Perplexity Ships PII-Tracer, a 0.6B Guard Keeping Private Data off the Cloud

Perplexity just shipped hybrid compute for its Computer agent on Mac, and the interesting piece is the small model guarding the boundary between local and cloud. Perplexity Computer can now start a task in the cloud, with frontier models handling search, planning, and reasoning, then hand off individual steps to a local model on your Mac whenever private files or sensitive data enter the workflow. The gate that decides what stays on device is a new open-source 0.6B parameter detector called PII-Tracer, released alongside a benchmark called PII-TRACE.

The problem is familiar to anyone building agents against proprietary data: more personal context helps an agent understand the user and produce better results, but supplying that context usually means shipping private information to a remote service. Hybrid compute tries to have both by keeping context on the device until the moment it needs to leave.

How the split actually works

Perplexity's hybrid local-server inference orchestrator decides what work runs on device and what work goes to agents in the cloud. The model, agent harness, conversations, and execution trajectories all reside on the user's machine. Tasks that touch external resources are invoked only with user permission, so unapproved content stays put.

Sitting in front of that orchestrator is the privacy gate. PII-Tracer provides one local control signal for model routing by flagging spans predicted to contain PII. The application then enforces policy: keep the relevant input local, redact detected spans, or request explicit approval before escalating to a cloud model. When Computer reads a file like meeting notes containing a name, email, and phone number, it surfaces a prompt with three options: process it on your Mac, upload it anyway, or skip the step.

Why detection breaks on real conversations

Perplexity built a new detector rather than pulling one off the shelf because existing tools were trained on single records, not sprawling agent transcripts. Detectors designed to process one record at a time perform poorly on long, complex conversations, and existing benchmarks generally do not evaluate consistency across turns. If a name shows up eight times in a conversation and the detector catches seven, the eighth still leaks.

PII-TRACE, the benchmark, is built to expose exactly this failure mode. It contains 13,148 synthetic user-assistant conversations across 13 languages and 10 writing systems, with 37,431 identifier mentions labeled at the character level across nine PII types. Among the 5,645 conversations with labeled PII, 63.8% include an identifier that appears more than once, and 28.7% include an identifier that spans multiple turns. The dataset is generated by templating real production conversations, replacing every identifier with a synthetic value, and running automated and human validation to make sure no real PII survives.

Inside the 0.6B model

PII-Tracer deliberately breaks from the decoder-only pattern that dominates almost everything else shipping today. It is a 0.6B bidirectional encoder adapted from a Qwen3 backbone, replacing Qwen3's causal mask with padding-aware bidirectional attention so every token can draw on both earlier and later turns within a 4,096-token window.

On top of the encoder sits a tagging head using the BIOES scheme, standard in named entity recognition. A linear layer produces scores for 37 possible labels: one special label for text outside a span, plus four span-position labels for each of the nine PII types. B, I, and E mark the beginning, inside, and end of a multi-token span, while S marks a one-token span. A second head predicts whether the conversation contains sensitive material like health or religious information, acting as a context signal so the model judges spans in context rather than as isolated strings.

Training combined multilingual assistant conversations with single-record examples over three epochs on roughly 714,000 samples, weighted so rare PII labels do not get drowned out by the majority "outside" tokens. At inference, a constrained Viterbi decoder picks the highest-scoring valid BIOES sequence rather than tagging each token independently, which prevents invalid transitions like a person-tag opening a span and an email-tag closing it.

Results and where it falls down

Across 12 detectors evaluated on PII-TRACE, PII-Tracer took the top character-level F1 score at 0.629, beating frontier models like GPT-5.6-sol and Claude Sonnet 5 on that metric while landing second on span-overlap and span-containment F1. The larger frontier models edged it on span-level scores, but they carry hundreds of billions to trillions of parameters and run in the cloud, which defeats the purpose.

The more interesting result is consistency across recurring mentions. Across the full evaluation, PII-Tracer finds every mention of 79.4% of recurring identifiers and 77.6% of cross-turn identifiers; GPT-5.6-sol reaches 57.0% and 55.1% on the same two measures. As the number of repetitions climbs, the gap widens. In the six-to-ten mention bucket, PII-Tracer catches every instance 69.1% of the time versus 46.4% for GPT-5.6-sol and single digits for GLiNER2-PII and Claude Opus 4.8.

Very long conversations remain the weak spot. Single-window recall is 0.975 below 1,000 characters and 0.955 from 1,000 to 10,000, but drops to 0.687 for conversations at or above 10,000 characters. The 4,096-token window is the bottleneck. Perplexity fixes this at inference by running a 50%-overlap sliding window, which pushes overall character recall from 0.830 to 0.965 and multi-mention consistent detection from 0.794 to 0.954 without retraining.

On five external single-record benchmarks (ai4privacy, Nemotron-PII, SPY, Gretel PII, and TAB), PII-Tracer beats the OpenAI Privacy Filter on character F1 across the board, including doubling recall on TAB's human-labeled European Court of Human Rights text at essentially the same precision.

Getting it running

Hybrid compute is available today to Perplexity Pro, Max, and Enterprise subscribers in the Perplexity Mac app on macOS 15 or later. The setup path:

1. Install the latest Perplexity Mac app
2. Download the local model, PPLX Qwen 3.8 27B, in one click (no Ollama or manual runtime)
3. Open the model selector, pick Hybrid, and choose the cloud and local models for the task

Hardware requirements are Apple silicon with 24 GB unified memory as a minimum and 32 GB recommended. Work that runs on the local model uses no cloud credits and no API key. The PII detector is available on Hugging Face, and the full research writeup details the benchmark methodology and ablations.

The broader signal is that assistant vendors are starting to treat local inference as a first-class part of the agent stack rather than a fallback. For anyone building agents that touch regulated data, the operative question has shifted to which specific tokens are allowed to cross the network boundary, and who decides.