Researchers Find Macs Build an Undocumented Personal Knowledge Graph, Scoring Contacts Daily

What happened

Security researchers Dario Pasquini and Michał Bazyli of Eighth Rank published an analysis on Oct 28 saying macOS builds a personal knowledge graph on-device through two system daemons, knowledgeconstructiond and intelligenceplatformd; the analysis reached the Hacker News front page on Nov 7.

According to the researchers, the graph draws on Contacts, Calendar, Photos (faces and co-appearances), Messages, Mail, location, Screen Time, Family Sharing and the Health Medical ID emergency contact, and lives in 51 SQLite databases under ~/Library/IntelligencePlatform; the main store, graph.db, is a triple store with 181 entity classes and 278 predicates.

At the core are two CoreML classifiers, EntityTagging_Family and EntityTagging_FamilyAndFriends, which score contacts daily from 144 mostly behavioral features to decide who counts as family, a partner, a parent or a coworker; only 20 of the 144 are identity signals such as a shared surname, address or iCloud Family flag. The researchers also released iKnow, a local dashboard for inspecting one's own graph.

Key facts

1. Scope: Built into every Mac since macOS 13 (2022); the researchers verified it on macOS 26.6.2
2. Storage: ~/Library/IntelligencePlatform, 51 SQLite databases, stored in plaintext and protected by macOS Full Disk Access
3. Scoring: Two XGBoost classifiers, recomputed daily; 20 of the 144 features are identity signals, the rest behavioral
4. Deletion gaps: Deleted contacts move to an expired_stable_graph table and remain readable; on one Mac the researchers found people deleted the day before were still being scored
5. Apple's documentation: Only a one-line man page for knowledgeconstructiond and a 2023 paper on knowledge-graph techniques; Apple has not responded to the findings
6. Permission context: Apple told developers on Oct 2 that Full Disk Access "largely sidesteps" its privacy controls and that it will tighten the permission because of AI agents
7. Data flow: The graph is designed to stay on-device and is not uploaded to Apple's servers; Apple says Siri Suggestions personalization syncs with end-to-end encryption, but has not said whether graph.db is part of that sync