The Perplexity company introduced PIITracer on September 1, 2020, a compact 0.6B parameters model that flags PII in a device’s text before sending it to cloud models. The announcement Both releases can be framed as privacy infrastructure to the company. hybrid compute architectureCloud agents are responsible for research, planning, reasoning and decisions, while local models work with files.
A local privacy gateway keeps sensitive data on the Mac and redacts private information that is detected. Or, it can request permission before sending content to the cloud. Perplexity stated that the privacy boundary is only effective if the device recognizes PII (personally identifiable information) before sending text to a remote model. Additionally, detection can be difficult in multilingual, long conversations when the same identifier occurs multiple times. The information that the system protects can be exposed if a mention is missed.
PII Tracer provides a local control signal to model routing, by identifying spans that are predicted to have PII. This application enforces a routing policy by keeping the input relevant local or redacting detected spans.
Benchmark PII/TRACE
PIITRACE (Tracing Recurring PII Across conversational exchanges) contains 13148 synthesized user-assistant dialogues in 10 languages and 13 writing systems. It also includes 37,431 identifiers that are labeled on a character-level for nine PIIs. In total, 41% contain structured content. 63.8% of the 5 645 conversations that contain PII are labeled with an identifier which appears multiple times. 28.7% have an identifier appearing on more than one turn.
Perplexity says it developed the benchmark around 3 behaviors which are important when a detector screens conversations with assistants. When an identifier occurs multiple times, or when it crosses between the user and assistant’s turns, a detector must find each mention. Second, the detector must be able to handle long conversations with conversation lengths ranging between 1,000 and 100,000 characters. Third, handling mixed formats and multiple languages is important, as a conversation can switch between languages, and include prose, code or tables.
The benchmark is a measure of performance in two dimensions. A consistent detection score is calculated at the identifier-level. This asks if the detector has covered all characters in each mention of the identifier. The scores are reported separately for multiple mentions, and for repeating identifiers. The character-level precision and recall scores are calculated by measuring how much text is marked PII. F1 then balances these two.
The dataset was created from conversations in production, but is synthetic. The company claims that multiple language models mark nine different types of PII during production conversations. A rule-based pass then groups identifiers with the same type together under one entity ID. The placeholders are kept intact and each value marked is then replaced with a placeholder typed in. Synthetic values that match each identifier type and format will be inserted. Three automated gates ensure that replaced spans match stored values, repeated mentions of the same value and marked source values remain absent after a Presidio rescan and regular-expression scan. The second language audits a small sample and then humans check anything flagged as PII.
Compact detector for local use
It is an encoder with a Qwen3-like backbone. Privacy screening is different from text generation, as it involves finding and returning relevant PII boundaries. The model replaced Qwen3’s causal mask by padding-aware, bidirectional attention.
Each token is encoded as a 1 024-dimensional representation. An auxiliary head determines whether the conversation contains sensitive material, such as health or religious information. A head that predicts sensitive information, like health and religious data, is used to determine if the conversation has been recorded. It said that it had trained the model on approximately 714,000 examples of training data, combining both multilingual conversations and records with single record samples. A constrained Viterbi encoder looks for the best-scoring label sequence at inference time and maps it back to the exact character ranges required for local routing or redaction.
Results of Evaluation
According to Perplexity, PII Tracer had the highest F1 character (0.629), along with second-highest F1 span-overlap and F1 span-containment amongst the 12 systems tested. The company reported that frontier models GPT 5.6-sol, Claude Sonnet, and GPT 5.6-sol achieved comparable performance. GPT 5.6-sol scored higher for both span metrics but lower in character F1. These frontier models, which are cloud-based closed-source models, have many billions and trillions of variables, rendering them ineffective for text screening that needs to remain locally.
The evaluation set has 899 unique identifiers and 959 others that are repeated, with 790 of these spanning several turns. Perplexity reports that PII Tracer finds all recurring identifiers (79.4%) and cross-turn identifiers (77.6%), while GPT 5.6-sol reaches 57.0% et 55.1% for the two same measures. The PII Tracer score goes from 0.917 when identifying a single mention to 0.691 when identifiers appear six to 10 times.
It is still a restriction to limit the length of a conversation. For conversations under 1,000 characters the single window recall rate is 0.975, and from 1,000 up to 10,000 it drops to 0.6887. Decoding with sliding windows that overlap by 50% increases overall character recognition from 0.830 up to 0.965, and the detection of multiple mentions from 0.794 up to 0.954 without any retraining.
The company said that PII Tracer outperformed the OpenAI Privacy Filter on five external single-record benchmarks. This included 0.950 versus 0.907 for ai4privacy, 0.847 versus 0.709 for Nemotron-PII, and 0.594 versus 0.350 for TAB, which is the only benchmark in the group built from real, human-labeled text. Perplexity stated that PII Tracer had a higher character F1 score than OpenAI Privacy on all five benchmarks. This included 0.950 versus 0.907 in ai4privacy and 0.847 versus 0.709 in Nemotron PII.
It is important to note that the word “you” means “you”. research paper The authors warn that these conversations are created synthetically from production assistant traffic. Results should not be interpreted as estimates of any production workload, but rather as measures of conversational PII. In addition, the paper notes that multimodal inputs, tool calls and inter-agent communications are outside of the scope of this benchmark. Each baseline was also evaluated using a single configuration for inference. Perplexity plans to release PII Trace and PIITracer in the near future. The paper says both products will be available under the MIT License.
