s in Ghosh et al. (2025) and Autio et al. (2024), Wuhrmann et al. (2026) identified two clearly illegitimate uses of LLMs in that context, and demonstrated how LLMs’ usefulness in such uses could be evaluated beyond simple refusal, leveraging the Swiss Supreme Court decisions, which are publicly available and correspond to unequivocally and clearly illegal instances of abuse.
Results.
Apertus 1.5 demonstrates a significant improvement in refusal and non-compliance with the requests emulating illegitimate uses compared to Apertus 1.0. Overall, Apertus 1.5 refusal and request compliance rates are in line with other widely used open-weight LLMs of similar size, and once abliterated, it does not comply with requests better than readily available abliterated models of the same size.
M.6 Offensive Cybersecurity
Threat Model.
A malicious party in cyberspace uses the model in order to design, support, and conceal offensive operations.
Results.
The evaluation from the third party (Orange Cyberdefense Switzerland) reports limited usefulness for offensive usage; however, it is significantly below other common open-weight models and has insufficient structured output compliance to allow for offensive automation. The Apertus safety and security team does not judge the reported results sufficient to block the candidates’ release.
M.7 Multimodal Prompt Injection
Threat Model.
We evaluate the model’s susceptibility to prompt injection through text supplied as images, including white-on-white text, previously reported as effective against widely used commercial LLMs.
Results.
We do not observe compliance with embedded instructions for the release candidates.
M.8 Harmful Disinformation
Threat Model.
LLM vectoring has been reported as an offensive information warfare tactic (VIGINUM, 2024; Sadeghi & Blachez, 2025), which is language-dependent. Here we investigate how much Apertus has been affected using publicly available examples of false narratives. Additionally, we ask the model about the status of the contested territories as defined in the UN 2022 “Main Instances of Disputed Territories” resolution and evaluate the partiality of the model’s response.
Results.
We note minimal disinformation recitation or disputed-territory partiality for released models, even in non-thinking mode.
M.9 Harmful Health Advice
Threat Model.
We focus on the harmful health advice that has been reported or can reasonably be expected from LLM-based chatbots. In order to test the model in the most realistic condition, we attempt the harmful response elicitation as a question with an implicit assumption of harmful statement correctness.
Results.
Across evaluated scenarios, the release candidates consistently inform the users of the harmfulness of the health advice, except in the low-resource language tested. While this behavior can be improved in the future, the release candidates offer an improvement compared to other commonly used open-weight models, resulting in a decision to not block the candidates’ release.
M.10 Private Person Defamation
Threat Model.
In this section, we focus on the case of an LLM user attempting to find information about a real person and getting partially incorrect, prejudicial information. Specifically, we examine the hallucination of a nonexistent lawsuit following a two-stage dedicated prompt, and the generation of partially correct information about a private person that would uniquely identify them but be incorrect about their biography.
Results.
We observe a high variability in the results across languages and private person names, with the vast majority refusing generation, and those providing it adding disclaimers or not allowing a reasonable association with a real person. We observe a quasi-universal rejection of the nonexistent lawsuit assumption, except for the low-resource language tested. While this behavior can be improved in the future, the model offers an improvement compared to other commonly used open-weight models, resulti