ode of Practice voluntarily, and neither document asserts that any obligation is satisfied. Both are versioned in swiss-ai/apertus-legal; the legal spreadsheet of Section 3.1.1 is versioned in swiss-ai/apertus-data-transparency.
7.2 Limitations
Factual Reliability. The models hallucinate on short-form factual questions at the rate of their predecessors: on PreciseWiki they attempt an answer on more than eight of 10 questions and hallucinate on roughly six to seven of them, slightly more than Apertus 1.0 at 70B scale (Table 39). The gains of this release lie in recognizing questions about things that do not exist and in long-form precision, not in factoid recall.
Over-Refusal. The alignment stages make the models cautious, and prompts that merely resemble harmful ones are often declined; the effect is visible across the post-training lineage (Section 5.3.2) and in manual testing. On the hard subset of OR-Bench, refusal rates rise sharply through the alignment stages (Section 5.9.2); because a share of its prompts is legitimately refusable, this shows the trend but not an absolute over-refusal rate. Reducing the caution without weakening the safety behavior remains open.
Language Coverage. Multilinguality is the models’ strongest relative position, but not uniformly so. XNLI regresses against Apertus 1.0 at both scales (Table 29), and the instruction-following and reasoning data concentrate on a few dozen languages, so quality in the long tail of the pretraining languages is not evaluated.
Multimodal Scope. The models understand images and audio but do not generate them. The 70B trails the 8B on several multimodal benchmarks because its run stops before consuming the full multimodal mixture and its inherited learning rate leaves it less room to adapt (Section 3.4). The audio training data skews toward parliamentary and political speech (Section 3.1), and for image and audio data we rely on the curation and filtering of the dataset creators (Section 3.1.1).
Grounding. Preference alignment improves most multimodal capability groups, among them spatial reasoning, medical and document understanding, and visual math, but systematically degrades referring-expression grounding, by about 17 points across the RefCOCO family. The diagnosis is precise: the output format remains valid and the model still locates the object, but the predicted boxes drift systematically looser, a regression in extent calibration. We accept this trade-off for the release; we note grounding-aware rewards in alignment for future iterations.
Identity. The post-trained models sometimes misstate their identity, claiming to be created by other providers, particularly in lower-resource languages; Apertus 1.0 did not show this behavior. We check the post-training data carefully: it conveys no other provider’s identity. This points at subtler inheritance: a model can adopt a teacher’s identity from distillation data with all identity markers removed (Zhong, 2026), and behavioral traits transmit through hidden signals in data more generally (Cloud et al., 2026), so model-generated content in the web corpus and the openly released reasoning traces in our mixture remain plausible carriers. Instilling a robust self-identity despite such data is an open problem.
Tool Calling and Thinking. Tool calling and thinking do not combine in the released models. The chat template supports tool calls inside the reasoning span (Figure 8), but the supervised mixture contains no conversation that both reasons and calls a tool, and we exclude tool-use prompts from the reinforcement-learning run (Section 4.5). The models behave accordingly: with thinking enabled and the reasoning span forced, they produce no tool calls; with thinking enabled but not forced, they tend to skip the reasoning span and answer as in non-thinking mode. At launch the serving stacks additionally mis-parse tool calls emitted under thinking, dropping the call terminator. Inference providers therefore expose the two f