What Is Ghost Font? How Motion-Only Text Exposes an AI Video Blind Spot

Ghost Font is an experimental form of animated typography in which letters are defined by motion rather than visible lines, colors or contrast.

A typical Ghost Font animation appears to contain hundreds or thousands of nearly identical moving dots. The dots inside the hidden letters travel in one direction, while the surrounding dots move in another. A human viewer quickly groups the differently moving dots and sees a word. Pause the animation, however, and the letters disappear into what looks like random static.

That distinction matters. Most conventional text-recognition systems search for information that exists within an individual image: edges, character shapes, color differences and spacing. Ghost Font moves the useful information out of any single frame and places it in the relationship between frames.

The original Ghost Font browser experiment was created by designer Eric Lu and published through Mixfont in July 2026. Lu describes it as an experimental “anti-AI font,” although it is technically a video generator rather than an installable font file. The project combines moving dots, visual noise and optional decoy information to test whether humans and AI systems perceive animated text differently. (Mixfont)

The important correction is that Ghost Font does not produce text that AI can never read. It produces text that many current, general-purpose AI systems do not reliably perceive without specialized temporal analysis.

The essential idea

Ghost Font takes advantage of a simple perceptual divide:

Humans often perceive an object by noticing which parts of a scene move together. Many AI systems still begin by analyzing separate images and only later attempt to reason about how those images relate over time.

That makes Ghost Font an unusually clear demonstration of an emerging problem sometimes called AI time blindness.

Research presented at CVPR 2026 found a remarkably similar effect. In the SpookyBench benchmark, researchers encoded words, objects and scenes entirely through changes in noise over time. Each individual video frame contained no recognizable object. Human participants identified the hidden content with approximately 98% accuracy, while more than 25 tested video vision-language models scored 0% on the benchmark’s original stimuli. (CVF Open Access)

Ghost Font is therefore more than a viral optical illusion. It represents a real and measurable gap between biological and artificial vision—although that gap is unlikely to remain permanent.

How Ghost Font works

The easiest way to understand Ghost Font is to imagine a stencil placed over a field of moving particles.

The stencil contains the desired word. It is not shown to the viewer. Instead, it controls how the particles move.

1. A hidden text mask is created

The system first renders a word internally as a black-and-white mask.

Pixels inside the letters belong to the foreground. Everything outside the letters belongs to the background.

The user never needs to see this mask directly.

2. The screen is filled with similar-looking dots

A large number of dots or noise particles are distributed across the screen.

The foreground and background dots can have the same size, color, brightness and density. This is important because it prevents the text from being visible through ordinary contrast.

In a properly constructed animation, a screenshot does not contain an obvious letter shape.

3. Foreground and background particles move differently

Dots located inside the hidden text may move upward, while dots outside it move downward. Another version might move foreground dots left and background dots right.

In simplified form:

• Foreground velocity: v
• Background velocity: −v

Because the two regions move in opposite directions, the relative motion at the edge of each letter becomes especially noticeable.

Opposite movement is not the only possible configuration. Different speeds, angles, accelerations or motion patterns could also separate the text from its background. Opposite vectors simply create a strong motion contrast.

4. The letters emerge only over time

At any one moment, the dots may still appear randomly distributed.

During playback, however, the viewer notices that one group of dots shares one direction while another group shares a different direction. The boundaries between those groups define the letters.

The message therefore does not exist as an ordinary visible image. It exists as a structured motion field.

5. Optional decoy information can mislead static analysis

The Ghost Font experiment can also contain spatial or metadata-based decoys. A model that searches individual frames, file labels, captions or other static clues may confidently report the decoy while missing the motion-defined message.

This is not merely concealment. It can become a form of adversarial misdirection: the machine is not only denied the correct answer but encouraged toward an incorrect one. The creator reports that tested models sometimes detected the decoy rather than the moving message, though those informal tests should not be treated as a standardized security evaluation. (Mixfont)

Why humans can read moving dots as letters

Ghost Font is sometimes explained as “persistence of vision,” but that phrase does not fully describe what is happening.

The more precise explanation involves:

• Temporal integration
• Motion segmentation
• Motion-defined contours
• Figure-ground separation
• The Gestalt principle of common fate

Common fate

The Gestalt principle of common fate describes the human tendency to group visual elements that move together.

A flock of birds may contain hundreds of separate bodies, but we can immediately perceive smaller groups based on their shared direction and speed. Similarly, dots moving together inside a Ghost Font letter are interpreted as belonging to the same visual object.

Research on human perception has repeatedly shown that motion can influence form recognition. Texture elements sharing the same motion can be grouped into a contour or region, even when no brightness-defined border exists. (PMC)

Motion-defined contours

Most ordinary letters are defined by luminance boundaries: dark ink against white paper, for example.

Ghost Font letters are defined by kinetic boundaries. The visual boundary appears because particles on one side move differently from particles on the other.

Neuroscience research has identified human visual responses specifically associated with contours defined through motion differences. Studies have also found orientation-selective responses to motion boundaries across parts of the visual cortex. (PMC)

Your visual system is therefore not waiting for a complete letter-shaped image. It is continuously estimating motion, separating regions and reconstructing an object from their behavior.

Temporal integration

The brain also combines evidence collected over a brief period.

A single frame may be ambiguous. After several frames, the consistent movement of the particles supplies enough evidence for the hidden form to emerge.

This is why Ghost Font often appears almost instantly once it starts moving but vanishes the moment it is paused.

Why many AI systems struggle with Ghost Font

It is tempting to say that AI “sees a video as individual pictures.” That is broadly useful as an explanation, but the technical reality is more nuanced.

Some video models do calculate temporal features. Some use video encoders, temporal attention or motion-aware training. The problem is that many current systems still place a heavy emphasis on spatial information extracted from selected frames.

Video is computationally expensive

A ten-second video at 30 frames per second contains 300 images. Processing every pixel of every frame at full resolution would require far more computation and memory than analyzing one photograph.

To reduce that cost, many multimodal systems:

1. Sample a limited number of frames.
2. Process the selected frames with an image-oriented visual encoder.
3. Compress those visual features into tokens.
4. Send the tokens to a language model for interpretation.

Research on video-language models notes that uniform frame sampling can discard important temporal evidence. Current systems must balance the number of frames against the amount of detail preserved within each frame. (CVF Open Access)

Ghost Font targets that compromise.

If every sampled frame resembles random noise, selecting more isolated frames may not help. The system must explicitly compare nearby frames, estimate particle movement and reconstruct the boundary separating the motion groups.

Ordinary OCR has almost nothing to recognize

Optical character recognition generally looks for features such as:

• Connected strokes
• Character contours
• Contrast boundaries
• Repeated letter structures
• Predictable spacing
• Baselines and alignment

Ghost Font removes or weakens those cues.

There may be no stable line forming the side of an “H.” The vertical stroke exists only as a region in which dots maintain one motion direction.

Running OCR on a screenshot is therefore the wrong operation. It is comparable to trying to understand a melody by examining one isolated sound sample.

Frame sampling can destroy the signal

Motion is not contained in one frame. It is calculated from change between closely spaced frames.

If a model samples frames too far apart, particles may have moved so extensively that their correspondence becomes difficult to establish. Compression, resizing and frame interpolation can further alter small-dot motion.

A human watching continuous playback receives a dense stream of visual evidence. A model receiving eight or sixteen resized frames may receive a very different stimulus.

The scientific connection: SpookyBench and AI “time blindness”

Ghost Font itself is a design experiment, not a peer-reviewed scientific benchmark. However, the CVPR 2026 SpookyBench study examined nearly the same underlying phenomenon in a controlled research setting.

SpookyBench contains 451 videos averaging approximately 7.1 seconds and 333 frames each. Its categories include motion-defined text, object silhouettes and dynamic scenes. For the text and object tasks, foreground and background noise move in opposing directions. Each individual frame looks like noise, while the content becomes perceptible during playback. (Timeblindness)

The study reported:

• Approximately 98% human accuracy
• Six human annotators
• More than 25 open and closed video models tested
• Model sizes ranging from roughly 2 billion to 78 billion parameters
• 0% accuracy across the tested models on the original benchmark
• No meaningful improvement from chain-of-thought prompting
• No success after limited fine-tuning experiments

Most importantly, the information was not cryptographically hidden. It remained computationally recoverable.

When researchers calculated motion boundaries using classical optical-flow processing and overlaid those boundaries onto visible frames, performance increased to 51.5% for one tested model and 59.1% for another. (Timeblindness)

That result explains both the power and the limitation of Ghost Font:

The information is present. Current general-purpose AI pipelines often fail to extract it in their normal workflow.

Can AI decode Ghost Font?

Yes. A purpose-built system can probably decode many Ghost Font animations.

A basic attack could:

1. Extract every frame from the video.
2. Compare adjacent frames.
3. Estimate the direction and speed of local particle movement.
4. Group pixels or dots by their motion vectors.
5. Identify the boundary between the motion groups.
6. Accumulate the boundary over multiple frames.
7. Produce a visible text mask.
8. Run conventional OCR on the reconstructed image.

This process could use:

• Frame differencing
• Dense optical flow
• Motion-energy filters
• Feature tracking
• Codec motion vectors
• Temporal frequency analysis
• Neural video segmentation

Even the official Ghost Font page acknowledges that the project is not encryption and that actual secrecy requires a password, key or established cryptographic method. (Mixfont)

The accurate claim is therefore:

Ghost Font is difficult for many current AI assistants to read through their normal video-analysis interfaces, but it is not inherently unreadable by computers.

That wording may sound less dramatic, but it is far more important technically. Ghost Font demonstrates a weakness in common AI architectures and product pipelines—not a permanent law separating human and machine intelligence.

Ghost Font is not a new type of encryption

Ghost Font should never be used to transmit:

• Passwords
• Financial information
• Authentication codes
• Private medical information
• Confidential business material
• Encryption keys
• Anything whose disclosure could cause harm

The video contains the message. The message is merely encoded in motion.

Once an attacker understands the technique, the attacker can build a decoder. Unlike encryption, Ghost Font does not require possession of a secret key to recover the content.

It is better understood as perceptual obfuscation.

How Ghost Font differs from earlier anti-OCR fonts

The idea of designing text for humans but not machines predates Ghost Font.

In 2013, designer Sang Mun drew attention to automated surveillance through ZXX, a family of typefaces containing camouflage, false letters, crossing lines and visual noise. ZXX attempted to interfere with the OCR systems available at the time. It was primarily a design provocation rather than a guaranteed security mechanism. (WIRED)

Modern vision models can often read the static ZXX examples that once confused conventional OCR. The Ghost Font creator cites this history as one motivation for moving the signal from static letterforms into animation. (Mixfont)

The difference is fundamental:

Ghost Font does not merely make letters uglier. It changes the dimension in which the letters exist.

Could Ghost Font become a CAPTCHA?

Potentially—but only as one component of a larger anti-bot system.

CAPTCHA stands for “Completely Automated Public Turing Test to Tell Computers and Humans Apart.” The term was introduced by Carnegie Mellon researchers in 2000. Its core premise is that a website can present a task that is easy for humans but difficult for automated systems. (Captcha)

That premise is under increasing pressure.

At USENIX Security 2025, researchers presented a generalized vision-language-model CAPTCHA solver called Halligan. It achieved a 60.7% solving rate across 2,600 challenges representing 26 visual CAPTCHA types. During tests involving previously unseen challenges encountered through CAPTCHA-solving farms, it reached an average solving rate of 70.6%. (USENIX)

Motion-defined text offers CAPTCHA designers another dimension to exploit.

Possible advantages of a Ghost Font CAPTCHA

Static screenshots become less useful

A bot that captures one screenshot may receive no recoverable answer.

This would block many simple automation pipelines that assume the challenge can be reduced to a still image.

Every challenge could use different motion

A system could randomize:

• Text
• Font
• Dot density
• Particle size
• Particle lifetime
• Foreground direction
• Background direction
• Speed
• Acceleration
• Frame rate
• Noise structure
• Motion coherence
• Decoy content

That variability would make a single fixed decoder less effective.

The task can feel easier than distorted text

For users who perceive the motion clearly, an ordinary-looking word may emerge without the warped letters and overlapping lines associated with traditional CAPTCHAs.

Motion-based CAPTCHA concepts are not entirely new. Earlier systems and patents proposed using relative movement, partial obstruction and human visual integration to reveal text across an animation. Ghost Font is a cleaner modern demonstration of the broader principle. (Google Patents)

Decoys could identify unsophisticated bots

A CAPTCHA could include one answer visible to basic static OCR and a different answer defined through motion.

Selecting the static answer would provide evidence that the response came from a screenshot-oriented solver.

This should not be treated as definitive proof of automation, but it could contribute to a wider risk score.

It could be used selectively

A motion challenge would be most reasonable as a step-up verification method shown only after other signals indicate suspicious activity.

Most users should not have to solve any visible puzzle at all.

What a secure implementation would require

A real motion CAPTCHA would need substantially more engineering than the public Ghost Font demonstration.

Server-side challenge generation

The correct answer should be selected and signed by the server.

If the browser receives the plaintext answer, an automated tool may extract it from:

• JavaScript variables
• HTML attributes
• Network responses
• Accessibility labels
• Canvas instructions
• Client-side text masks

Generating a visually clever animation is useless if the answer is exposed elsewhere in the application.

Short-lived, session-bound challenges

Each challenge should be associated with:

• A unique nonce
• The current session
• The protected action
• A short expiration time
• A limited number of attempts

This reduces replay attacks in which a previously solved animation and answer are reused.

Randomized temporal construction

Changing only the displayed word would not be sufficient. The motion-generation process should also vary.

A defensive system could randomize the number and direction of motion classes, introduce controlled dot turnover, alter temporal frequencies and occasionally use non-text shapes.

Rate limiting and behavioral risk analysis

A correct answer should not automatically establish that an entire session is trustworthy.

The site should still evaluate request rate, account history, network reputation, repeated failures, browser integrity and other abuse indicators.

Server-side verification

The browser should submit the user’s answer along with the challenge token. The server—not client-side JavaScript—must decide whether the response is valid.

Continuous red-team testing

The system should be tested against:

• Static OCR
• Multimodal assistants
• Dense frame extraction
• Optical-flow methods
• Codec-vector analysis
• Purpose-trained neural models
• Replay attacks
• Human-solving services
• Accessibility technologies

A CAPTCHA cannot be considered strong merely because several popular chatbots failed during an informal test.

The accessibility problem

Motion-based text may be easy for some users and impossible for others.

Possible barriers include:

• Low vision
• Reduced contrast sensitivity
• Impaired motion perception
• Vestibular or motion sensitivity
• Cognitive or attention-related difficulties
• Small mobile displays
• Low-refresh-rate screens
• Video compression
• Reduced-motion operating-system settings
• Slow or unstable connections

Continuous animation can also distract or physically affect some users. W3C accessibility guidance recommends giving users control over moving content and providing an alternative CAPTCHA using a different sensory or cognitive modality. (W3C)

A motion CAPTCHA should therefore never be the only route into an account or service.

Possible alternatives include:

• An accessible audio challenge
• Email or device confirmation
• Passkeys
• One-time codes
• A nonvisual interactive challenge
• Human support
• Background risk verification requiring no puzzle

The alternative should provide equivalent access rather than functioning as an intentionally inferior fallback.

Why the future of CAPTCHA is probably not another puzzle

Ghost Font may inspire a new generation of temporal CAPTCHAs, but the larger trend is moving away from forcing every human to complete a visual test.

Cloudflare Turnstile, for example, describes itself as a CAPTCHA alternative. It can evaluate small browser challenges, environmental signals and browser behavior without necessarily showing the visitor a visual puzzle. Cloudflare states that Turnstile can use proof-of-work, proof-of-space, browser API checks and other signals to adapt verification to the request. (Cloudflare Docs)

That approach reflects an uncomfortable reality: there may no longer be one universal visual puzzle that remains easy for every human and reliably difficult for every AI system.

Any fixed challenge creates training data. Once it is deployed widely:

1. Attackers collect examples.
2. Solvers are built.
3. Models are trained or adapted.
4. The challenge becomes weaker.
5. Designers increase its difficulty.
6. Human usability declines.

Ghost Font may temporarily restore part of the human-machine gap by shifting the challenge into motion. But if it became widely used, temporal models and specialized decoders would quickly be trained against it.

The strongest future systems will likely combine:

• Passive risk scoring
• Rate limiting
• Cryptographic device or session signals
• Proof-of-work when appropriate
• Account reputation
• Abuse-pattern detection
• Short-lived step-up challenges
• Multiple accessible verification paths
• Human review for exceptional cases

In that architecture, Ghost Font would not replace CAPTCHA. It would become one optional challenge in a rotating collection.

A better term: temporal human verification

Calling Ghost Font a “font” makes the concept approachable, but it may limit how we think about it.

The broader category could be described as temporal human verification: challenges whose meaningful information exists in change over time rather than in a static image.

Examples could include:

• Motion-defined words
• Shapes revealed through coordinated movement
• Objects defined by flicker timing
• Boundaries visible only during transitions
• User-controlled motion that reveals a symbol
• Brief temporal sequences that must be ordered
• Motion patterns combined with a simple semantic question

Researchers are already exploring video boundaries, visual illusions and other human-perception advantages as possible CAPTCHA mechanisms. For example, IllusionCAPTCHA uses perceptual illusions intended to remain intuitive for humans while misleading multimodal models, while BounTCHA investigates human sensitivity to changes and boundaries in generated videos. (arXiv)

The common strategy is no longer simply “damage the text until OCR fails.” It is to identify perceptual operations humans perform naturally that current AI pipelines do not yet perform reliably.

What Ghost Font tells us about AI vision

Ghost Font demonstrates that recognizing every object in a frame is not the same as understanding a visual experience.

A system may be excellent at:

• Describing photographs
• Reading documents
• Identifying objects
• Answering questions about selected video frames

Yet still fail when meaning exists only in:

• Movement
• Timing
• Synchronization
• Rhythm
• Temporal order
• Motion-defined boundaries

This does not mean human vision is universally superior. AI systems can detect wavelengths, statistical patterns and microscopic differences that humans cannot perceive. The lesson is narrower and more valuable:

Human and machine perception have different strengths, shortcuts and failure modes.

Ghost Font turns one of those differences into something anyone can see.

Is Ghost Font the future of CAPTCHA?

Ghost Font is probably not the final answer to automated abuse.

It is more valuable as a design principle:

Do not assume information must be placed inside a static image. Meaning can be encoded in time, motion and interaction.

Motion-defined challenges could temporarily raise the cost of automated solving, especially for bots built around screenshots and ordinary multimodal APIs. They could also produce more natural verification tasks than heavily distorted text.

But the technique has three unavoidable weaknesses:

1. Specialized motion analysis can recover the message.
2. Widespread deployment would produce training data for better solvers.
3. A visual-motion requirement can exclude legitimate users.

Ghost Font should therefore be treated as a promising research direction, not a finished security product.

Its real contribution is showing exactly where many current AI systems remain weak—and giving CAPTCHA designers a new dimension in which to experiment.

Frequently Asked Questions

What is Ghost Font?

Ghost Font is an animated text system that defines letters through differences in particle movement. Humans can often see the moving letters, while individual paused frames appear to contain only random dots.

Is Ghost Font a real font?

Not in the conventional sense. It is not simply a TTF or OTF typeface that can be installed and typed into a document. It is a browser-based animation generator that renders text as motion.

Why does the text disappear when the video is paused?

The letters are defined by the directions in which groups of dots move. A still frame removes that motion information, leaving dots with similar visual properties across the entire image.

Why can humans read Ghost Font?

Humans naturally group elements that move together, a perceptual principle called common fate. The visual system also detects contours and regions defined by relative motion.

Why does AI fail to read it?

Many video AI systems sample a limited number of frames and rely heavily on image-oriented spatial features. Ghost Font contains little useful spatial evidence within any individual frame, so the system must explicitly calculate and integrate motion over time.

Can ChatGPT, Gemini or Claude read Ghost Font?

Performance can vary by model, interface, video format and prompting. Some general-purpose systems may fail through their normal video pipeline. A system equipped with dense frame extraction or optical-flow analysis may recover the message.

Is Ghost Font secure?

No. It is not encryption. Anyone who obtains the video can theoretically analyze its motion and reconstruct the text.

Can Ghost Font be used as CAPTCHA?

It could be tested as a temporary, risk-triggered CAPTCHA challenge, but it should not be the sole security control. It requires server-side generation, replay protection, rate limiting, accessible alternatives and testing against specialized motion-analysis attacks.

What is AI time blindness?

AI time blindness refers to the difficulty some video models have when information exists primarily in temporal changes rather than recognizable individual frames. The SpookyBench research demonstrated this by placing words and objects inside sequences of noise-like frames.

Will AI eventually learn to read Ghost Font?

Almost certainly. The motion information is mathematically recoverable, and research already shows that preprocessing video with optical-flow information can substantially improve model performance on similar stimuli.

Hiding writing in plain sight

Ghost Font hides writing in plain sight—not by making the letters more distorted, but by removing them from the static image entirely.

The human eye sees groups of particles moving together and reconstructs a word. Many current AI systems see a series of noisy frames and fail to connect them into the same motion-defined form.

That gap is real, measurable and potentially useful. It could inspire temporal CAPTCHAs that frustrate screenshot-based bots and introduce more varied human-verification challenges.

But it is not permanent protection. Ghost Font is not encryption, and specialized computer-vision software can analyze its movement. Its strongest future use would be as one randomized, accessible and replaceable component within a layered anti-abuse system.

The broader lesson is the lasting one: AI can recognize what is inside an image without necessarily understanding what emerges across time.

References and Further Reading

1. Ghost Font — official Mixfont experiment by Eric Lu. Describes the project, its local browser implementation, moving-dot construction, decoys and security limitations. (Mixfont)
2. Time Blindness: Why Video-Language Models Can’t See What Humans Can? CVPR 2026 paper introducing SpookyBench. (CVF Open Access)
3. M-LLM Based Video Frame Selection for Efficient Video Understanding. CVPR 2025 research explaining frame-sampling constraints in video-language systems. (CVF Open Access)
4. Are CAPTCHAs Still Bot-hard? USENIX Security 2025 research on generalized visual CAPTCHA solving. (USENIX)
5. W3C CAPTCHA accessibility guidance. Recommends equivalent challenges using different modalities. (W3C)
6. Cloudflare Turnstile documentation. Explains modern puzzle-less and risk-adaptive verification. (Cloudflare Docs)
7. Human research on motion and form processing. Reviews how common motion helps the visual system group features and identify contours. (PMC)
8. ZXX anti-OCR typeface. An earlier static typography experiment designed to provoke discussion about OCR and surveillance. (WIRED)