Perplexity just shipped something that actually solves a real problem: how do you let an AI assistant work with sensitive documents without sending those documents to a cloud server? The answer, live this week for Pro, Max, and Enterprise subscribers on Apple silicon Macs, is hybrid compute. Tasks start in the cloud where frontier models handle the heavy lifting—web search, planning, reasoning. But when the workflow touches a private file, the task hands that step down to a compact local model running on the user’s Mac. No restart, no lost context. The cloud and local halves merge into a single result.
The load-bearing piece is the privacy gate. Before anything from a protected file crosses the boundary, an on-device classifier called PII-Tracer inspects it and applies one of four outcomes: keep it local, mask the sensitive spans, refuse the action, or ask the user. Credentials, payment card numbers, and government IDs get the strictest treatment. Masked values get swapped for stand-ins on the way out and restored when the cloud answer comes back. PII-Tracer is a 0.6B bidirectional encoder built on a Qwen3 backbone, trained on roughly 714,000 samples, and Perplexity open-sourced the whole thing.
The benchmark numbers are worth a second look. Across 12 detectors, PII-Tracer posted the highest character F1 at 0.629. But the consistency metric is where it separates itself: 79.4% of recurring identifiers had every mention found, versus 57.0% for GPT-5.6-sol. In the hardest bucket—six to ten mentions of the same identifier—it scored 0.691 against 0.464 for GPT-5.6-sol and a dismal 0.045 for Claude Opus 4.8. Finding most PII is not the same as finding every copy of it, and that distinction is what gets legal and healthcare teams sued.
There’s a catch with long conversations. Single-window recall drops from 0.975 on conversations under 1,000 characters to 0.687 at 10,000 or more. Perplexity’s fix wasn’t retraining—it was sliding-window decoding with 50% overlap, which lifts character recall to 0.965 on the same checkpoint. That’s a pragmatic engineering call, and it suggests the bottleneck was context truncation, not model capacity. The Enterprise controls—org-wide rules, audit logs for what leaves a machine—are what make this deployable in regulated environments rather than just interesting. This inverts the local-first approach Perplexity showed on NVIDIA DGX Spark a week ago, which started on-device and escalated to cloud with permission. Same orchestrator, opposite default. The question now is whether users trust a classifier to make privacy decisions on their behalf, or whether the consent prompts become so frequent that people just click through them.
