Perplexity Hybrid Compute: Local Model Meets Cloud Agents

Perplexity Hybrid Compute: Cloud Agents Delegate Down to a Local Mac Model

Agentic assistants have a structural problem that no amount of prompt engineering fixes: the context that makes them useful — deal documents, privileged files, client records — is exactly the context you cannot legally or safely ship to a cloud endpoint. Last week Perplexity shipped its local-first answer for NVIDIA DGX Spark (Portable Computer). This week it flipped the direction of travel on Mac with Hybrid Compute: one task, split between frontier models in the cloud and a compact model on your Mac, with an on-device privacy gate deciding what may cross the boundary. And unusually, the classifier behind that gate is open-source.

What Hybrid Compute Actually Does

The direction of orchestration is the load-bearing design decision. Computer starts every task in the cloud, where frontier models handle web search, planning, and long-horizon reasoning. When a step touches private files or sensitive data, Computer hands that step down to the local model on your Mac — without restarting the task or losing context — then merges both halves into one result you never have to reconcile.

This inverts the local-compute mode Perplexity shipped on the DGX Spark a week earlier, which starts on your hardware and escalates up to cloud models with permission. Same orchestrator, opposite default. The DGX Spark version assumes you own the compute and want to protect upstream; the Mac version assumes the cloud does the heavy lifting but wants to protect downstream.

# Conceptual flow of Hybrid Compute's cloud-first orchestrator
from perplexity_computer import Task, LocalNode, CloudProxy

task = Task("Summarize the MSA, redact confidential figures, then draft a reply")

# Starts in the cloud: search + plan + long-horizon reasoning
plan = task.plan_with("frontier-model")

# A step touches a protected file -> handed DOWN to the local Mac model
with LocalNode(model="pplx-qwen-3.8-27b") as local:
    local.inspect(plan.files["msa.pdf"])

# The on-device gate classifies each span before anything leaves
gate = local.gate()
decision = gate.evaluate(
    content=plan.files["msa.pdf"],
    policy={"credentials": "mask", "gov_ids": "ask"},
)
# decision: "local" | "mask" | "refuse" | "ask"

# Only after the gate passes does the cloud ever see restorable stand-ins
merged = CloudProxy().merge(local.redacted(plan), restored=gate.restore())

Because Computer also works on iPhone, a task can be triggered remotely while the sensitive steps execute on the Mac sitting on your desk. Perplexity explicitly positions an always-on Mac mini as a dedicated local inference node for exactly this pattern — a home "data center" that never lets client records touch a third-party API.

The Privacy Gate Is the Load-Bearing Component

Before anything from a protected file reaches the cloud, an on-device classifier inspects it and applies one of four decisions:

• Keep local — the step never leaves the machine
• Mask — sensitive spans are swapped for stand-ins on the way out
• Refuse — the action is blocked outright
• Ask — the user consents before it proceeds

Credentials, payment card numbers, and government IDs get the strictest handling. Masked values are swapped for stand-ins on the way out and restored server-side when the cloud answer comes back, so a partially-masked negotiation draft still reads coherently.

PII-Tracer: the 0.6B Model Under the Hood

The gate's engine is PII-Tracer, a 0.6B bidirectional encoder adapted from a Qwen3 backbone. It replaces the causal mask with padding-aware bidirectional attention over a 4,096-token window. A linear tagging head emits 37 labels — one outside-span label plus BIOES position labels for each of nine PII types — and an auxiliary head predicts whether a conversation contains sensitive material at all. Training ran three epochs on roughly 714,000 samples, and a constrained Viterbi decoder resolves the label sequence at inference.

The accompanying benchmark, PII-TRACE, contains 13,148 synthetic conversations across 13 languages and 10 writing systems, with 37,431 character-level identifier mentions. Its central claim is subtle and worth internalising: finding most PII in a long conversation is not the same as finding every copy of it. A single missed recurrence of a card number is still a leak.

On results, PII-Tracer leads 12 detectors on character F1 (0.629) and lands second on span-overlap and span-containment F1, behind GPT-5.6-sol. On consistency it leads by a wide margin — it found every mention for 79.4% of recurring identifiers and 77.6% of cross-turn identifiers, versus 57.0% and 55.1% for GPT-5.6-sol. In the hardest bucket (6–10 mentions) it scores 0.691 against 0.464 for GPT-5.6-sol, 0.073 for GLiNER2-PII, and 0.045 for Claude Opus 4.8.

The Long-Context Trap and the Decoding Fix

The interesting engineering detail is that single-window recall drops from 0.975 on conversations under 1,000 characters to just 0.687 at 10,000 characters or more. Perplexity's fix is decoding, not retraining: 50%-overlap sliding windows lift overall character recall from 0.830 to 0.965 and multi-mention consistent detection from 0.794 to 0.954 on the same checkpoint. That is a cheap, pragmatic win any team building PII detection should steal.

Models, Controls, and Availability

The announcement lists three local models at launch: Gemma 4 E4B, Qwen3.6 35B-A3B, and a Perplexity model post-trained for Computer. The product page's setup flow points to a one-click download of PPLX Qwen 3.8 27B, and Perplexity's Hugging Face org carries matching pplx-computer-qwen-3-8-27b builds alongside pplx-pii-masking-vllm, the 0.6B model behind the gate. The local model installs in one click from the Mac app — no Ollama, no separate runtime, no API key — and local work consumes no cloud credits.

Hybrid Compute is live for Pro, Max, and Enterprise subscribers on any Apple silicon Mac running macOS 15 or later with at least 24GB of unified memory (32GB recommended).

For Enterprise, admins set org-wide rules for what must stay on device, what may be masked, and what requires explicit approval — plus audit logs for when information leaves a machine. That is the piece that makes this genuinely usable for legal, healthcare, and financial teams rather than just technically interesting.

What This Means for Devs Building Agentic Systems

The pattern Perplexity is converging on — a cloud orchestrator that can momentarily and transparently descend to a local model behind a privacy gate — is one of the more sensible answers yet to the "I can't send this to the API" problem. If you are building vertical agents for regulated industries, stealing two ideas from this release is worth it: a classifier that finds every occurrence, not just some, and an explicit four-way gate (local / mask / refuse / ask) rather than a binary "send / don't send." Combined with an always-on local node for the sensitive steps, that is close to a production-ready privacy architecture — no matter which vendor ships the frontier model.

Key Takeaways

• Hybrid Compute starts tasks in the cloud and hands sensitive steps down to a local Mac model, mid-task, without losing context.
• An on-device PII classifier gates the boundary: local, mask, refuse, or ask.
• PII-Tracer (0.6B) leads 12 detectors on character F1 (0.629) and on finding every recurring mention (79.4%).
• Long-context recall drops to 0.687 past 10K characters; sliding-window decoding recovers it to 0.965.
• Runs on Apple silicon, macOS 15+, 24GB unified memory, for Pro, Max, and Enterprise.

For more of the current local-agent wave on this blog, see our coverage of Perplexity Portable Computer on DGX Spark. Read the Perplexity announcement and the PII-TRACE research post for the full detail.

Sources

• Perplexity: Introducing Hybrid Compute on Mac
• Perplexity: PII-TRACE: Detecting personal data before it leaves the device