Thinking Machines will pay $50,000 in its own credits to see if Inkling breaks under fine-tuning

Tinker trains LoRA adapters rather than updating every parameter, which is how the platform shares computing capacity across jobs ^[13]. That detail sets the boundary of what a grant-funded tamper-resistance study can actually measure: cheap adapter training, on hosted infrastructure, with scheduled check-ins from the host ^[9]. The threat described in the same announcement is wider. Anyone holding the weights can remove behavioral safeguards or train on hazardous material ^[6], using full fine-tuning, off-platform, with nobody metering it. Inkling activates 41 billion of its 975 billion parameters ^[4], about 4.2 percent ^[18], so it is cheap to serve and cheap to modify for the funded researcher and the unfunded one alike.

Then there is the denomination. Because the credit is measured at Tinker's current rates and locked to one approved proposal ^[8], the grantor sets how much compute the headline figure converts into, and can reset it. The engagement runs up to six months ^[9] while unused credit lives twelve ^[8], leaving a six-month tail ^[19] that can only be spent on a study already finished. The ceiling is also per participant, and neither the number of awards nor the total budget appears on the cited pages ^[12], so $50,000 describes one researcher's maximum and tells you nothing about the program's size.

Forty days separated the larger model's release from the grant call ^[16]. Applications run for 32 days ^[17], with review promised within a week of the September 25 deadline ^[10], and selected work continuing for as long as half a year ^[9]. The weights stay public through all of it. Thinking Machines' own open-weight safety framework says downloadable models widen access while creating irreversible misuse risks ^[14], which is a reasonable argument for having tamper-resistance results in hand before publishing weights rather than commissioning them afterwards.

What the topic list concedes is more interesting than the money. Putting tamper-resistant safeguards next to reward hacking, alignment failures and the measurement of how risk changes after fine-tuning ^[5] locates the unsolved problem in customization, not in how the model behaves the day it ships. Murati's stated position is that a small number of labs should not permanently fix one system's behavior for everyone, and that organizations should keep reshaping models with their own knowledge ^[21]; Tinker is the commercial form of that argument, handing researchers control of data, loss functions and training loops while the lab runs the infrastructure ^[13]. The open question is whether safeguards can be made to survive the modification the product exists to sell. Paying in access to that same modification infrastructure ^[7] is efficient on both sides of the ledger: the lab settles in capacity it already operates, and it buys precisely the evidence a customization-first vendor will need to show.

Selection weighs relevance, feasibility, construct validity and generalizability ^[11], which reads like a lab that wants small, repeatable results it can cite. Construct validity is the one to watch. A study that only stresses adapters on Tinker has measured the resistance of a safeguard to the polite attack.