A web font whose digits draw other digits
A font the page embeds and applies to text maps a digit to a glyph that cannot be that digit, so a reader sees different numbers from the ones the page stores.
How the text is hidden
The embedded font's cmap points each character at a glyph outline. Point the code for 5 at the outline that draws 0 and the page text still reads $50,000 while the screen reads $500,000. Nothing is hidden and nothing is added; the divergence lives entirely inside the font, which is the mechanism the EMNLP 2025 paper *Invisible Prompts, Visible Threats* describes for web pages and PDFs alike.
Why a model still reads it
The text is ordinary Unicode and extracts perfectly; that is the attack rather than an accident of it. The human reads one number and every machine downstream reads another — the same divergence as pdf.cmap-divergence and ooxml.embedded-font-remap, arriving through a stylesheet.
What we do about it
The same three signals the Office check reads from a font's own tables, pointed at a @font-face the page embeds as a data: URL and applies to text: a 0 or 8 drawn with fewer than two contours cannot be that digit; two digits never legitimately share a glyph id; and a drawn digit is rasterised and compared against a consensus of what each digit looks like across 81 text faces. Any signal fires the rule at high with action flag, family B, and the finding carries a divergence pair where one can be named. Blank digits are blank, not remapped — they are html.blank-font's finding.
How often it fires
0% of a broad crawl of 399 real web pages — pages, not documents, measured 2026-09-25.
This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.
Seen in the wild
A font whose character-to-glyph table is edited so the code for one letter draws another — loaded by a web page through @font-face or embedded in a PDF — shows a reader one text while a model reads a different one; six models relayed the hidden content from PDFs 63–70% of the time and from web pages 20–47%.
Check your own file
Three commands: a key, credit, a verdict.
Start with the API