Janus pro — agentic threat model
Janus Pro is an open-source multimodal foundation model with low inherent agentic risk, but it possesses high opacity and non-determinism typical of deep learning models, requiring external guardrails when deployed.
OWASP AIVSS score rationale
| Autonomy of Action | 0.10 | |
| Goal-Driven Planning | 0.10 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.00 | |
| Persistent Memory | 0.00 | |
| Contextual Awareness | 0.20 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.70 | |
| Opacity & Reflexivity | 0.80 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
As an open-source multimodal model, Janus Pro is highly susceptible to L1 threats including adversarial prompt injection, jailbreaking for restricted image generation, and model reprogramming. Its open weights also make it vulnerable to offline model stealing, fine-tuning poisoning, and backdoor insertion by malicious actors.
Not certain from the listing — The training data pipeline, dataset provenance, and potential RAG integrations for Janus Pro are not detailed, leaving risks of training data poisoning or copyright/lineage gaps unaddressed.
Not certain from the listing — Janus Pro is a foundation model rather than an orchestrated agent framework; any tool calling, memory management, or planning capabilities depend entirely on the external framework in which it is embedded.
Not certain from the listing — Deployment and infrastructure security are the sole responsibility of the entity hosting the open-source model, with no built-in sandboxing or secure hosting configurations specified.
Not certain from the listing — There are no built-in guardrails, evaluation suites, or observability tools specified in the directory listing to monitor for model drift or malicious inputs/outputs.
Not certain from the listing — Compliance controls, identity management, and usage policies are not defined in the open-source model listing and must be implemented by the downstream deployer.
Not certain from the listing — There is no native multi-agent ecosystem or marketplace integration described for this model, limiting direct ecosystem-level threats unless integrated into external multi-agent systems.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).
These scores are auto-generated from public information (the agent's own listing, docs, and repository) using the canonical OWASP AIVSS formula and the MAESTRO framework — an estimate for guidance, not a penetration test, audit, or certification. See the scoring methodology. Are you the vendor? Factual corrections are free.