acklist. All downloader traffic passes through the proxy, including requests generated by HTTP redirects, and destination hostnames are resolved before the resulting addresses are checked against the IP-based blacklists. Because HTTPS path information is not visible to the proxy without TLS interception, URL-level HTTPS indicators are conservatively promoted to host-level blocks. In the first production run, the resulting policy rejected fewer than 0.01% of candidate downloads, indicating that a very small fraction of destinations accounts for the relevant security risk.
Reinforcement Learning Infrastructure.
Reinforcement learning introduces a distinct infrastructure workload. This stage runs on our fork of verl with a fully asynchronous trainer. Enabling the rollout stack on the ARM-based Grace Hopper superchip (GH200) platform and the Alps interconnect requires upstream contributions across the inference engines, training framework, and attention kernels. At scale, two performance bottlenecks become dominant. The first is the distribution of updated model weights from the trainer to the inference workers, which we addressed by porting a high-performance transfer engine to the interconnect’s libfabric interface in close collaboration with CSCS engineering teams. The second is the loading of sharded checkpoints from the parallel filesystem, whose aggregate I/O becomes increasingly significant as the number of workers grows.
Reward environments are decoupled from the GPU compute nodes and run as CPU-only services on an on-premises Kubernetes cluster built on commodity hardware. The code sandbox executes its test harnesses within the Kubernetes pods, keeping this workload outside the GPU allocation and isolating it from the training infrastructure. End-to-end rollout throughput comes within approximately 5% of comparable open models executed on the same software stack. The remaining difference is attributed primarily to the implementation of the xIELU activation function.
7 Responsible Release and Governance
This chapter documents the release: the license and the gated distribution (Section 7.1), the known limitations of the models (Section 7.2), what the openness of weights, data, recipes, and values enables and what it risks (Section 7.3), and the external evaluation and community work around the release (Section 7.4). We describe practices and published documents and make no claim about their legal sufficiency.
7.1 License and Acceptable Use
We release model weights and training and evaluation code under the Apache 2.0 license. All training data is fully available: every dataset is public, and Section 3.1 and the legal spreadsheet identify each one in the version we use. Third-party data can be obtained from its original providers; we also publish the SFT mixture as a single dataset, with each component retaining its source license. Datasets we construct ourselves, such as the instruction-following prompt sets and preference pairs in Section 4, are published on Hugging Face under open licenses specified in the corresponding dataset cards. We maintain the license, acceptable-use policy, and privacy policy in swiss-ai/apertus-legal. The models are distributed on Hugging Face behind a gated download that records assent to the acceptable-use policy.
Transparency Documentation. We publish two documents prepared for the EU framework for general-purpose AI models: the Public Summary of Training Content, following the European Commission’s template, and a Code of Practice document covering transparency and copyright policy. We publish the Code of Practice voluntarily, and neither document asserts that any obligation is satisfied. Both are versioned in swiss-ai/apertus-legal; the legal spreadsheet of Section 3.1.1 is versioned in swiss-ai/apertus-data-transparency.
7.2 Limitations
Factual Reliability. The models hallucinate on short-form factual questions at the rate of their predecessors: on PreciseWiki they attempt an answer on mor