Yesterday Perplexity put the code that decides whether your private data leaves your laptop on Hugging Face under an MIT license. The model is roughly 600 million parameters, small enough to run on a phone, and its entire job is to read one step of an AI agent’s task and answer a single question: does this touch something that should never reach the cloud? Its name is PII-Tracer, and it is the quiet center of a shift that matters more than the product it shipped inside.
The product is Hybrid Compute, which Perplexity released for its Mac app on September 1. The framing everyone repeated was “keep sensitive data local.” The framing worth your attention is different: for the first time in a mainstream agent product, the boundary between what you share and what you keep is not a promise in a contract. It is a routing decision made by a model you can now download and inspect.
What Perplexity actually shipped
Hybrid Compute splits a single Perplexity Computer task across two places. Frontier models in the cloud still handle web search, planning, and long-horizon reasoning. When a step in that task touches private files or sensitive data, Computer hands that step down to a local model on the Mac without restarting the task or losing context. The cloud keeps doing the heavy thinking; the private slice runs on your own silicon.
Three local models ship at launch: Gemma 4 E4B, Qwen3.6 35B-A3B, and a Perplexity-tuned variant, with the setup flow defaulting to a Perplexity Qwen build. The requirements are an Apple silicon Mac, macOS 15 or later, and at least 24GB of unified memory, with 32GB recommended. Setup is one click inside the desktop app, with no terminal and no API key. Aravind Srinivas described the use cases as investment teams cross-referencing deal documents against public filings, agencies comparing draft creative against web research, and lawyers researching case law while keeping privileged summaries local.
Two details make this more than a privacy checkbox. First, local processing consumes no cloud credits; you pay only for the frontier steps. Second, the routing is not a static rule. A classifier reads each step and picks one of four outcomes: keep it local, mask the sensitive spans, refuse the action, or ask you to decide. That classifier is PII-Tracer, and Perplexity open-sourced it.
The privacy boundary used to be a sentence in a contract
For two years the answer to “is my data safe with this AI vendor” has been a document. You negotiated a data processing agreement. You toggled zero-data-retention. You read a retention window and a deletion promise. Anthropic’s own enterprise posture is a fair example of how far that model can go: thirty-day logging that is mandatory on its best models, with misuse monitoring you cannot fully switch off. Every one of those controls is a promise about what a company will do with data you have already sent it.
Hybrid Compute moves the boundary earlier, to the point of the data never leaving at all. That is a categorically stronger guarantee than a retention clause, because a promise not to keep something still requires you to hand it over first. Running network operations at a large telecom, I spent years on exactly this distinction during vendor reviews. A supplier telling you they will delete your logs after ninety days is a control you have to audit, trust, and re-audit. A supplier that never receives the logs is not a control you have to police; it is a category of risk that does not exist. On-device inference collapses a whole column of your data-flow diagram, and with it a chunk of the questions a data protection impact assessment has to answer.
This is not unique to Perplexity. Apple’s 2026 SDK inverts the old default so the on-device model answers first and the cloud answers only when the local one cannot, evaluated against device class, latency budget, privacy requirement, and acceptable error rate before anything becomes a cloud call. One local-AI vendor’s read of the market is that enterprise inference has swung hard toward on-premise and on-device over the last three years. Treat that specific figure as a vendor estimate, but the direction is real and visible across the field. What Perplexity added is the part nobody else has exposed: the thing that decides.
The gatekeeper is now a model you can audit
PII-Tracer is a roughly 600-million-parameter bidirectional Qwen3 encoder with two heads, one that tags tokens across 37 labels spanning 9 categories of sensitive data (people, account numbers, private URLs, dates, addresses, emails, phone numbers, secrets, and a catch-all), and one that scores whole-conversation sensitivity. It is released under MIT, with vLLM and MLX builds for local inference.
The performance claim is the interesting part. On Perplexity’s own PII-TRACE benchmark, 13,148 synthetic conversations across 13 languages and 37,431 identifier mentions, the 0.6B model posts a 0.629 character-level F1 and beats both GPT-5.6 Sol and Claude Sonnet 5 at the task. On the measure that matters most for an agent that reuses an identifier across a long task, catching every mention of a recurring identifier, PII-Tracer hits 79.4% against Sol’s 57.0%, and 77.6% versus 55.1% on identifiers that span conversation turns. A frontier model is worse at reliably spotting the sixth appearance of an account number than a purpose-built model a hundredth its size.
Open-sourcing that classifier is the real news, and it is easy to underrate. A privacy gate you cannot see is a marketing claim. A privacy gate published as open weights is an artifact you can read, test on your own documents, and, critically, run outside Perplexity’s product entirely. If you are building your own agent pipeline and want a local filter that decides what escalates to a cloud model, you can pull PII-Tracer and wire it in. The definition of “sensitive” stops being Perplexity’s private judgment and becomes something you can inspect and tune. That is the difference between trusting a vendor’s routing and owning it.
What still leaves your machine
The honest version of this story has limits, and they are the part a practitioner has to hold onto.
The cloud still sees a lot. Hybrid Compute keeps flagged data local, but planning, search, and reasoning run in the cloud, which means the shape of your task, your query, the framing of the problem, and anything the classifier does not flag all still leave the machine. The privacy floor is exactly as high as the classifier’s recall, and that recall is not 100%. A 0.629 character F1 is best-in-class and still means real misses. Worse for enterprise work specifically, single-window recall drops to 0.687 on conversations at or above 10,000 characters because the model reads a 4,096-token window; sliding-window decoding at inference recovers much of that, but the long documents that make hybrid compute attractive are the same ones that stress its gate. The model card is blunt that there are no inference providers currently deployed for the open weights and that loading it takes custom code. This is a research-grade artifact you operationalize, not a finished appliance.
Then there is the hardware gate. Twenty-four gigabytes of unified memory on Apple silicon rules out a large share of any real corporate fleet, and it ties the strongest version of the feature to one vendor’s laptops. Treat the local classifier the way you would treat any input-facing filter on an agent that can act, which is to say as one layer, not the whole defense. The same posture that applies to prompt injection in agentic browsers applies here: a probabilistic gate reduces risk, it does not certify compliance.
Where it fits, and where self-hosting still wins
For mixed work, the kind where a genuinely useful cloud agent keeps colliding with a document you are not allowed to upload, Hybrid Compute is a real advance and worth piloting on the Apple silicon machines you already have. Turn on the Enterprise controls, which add admin-set masking rules and audit logging, and treat the local-versus-cloud split as a policy you configure and review, not a default you trust. Log what routed where. Before you rely on the gate, run PII-Tracer against a sample of your own sensitive documents and measure its recall on your data, not Perplexity’s benchmark; the discipline of testing on your own workload rather than a leaderboard is the entire point.
For regulated data where any leakage is unacceptable, hybrid is the wrong tool, and no amount of clever routing changes that. If a single missed identifier reaching a cloud model is a reportable event, the correct architecture is still the one where the model never touches the internet, which is a fully self-hosted stack on your own hardware. Hybrid compute narrows the exposure; it does not eliminate it.
What Perplexity got right is subtle and durable. It reframed a privacy question that vendors have answered with paperwork as an engineering question with an inspectable answer. The billing follows the same logic, since local steps cost nothing, so for once your cost incentive and your privacy incentive point the same direction. The part to watch is not the Mac app. It is the 0.6B model now sitting on Hugging Face, because a privacy boundary you can download, audit, and run yourself is a different kind of promise than one written into a contract you have to enforce.