Perplexity Releases Hybrid Compute on Mac: Cloud Agents Orchestrate Down to a Local Model, Gated On Device

Perplexity has pushed a new Mac feature that treats privacy as part of the workflow, not an afterthought. A task starts in the cloud, where frontier models do the searching, planning, and long-range reasoning. Then, if the task runs into private files or sensitive data, it gets handed to a local model on the Mac and stitched back together without losing context.

That matters because the useful context in these assistants is often the stuff people cannot or should not upload in the first place: deal documents, client records, privileged files. Perplexity’s answer is hybrid compute, and the company says the boundary is enforced by an on-device privacy gate. It has also open-sourced the classifier behind that gate.

The setup is limited but not obscure. It is live for Pro, Max, and Enterprise subscribers on Apple silicon Macs running macOS 15 or later, with at least 24GB of unified memory. Perplexity recommends 32GB. The local model installs from the Mac app in one click, without Ollama, without a separate runtime, and without an API key. Local work does not burn cloud credits.

The orchestration runs in the opposite direction from the local compute mode Perplexity shipped on NVIDIA DGX Spark a week earlier. There, the task starts on the user’s hardware and only escalates to cloud models with permission. Here, the cloud starts first, then hands sensitive steps down to the machine at the desk. Because Computer also works with iPhone, a task can be triggered remotely while the private part executes on the Mac. Perplexity even frames an always-on Mac mini as a dedicated local inference node for that setup.

The gate itself is doing the heavy lifting. Before anything from a protected file reaches the cloud, an on-device classifier checks it and decides whether to keep it local, mask the sensitive parts, refuse the action, or ask for consent. Credentials, payment card numbers, and government IDs get the tightest handling. Masked values are replaced before the cloud sees them, then restored when the answer comes back.

Perplexity’s research write-up around the gate is unusually specific. PII-Tracer is a 0.6B bidirectional encoder adapted from a Qwen3 backbone, trained over three epochs on roughly 714,000 samples. The benchmark it accompanies, PII-TRACE, includes 13,148 synthetic conversations across 13 languages and 10 writing systems. On that benchmark, PII-Tracer leads 12 detectors on character F1 at 0.629, and it is much better at finding repeated identifiers across turns than the rest. The hard part is not spotting one mention. It is catching every copy of it.

Perplexity says the long-context problem is real: single-window recall falls from 0.975 on conversations under 1,000 characters to 0.687 at 10,000 characters or more. Its fix is not retraining the model but changing the decoding. With 50%-overlap sliding windows, overall character recall rises to 0.965 and multi-mention consistent detection to 0.954 on the same checkpoint. For teams in legal, healthcare, and finance, that is the bit that turns this from a neat demo into something people might actually trust.