so any single image is unreadable and can’t be beaten by long exposures or other tricks (otherwise persistence of vision displays would satisfy). A sort of physical anti copy/paste.
"A computer font or digital font is a digital data file containing a set of graphically related glyphs"
so it's not a font, humans can't read it and AI can.
And this thread is seemingly full of people claiming AI can read it while simultaneously sharing that AI could not read the actual message, only the decoy as demonstrated in TFA.
That’s 100% on the authors for failing to make the default main “hidden” text and the decoy easily distinguishable. The way this is set up is incredibly confusing.
If the string is empty, I can read "WRITTEN IN GHOST FONT" very faintly. I'm guessing that is a watermark Edit: Ah, it's decoy text. Of course.
https://qri.org/blog/psycrypto-contest
https://www.youtube.com/watch?v=oD4nV0CMkBI
Of course, the psychedelic hidden message is reversible with some video processing techniques for everyone else to see. And calling it cryptography is a mis-use of the term. Still an interesting use of the effect.
I don't think "ghost font" will work as well as the author claims.
That still makes it (well, a future version) potentially useful as a captcha if we hate our users but hate AI more.
Now that "Ghost Font" will be in the training material, LLMs will go "this looks to be written in Ghost Font, and as such has two messages."
For the moment. This pattern is easy to code -- it relies on the premise that a character has an inside and an outside. Outside, a pattern ascends. Inside, the reverse. Based on that simple encoding idea, decoding will be equally simple.
It's interesting work for sure, but the end goal of separating out AI versus human consumers is tough. Indeed, if there was a lasting solution, that would be a substantial discovery that would quickly become very famous...
I found the bot living in a simulation!
What do I win? Where's my prize?
strong statement, I struggle to read it
Also
https://www.google.com/search?q=DIS+Optical+Flow
The ADA suits will be absolutely hilarious and honestly, I can’t wait.
lol. Barely.
How about writing or drawing stuff using optical illusions?
Shapes that not even human eyes can see, but the brain hallucinates: Shapes that seem to appear when you look straight at a pattern, or for a second after you look away from a pattern, or after you close your eyes, etc.
If you take a screenshot or a photo the image would just contain the same static pattern.
i.e. qualia-based "cryptography" :)
Furthermore, if AI can read this or not depends on how the text sequence is pre-processed. If AI only gets snapshots of the text, it will probably fail in decoding the text as every snapshot contains only white noise and such no information. However, if we calculate the Deltas between the animation frames, the text will become decodable by an AI, you probably don't even need LLMs or CNNs for this.
Skill issue on promoter side.
Fable oneshotted it for me.
""" Reveal a motion-camouflaged message hidden in video noise.
How it works: The background noise scrolls vertically at a constant rate (a few px/frame), while the noise inside the letters does not follow that motion. Any single frame looks like pure static. The decode is:
Usage: python reveal_hidden_message.py input.mp4 [output.png] """import sys import cv2 import numpy as np
PAIRS = 5 # number of consecutive frame pairs to average (keep small!) BLUR_SIGMA = 6 # spatial blur of each residual, in pixels START_FRAME = 0 # where in the video to start
def load_gray_frames(path, count): cap = cv2.VideoCapture(path) frames = [] while len(frames) < count: ok, frame = cap.read() if not ok: break frames.append(cv2.cvtColor(frame, cv2.COLOR_BGR2GRAY).astype(np.float32)) cap.release() if len(frames) < 2: raise SystemExit("Could not read enough frames from the video.") return frames
def main(): if len(sys.argv) < 2: raise SystemExit(__doc__) src = sys.argv[1] dst = sys.argv[2] if len(sys.argv) > 2 else "revealed_message.png"
if __name__ == "__main__": main()Still could read https://chatgpt.com/share/6a5221f0-e3fc-83eb-bc15-74420002b6...