The Rendering Gap: Where Should Moderation Look?

Software agents increasingly ship images as code. A chart is a matplotlib script, a poster is an SVG, and such artifacts can travel through storage, mail filters, and moderation without ever existing as pixels. Yet the harm of this content often lives only in the rendered image: instructions fragmented into one glyph per element leave no harmful substring in the source, and symbols drawn from pure geometry carry no text at all. We show that where a moderation filter sits relative to rendering decides whether it sees such harm at all. On a preregistered benchmark of 770 stimuli spanning four code carriers and a five-level obfuscation gradient, every locally deployable guard we test, including the industry-standard LlamaGuard-3, detects at most 2.7% of the semantically invisible content on the code path (four of six guards exactly zero) while flagging nearly all of the same content shown as plain text. The failure is placement, not capability. Frontier API models can read obfuscated code, but the endpoints in front of them, input filters and quota limits, can block up to 69% of the calls that would carry it, so the problem moves one step upstream. The threat is cheap to realize: a thirty-word “rendering service” system role persuades three of four model families to write harmful payloads verbatim into SVG. Turning the diagnosis into a defense, Rasterize–Transcribe–Judge (RTJ) routes the artifact through rendering, asks a vision model to transcribe what it sees, and lets the text-guard class judge the transcription. RTJ is the only single path we test that detects at least 60% on every text condition in the benchmark, including the adversarial layouts where classical OCR collapses to 10%, at a false-positive cost of 1 out of 25. We release the benchmark, the method, and a placement decision framework with measured costs.