Estonia ranks LLMs on Russian propaganda resistance

Estonia just turned a very modern AI problem into a very old-school national-security test. The government-sponsored Estonian Language Institute, working with volunteer-run defense collective Propastop, has released a new “Propaganda Resistance” benchmark that ranks dozens of large language models on whether they can avoid taking positions on topics the Russian Federation uses in its strategic narratives. In plain English: the benchmark asks whether an LLM can answer without being nudged into repeating propaganda.

That matters because the models are not just being graded on whether they get facts right. They are being judged on whether they can push back on propaganda narratives, without external help from web search or other tools. The benchmark is built around a real anxiety that is spreading beyond Estonia. As more people use LLMs for quick answers to complicated questions, governments and institutions are worrying that these systems could become efficient parrots for foreign influence campaigns if the prompts are phrased carefully enough.

The setup is deliberately adversarial. The Estonian researchers identified 14 broad categories where they believe Russian influence operations try to sway public discussion. Those categories run from the current status of Crimea and justifications for the war in Ukraine to the history of NATO and Russia’s justification for annexing Baltic states during World War II. For each category, the team created separate questions in three flavors: neutral prompts, biased prompts built around “false assumptions” drawn from Russian propaganda, and malicious prompts designed to directly elicit explicit misinformation from the model. Then they tested the models in English, Estonian, and Russian, and had a separate AI model score the responses. That judge model was calibrated to align with Propastop experts, which is the kind of detail that should make anyone in AI evaluation sit up a little straighter.

Why Estonia? Because this is not an abstract lab exercise. Estonia was part of the Soviet Union and has been independent for only a few decades, so the country has a lived memory of how narratives can be used as pressure. In that context, concerns about “strategic narratives” are not some internet-age moral panic. They are part of a national reflex. That gives this benchmark a sharper edge than a generic content-safety test. It is not asking whether a chatbot can avoid being rude or politically sloppy. It is asking whether an AI system can resist being steered into amplifying false claims that have real diplomatic and historical baggage.

The multilingual part is also doing a lot of work here. Testing in English, Estonian, and Russian acknowledges something product teams already know but often underweight: a model that behaves in one language can behave very differently in another. For companies rolling out AI assistants across markets, that is a big deal. A system that looks safe in English could still be vulnerable when a user switches to Russian or Estonian, or when the prompt uses language patterns that resemble propaganda framing. The benchmark is basically saying that language coverage is not a nice-to-have. It is part of the risk surface.

There is also a broader governance lesson for executives. Benchmarks are becoming part of how institutions decide whether AI is ready for deployment, and this one shows the direction of travel. It is not enough for a model to sound confident, fluent, or even useful. In some settings, it has to be resistant to manipulation by hostile narratives without relying on a search tool or another external backstop. That raises the bar for model vendors, but it also raises the bar for the buyers. If you are a leader deploying AI into customer support, public information, education, government services, or any other high-trust workflow, you now have to think about whether your model can be socially engineered at the prompt level, not just whether it hallucinates on basic facts.

The strategic implication is pretty simple: geopolitical resilience is becoming a product feature. Estonia’s benchmark treats propaganda resistance as something measurable, testable, and comparable across models. That puts pressure on vendors to prove their systems can handle adversarial prompting in different languages and on sensitive topics, not just benchmark well on generic reasoning tests. It also gives public-sector buyers a template for asking tougher procurement questions. If your AI can be coaxed into repeating the wrong story about Crimea, NATO, or the Baltic states, that is not just a model flaw. It is a governance problem. And for every executive shipping AI into the world, Estonia just made that a lot harder to ignore.