t majority refusing generation, and those providing it adding disclaimers or not allowing a reasonable association with a real person. We observe a quasi-universal rejection of the nonexistent lawsuit assumption, except for the low-resource language tested. While this behavior can be improved in the future, the model offers an improvement compared to other commonly used open-weight models, resulting in a decision to not block the candidates’ release.
Appendix N Coverage of Common AI Security Framework Risks
Table N.1: NIST AI RMF 600.1 and MLCommons Hazards Taxonomy v1.0 risks evaluated for Apertus 1.5. Bold items indicate benchmark names. Color coding: fully evaluated, partially evaluated, not evaluated, not applicable.
NIST AI RMF 600.1
MLCommons Hazards v1.0
Apertus 1.5 Pre-Release Evaluation
CBRNE Information and Capabilities
CBRNE
Evaluated: Manually evaluated for usefulness in principle, given offline use potential, and then for the risk increase compared to a shallow web search output, in reference to
CBRNE scenarios in a multi-turn and iterative multi-conversation setting, including abliterated release candidates. Early access for evaluation provided to Spiez Lab of the Federal Office for Civil Protection.
Dangerous, Violent, or Hateful Content
Hate
Evaluated: using the standardized
RealToxicityPrompts, ToxiGen, and PolyglotToxicityPrompts benchmarks.
Harmful Bias and Homogenization
Evaluated: using the standardized
BBQ and ToxiGen benchmarks.
Obscene, Degrading, and/or Abusive Content
Child Sexual Exploitation
Evaluated: No image generation supported; main concern is Child Sexual Abuse enablement. We apply the LLM under-alignment benchmark of Wuhrmann et al. (2026), derived from cases reported in the Swiss Supreme Court rulings, as part of the manual evaluation.
Sex-Related Crimes
Partially evaluated: Same evaluation as above. While the dataset of Wuhrmann et al. (2026) covers general sex-related crimes, it has fewer test cases.
Violent Crimes
Evaluated: Same evaluation as above. Additional overlap for armed violence with manual dual-use capabilities evaluation; partially probed by HarmBench.
Confabulation / Hallucinations
Defamation
Evaluated: HalluLens benchmark, combined with manual probing for private person biography hallucination, and wrongful confirmation of harmful statements about such persons.
Information Integrity
Specialized Advice
Partially evaluated: We manually test dangerous health misinformation reported as recited by widely used LLMs. HarmBench partially tests for unqualified advice. We do not specifically test financial, legal, and electoral advice.
Information Security
Nonviolent Crimes, Specialized Advice
Evaluated: Orange Cyberdefense Switzerland and the Swiss Cyber-Defence Campus performed an offensive cyber-capabilities evaluation. The security team judges none of the reported findings to increase risk.
Information Integrity
–
Evaluated: Manual testing for suitability for information operations, dangerous health misinformation previously reported in other LLMs, and politically motivated disinformation.
Human-AI Configuration
–
Not completed: INTIMA benchmark integration not completed in time.
Value Chain and Component Integration
–
Evaluated: Apertus development relies exclusively on openly available components. Data collection and preprocessing are described in this report. Code artifacts documented.
–
Suicide and Self-Harm
Partially evaluated: Partially probed by HarmBench; we cannot guarantee the construct validity of the manual tests and hence do not report them.
–
Nonviolent Crimes
Partially evaluated: Indirectly probed by HarmBench test cases; however, given the multilinguality and international use scope of Apertus, evaluation is minimal due to jurisdictional differences.
Data Privacy
Privacy
Mitigated by Design: PII filtering and masking on pretraining and post-training data and Goldfish training loss (Section 3.1.1 & Section 3.2).
Intellectual Property
Intellectual Property
Mitigated b