Distilled Models, Capability Manifolds, and the Procurement Question Healthcare Buyers Are About to Get Wrong

What the disclosure said and how to read it A frontier AI vendor disclosed in late February that three competing AI labs, operating from a single jurisdiction outside the United States, had run an estimated sixteen million automated conversations through the vendor's API, distributed across roughly twenty-four thousand fraudulent accounts, to extract reasoning, agentic tool-use, and code-generation capabilities into their own models. One lab targeted reasoning across roughly one hundred fifty thousand exchanges, generating chain-of-thought training data. Another ran 13 million-plus exchanges focused on agentic coding and tool orchestration. A third ran 3.4 million exchanges across hundreds of fraudulent accounts. The infrastructure included "hydra cluster" account architectures that mixed extraction traffic with unrelated customer requests; one of the labs reportedly pivoted within twenty-four hours when the source vendor shipped a new model mid-campaign, redirecting nearly half its traffic to the new model. The framing in the broader press has been geopolitical, a "cold war" of AI capabilities. That framing is convenient. It is also the wrong frame for a regulated mid-market buyer trying to figure out whether DeepSeek, Moonshot's Kimi, MiniMax, or any of the open-weight models that follow them belong in a HIPAA-defensible AI deployment. The economic frame is more useful. The cost of generating frontier capability is asymmetrically higher than the cost of copying it; the pressure to copy applies to every non-frontier lab, not just to labs in any particular jurisdiction. Distilled models are a feature of the economic landscape, not a transient incident. For a regulated buyer the question is not whether distilled models will exist in 2026 procurement decks. They will. The question is where they belong in the architecture, and where the BAA chain actually terminates. Capability manifolds and what breaks where The clearest technical frame on distilled models is the capability manifold. A frontier model trained from scratch occupies a wide manifold, a broad surface of competence across reasoning, code generation, tool use, sustained agentic loops, multi-modal inputs, and the long tail of tasks that fall outside the central training distribution. A distilled model, trained predominantly or partially on outputs extracted from the frontier, occupies a narrower manifold. It reproduces the specific behaviors targeted during distillation, scores well on benchmarks that overlap with that distribution, and falls off steeply outside it. The model is brilliant in the center of its training distribution and fragile at the edges. The brittleness gap shows up where it matters most for agentic workloads. The third-party reports we have seen and our own testing on healthcare-adjacent tasks confirm the same pattern. On narrow, well-defined tasks, classification, summarization with templated structure, code completion on common patterns, distilled models can be ninety percent as good at fifteen percent of the cost. On sustained autonomous workloads, a multi-hour agentic loop with novel tool combinations, an off-distribution clinical-documentation task, an unusual billing-code reconciliation, a long-context care-coordination thread, the same distilled model can be forty percent as effective. The vertical gap on narrow tasks is small. On wide tasks the vertical gap is a chasm. The two-axis frame is the procurement-side translation. The horizontal axis is task scope, narrow to wide. The vertical axis is model provenance, frontier-trained to distilled. On narrow tasks the vertical gap barely matters; the cost case for the distilled model can be strong. On wide tasks, and the agentic workloads regulated buyers are increasingly being sold on, the vertical gap is the architecture-deciding factor. Procurement screens that compare distilled to frontier on benchmark scores alone systematically under-weight the failure mode the buyer will actually encounter in production. The BAA chain question that nobody is asking The capability question is the half of the procurement decision that gets debated in the architecture review. The other half, the half that gets discovered later, and more painfully, is the BAA chain. A regulated mid-market healthcare buyer cannot deploy a model into a PHI workflow without a Business Associate Agreement that covers the model and the surrounding infrastructure. The hosted frontier vendors have spent the last eighteen months building enterprise tiers with BAA-eligible postures: Anthropic's enterprise BAA, OpenAI's ZDR addendum on top of the enterprise BAA, AWS Bedrock's BAA scope across model and orchestration, Azure AI Foundry's coverage across models and the agent surface. The distilled models from the three labs named in the disclosure do not, today, have HIPAA-eligible direct API paths. The path that exists for a regulated buyer is a self-hosted or VPC-isolated deployment of the open-weight artifact, where the BAA-relevant surface is the cloud provider hosting the inference, not the lab that trained the weights. That changes the procurement screen materially. The procurement question for a hosted frontier model is "is the BAA executed, on which tier, with which addenda, covering which surfaces." The procurement question for a distilled or open-weight model is "where will the inference run, who is the BAA counterparty for that environment, and is the operational rigor on our side sufficient to satisfy the controls the BAA does not explicitly cover." Architecture C, on-premises or VPC-isolated, is where most distilled-model deployments belong for regulated buyers. The four-architecture frame in the HIPAA AI Architecture Field Guide names the trade-off: the BAA boundary is where the model runs, not who trained the weights. The operational cost, managing inference SLAs, model lifecycle, security patching of the hosting environment, audit-log surface, sits with the buyer. The hidden risk we audit most often: a buyer attracted by distilled-model economics deploys on a hosted inference platform that the buyer's procurement team did not realize was a separate BAA-chain link. The cost case fell apart the moment the orchestration layer's BAA scope did not extend to the inference platform. The deployment shipped. The audit found the gap. The remediation cost exceeded the original cost case by a factor of three. The off-manifold probe (the test we run) Benchmark numbers are not the right test for a regulated workload. Benchmarks measure central-distribution performance. The audit will not be triggered by a central-distribution case; it will be triggered by an edge case the model was never tested on. The off-manifold probe is the diagnostic we run during Adopt-AI-Safely engagements when a distilled model is in the procurement deck. The structure is simple. Take a real, non-benchmark task in the buyer's actual workflow. Run it on the candidate distilled model and the frontier baseline. When both succeed on the central case, change one constraint, a single variable, not the whole task. A different patient population, a different documentation template, an unusual reimbursement scenario, an off-pattern clinical-decision query. Watch whether each model adapts coherently or regenerates from scratch and force-fits the prior solution into a context where it does not fit. The model that adapts coherently is operating inside its manifold. The model that force-fits the old solution is at the edge. The off-manifold probe tells the buyer more than any leaderboard. For a regulated workload the manifold edge is where the audit happens. What we recommend For a regulated mid-market buyer the practical procurement posture for distilled models in 2026 has three components. One: scope the use case before scoping the model. Distilled models are excellent value for narrow, well-defined tasks where the manifold edge is far from the workload, classification of a known set of categories, summarization with a templated structure, code completion on common patterns. They are systematically the wrong choice for sustained agentic workloads, which is exactly the category most AI vendors are now selling. Two: place the model in Architecture C if the BAA path requires it. A distilled or open-weight model with no hosted BAA path belongs in a VPC-isolated or on-premises deployment with the cloud provider as the BAA counterparty. The four-architecture frame holds. The operational cost is real and worth pricing into the procurement decision. Three: run the off-manifold probe before the architecture review. A regulated buyer who picks a distilled model on benchmark performance is a buyer who learns about the manifold edge from a production failure. The probe is short, structured, and produces an artifact the procurement file can carry. The vendor matrix on the Securem AI Watch hub tracks BAA tier, training-data exclusion, audit-log access, and best-fit architecture for each model class on a rolling basis. The procurement question is not which model is cheaper. It is where the model belongs on the architecture given the BAA chain it can actually support, and whether the workload sits inside the manifold or at the edge.