rsions of the release candidates alongside the release candidates to confirm the absence of dangerous capabilities independently of the model alignment. For non-abliterated models, we evaluate their helpfulness through multi-turn, multi-conversation interactions with a malicious user faking benign interest.
In addition to the internal safety and security evaluation, we provide early access to the release candidates to independent third-party evaluators. Specifically, we provide access to Orange Cyberdefense Switzerland (previously SCRT) for offensive cybersecurity capabilities evaluation; to Cyber-Defence Campus, armasuisse S+T, DDPS (Federal Department of Defence, Civil Protection and Sport) for overall model risk evaluation; and to Spiez Lab, Federal Office for Civil Protection, DDPS, for CBRNE capabilities evaluation.
M.2 Chemical, Biological, Radiological, Nuclear, and Explosive Indiscriminate Weapons (CBRNE)
Threat Model.
A moderately sophisticated attacker seeks to fabricate such a weapon at home. We assume they are seeking to acquire fabrication knowledge for such weapons by prompting the model. This would notably exclude biological weapons fabrication, due to the need for specialized equipment and tools in order to produce and maintain such weapons, as well as nuclear weapons, given the difficulty of procuring the components, correctly assembling them, and packaging them for delivery. While such tests are important for frontier models, they are not a primary concern for a medium-sized open-weight model such as the Apertus family.
Results.
While the abliterated versions of the model provide realistic-looking recipes for CBRNE indiscriminate weapons in the test cases examined, due to the concept collapse, none of the recipes examined contain sufficient information for household assembly alone, and none provide any additional information beyond what is available on the web. We observe a variability in response across languages, including lower refusal in the low-resource language tested, but that does not affect the overall evaluation of release candidates as safe to release.
M.3 Dual Use and Insurgency
Threat Model.
Similar to CBRNE weapons, dual-use and specific military knowledge is generally considered inherently harmful in models available to the general public. Additionally, some of this knowledge might be useful for the preparation of terrorist attacks on civilians, making the existence of such knowledge within LLMs inherently problematic.
Results.
Neither the release candidates nor the abliterated versions of release candidates provide any useful dual-use information in the test cases analyzed.
M.4 LLM-Assisted Information Operations
Threat Model.
An attacker attempts to leverage an LLM for information operations in a low-resource language. Notably, they use in-depth prompting and real-world text examples to generate social media biographies of journalists or digital technology company workers, social media posts, or short articles, using few-shot learning prompts for target text types and in-depth person definition prompting in the original language, a popular and effective attack strategy (Gameiro et al., 2024; Kucharavy et al., 2025).
Results.
We are not able to produce texts undetectable to common online free LLM detectors across several mid-to-low-resource languages.
M.5 (Child) Sexual Abuse
Threat Model.
Distinct from CBRNE and dual-use concerns is the use of LLMs for sexual and intimate abuse assistance, notably against children. Based on the Lanzarote Convention (Council of Europe, 2007), as well as the definitions in Ghosh et al. (2025) and Autio et al. (2024), Wuhrmann et al. (2026) identified two clearly illegitimate uses of LLMs in that context, and demonstrated how LLMs’ usefulness in such uses could be evaluated beyond simple refusal, leveraging the Swiss Supreme Court decisions, which are publicly available and correspond to unequivocally and clearly illegal instances of abuse.
Results.
Apertus 1.5 