A local filter tracks private data from one message to the next

PII-Tracer detects personal data locally before it is sent to the cloud, while PII-TRACE measures whether each recurrence is caught across a conversation.

A name appears at the beginning of a conversation. A phone number is provided several messages later. The same email address returns when a reservation is confirmed. Protecting this information requires more than recognizing it once: every recurrence must be caught before the conversation is transferred to a cloud service.

PII-Tracer is a 600-million-parameter model developed by the Perplexity Secure Intelligence Institute. It is paired with PII-TRACE, a benchmark designed to evaluate the detection of personally identifiable information in long, multilingual, multi-turn conversations.

The two names refer to different components. PII-TRACE is the evaluation dataset and protocol. PII-Tracer is the compact detection model intended to run locally on a user’s device.

This work is tied to Perplexity Computer’s Hybrid Compute architecture on Mac. Under this approach, tasks involving private information can remain on the device, while operations requiring additional resources or external services can be sent to the cloud.

That separation only works if the local system identifies sensitive information before anything leaves the machine. An application can then keep the request local, redact the relevant portions, or ask the user for permission before transmitting it.

PII-Tracer does not make that routing decision itself. It identifies spans that may contain private information, while the application determines what to do with them. A missed detection can expose data, while an incorrect detection can unnecessarily block or alter a legitimate request.

Context makes this task more difficult than simply recognizing the structure of an email address or phone number. A name such as “Maria Torres” could refer to the user, a public figure, a fictional character, or an example included in a document.

The model must therefore identify information according to its role in the conversation. It must also recognize when the same identifier returns in a different form or in a later exchange.

Many existing privacy benchmarks evaluate isolated sentences or standalone documents. PII-TRACE preserves conversational order and links repeated mentions of the same information across multiple turns.

The dataset contains 13,148 synthetic conversations in 13 languages and 10 writing systems. It includes 37,431 labeled mentions across nine categories: private names, dates, URLs and IP addresses, physical addresses, account and identity numbers, email addresses, phone numbers, secrets, and other personally identifiable information.

Of those conversations, 5,645 contain PII and 7,503 contain none. The PII-free portion is important because it measures how often a detector flags harmless content.

About 41% of the conversations combine ordinary text with structured elements such as source code or tables. Among conversations containing PII, 63.8% repeat at least one identifier, and 28.7% repeat it across separate turns.

The dataset was derived from the structure of deduplicated production assistant traffic rather than released as a verbatim copy. Personal information was replaced before publication.

Several models were used to label categories and group recurring identifiers. The process then introduced placeholders, paraphrased passages, and inserted fictitious values intended to preserve the conversational structure without retaining the original personal information.

Automated checks were used to identify malformed or inconsistent examples. Questionable documents were regenerated or removed, followed by a second assisted review and an examination by the research team.

This process makes it possible to reproduce certain conversational patterns without publishing source PII. However, synthetic rewriting can introduce its own biases and may not fully represent the ambiguity, spelling errors, or irregular structures found in real conversations.

The paper also documents a known residual issue: some personal names remained untagged in several non-English examples. Their presence is disclosed as a limitation rather than treated as part of the intended benchmark.

PII-Tracer uses a Qwen3 foundation converted into a bidirectional encoder. Unlike an autoregressive model that primarily predicts the next token, this architecture can examine the surrounding window and classify each token using both the preceding and following context.

The model supports a window of up to 4,096 tokens. Longer conversations must be divided into overlapping segments. Each token is represented through a 1,024-dimensional hidden state before being assigned one of 37 possible labels.

These labels follow the BIOES format, which indicates whether a token appears at the beginning, inside, end, or as the sole element of an identified span. An additional label marks tokens that fall outside any PII category.

A separate classification head estimates whether the conversation contains sensitive attributes such as health information, religion, origin, sexual orientation, political views, disability, age, or gender. These attributes are distinct from the nine direct identifier categories.

The model was trained for three epochs on approximately 714,000 examples, including data from ai4privacy. Its training objective combines token-level span detection with conversation-level sensitivity classification.

A constrained decoder prevents incoherent label sequences and maps the detected spans back to precise character positions. Those positions can then be used for masking, redaction, or local routing.

The researchers compared PII-Tracer with 11 other systems, including Microsoft Presidio, OpenAI’s Privacy Filter, GLiNER2-PII, Piiranha, two OpenMed models, GPT-5.4, GPT-5.6 Sol, Claude Opus 4.8, and Claude Sonnet 5 in zero-shot configurations.

PII-Tracer obtained the highest character-level F1 score, at 0.629, with precision of 0.507 and recall of 0.830. The recall figure shows that it catches a large share of labeled information, while the lower precision indicates that many detections are still