Perplexity's tiny 0.6B model catches leaks before they leave your Mac

PII-Tracer is an open-source 0.6B privacy detection model from Perplexity, released alongside a dedicated multi-turn conversation benchmark called PII-TRACE. It is designed to act as an on-device privacy gate for hybrid AI setups, catching and redacting sensitive data before it gets routed to cloud models.

Both the model weights and the benchmark dataset are available on Hugging Face.

What it does

In hybrid architectures, small local models handle private files on your machine while giant frontier models in the cloud do the heavy planning and search. That split only works if the local layer knows exactly what counts as personally identifiable information (PII).

Conversations with AI assistants are rarely single-shot. Identifiers like names, addresses, or account numbers repeat across turns. If a detector misses just one occurrence, the sensitive data leaks out anyway.

PII-Tracer evaluates multi-turn context across 13 languages and 10 writing systems, detecting 9 PII types down to the exact character level. It handles prose mixed with code, tables, and structured data without falling apart as the conversation grows.

How it works under the hood

Instead of deploying an oversized generative model, Perplexity adapted a Qwen3 backbone into a 0.6B bidirectional encoder. Because PII screening needs boundary tagging rather than text generation, they swapped out the causal mask for padding-aware bidirectional attention over a 4,096-token window.

Each token produces a 1,024-dimensional vector feeding into a 37-class BIOES tagging head. An auxiliary classification head also predicts whether the dialogue touches sensitive domains like healthcare or religion, providing global context that cuts down false positives.

During inference, a constrained Viterbi decoder ensures that predicted span tags follow valid transition structures before mapping tokens back to character offsets.

Benchmark results

On the new PII-TRACE benchmark, PII-Tracer was evaluated against 12 detection systems. It scored a 0.629 character F1, the highest across the board, beating every open-source rival and staying competitive with massive cloud models.

Its biggest edge lies in recurring mentions. When an identifier appeared 6 to 10 times in a conversation, PII-Tracer kept a consistency score of 0.691. By comparison, GPT-5.6-sol fell to 0.464, while GLiNER2-PII and Claude Opus 4.8 collapsed to 0.073 and 0.045 respectively.

Why it matters

If you are building local agent pipelines or hybrid routing layers, PII-Tracer is an ideal tool to test right now. At 0.6B parameters, it runs locally on standard consumer hardware with negligible compute overhead, solving a headache that usually required complex regexes or costly cloud screening calls.

We think this is a smart strategic move for Perplexity. Hybrid agent architectures cannot succeed without trustworthy on-device filtering, and open-sourcing the detector sets an open standard for client-side privacy gates. Just keep in mind that while a 0.629 F1 leads the category, automated filters are never foolproof, and high-stakes enterprise deployments will still want policy-level fallbacks.