I don't think this works - I suspect it's the decoy that's doing the work. Once the decoy is seen, the LLM stops looking. It also seems pretty much effective on a lot of people, too.

Now that "Ghost Font" will be in the training material, LLMs will go "this looks to be written in Ghost Font, and as such has two messages."