Perplexity launches hybrid compute for Mac with on-device privacy gate

Perplexity released Hybrid Compute for the Mac edition this week, an architecture that splits a single Perplexity Computer task between cloud-front models and a compact model running on the user’s Mac, with an on-device privacy gate deciding what crosses the boundary. The release also open-sourced the classifier that powers the gate.

The central architectural decision is the scheduler. The Computer starts every task in the cloud, where front-end models handle web search, planning and long-term inference. When a step involves private files or sensitive data, the system drops that step to the local model on the Mac without reinitialising the task or losing context, then merges the two halves into a single result. This reverses the local-compute mode Perplexity introduced a week earlier on NVIDIA DGX Spark, which starts on user hardware and scales to the cloud with approval. The same scheduler, with the default reversed, allows a task to run remotely while sensitive stages execute on a continuously-on Mac mini positioned as a dedicated local inference node for this pattern.

Before any protected content reaches the cloud, a local classifier checks it and the gate triggers one of four outcomes: keep it local, mask the sensitive segments, reject the operation, or request user consent. Approvals, credit-card numbers and government identifiers receive the strictest handling. Masked values are replaced with stand-ins on the outbound path and restored when the cloud response returns. The classifier, named PII-Tracer, is a bidirectional encoder of 0.6 billion parameters built from the Qwen3 skeleton, replacing the causal mask with a padding-aware bidirectional attention mechanism on a 4,096-token window. A linear tagging head emits 37 labels, one outside-span label and BIOES location tags for each of nine PII types, while an auxiliary head predicts whether a conversation contains sensitive material. Training ran for three epochs on roughly 714,000 samples; a constrained Viterbi decoder resolves the label sequence at inference time.

The accompanying benchmark, PII-TRACE, contains 13,148 synthetic conversations in 13 languages and 10 scripts, with 37,431 character-level mentions. The headline claim is that locating most PII in a long conversation differs from finding every copy of it. Across 12 detectors, PII-Tracer achieved the highest character-level F1 of 0.629 and the second-best span-overlap and span-containment F1, after GPT-5.6-sol. In consistency, it leads by a wide margin, finding every mention for 79.4 % of recurring identifiers and 77.6 % of identifiers that cross conversation turns, versus 57.0 % and 55.1 % for GPT-5.6-sol. In the hardest bucket (6–10 mentions) it scores 0.691 against 0.464 for GPT-5.6-sol, 0.073 for GLiNER2-PII and 0.045 for Claude Opus 4.8.

Recall drops from 0.975 in conversations under 1,000 characters to 0.687 in those of 10,000 characters and above. Perplexity’s fix operates at decoding time, not via retraining: sliding windows with 50 % overlap raise overall character-level recall from 0.830 to 0.965 and multi-mention consistency from 0.794 to 0.954 on the same checkpoint.

Hybrid compute is available now to Pro, Max and Enterprise subscribers on any Mac with Apple silicon running macOS 15 or later, equipped with at least 24 GB unified memory (32 GB recommended). The local model installs with a single click from the app, without Ollama, a separate runtime or an API key, and local execution does not consume cloud credits. The PII-Tracer classifier is released as open source, allowing anyone to inspect, run or integrate it independently.