Apple's knowledge graph knows who your family is, and nobody typed it

On 7 November a post about a database sitting on your own laptop reached the top of Hacker News, at 841 points. Dario Pasquini and Michal Bazyli, who publish as the Bishop and the Knight at 8rank.ai, read what macOS writes into ~/Library/IntelligencePlatform. Their write-up, dated 28 October, is not a leak. It is a map of something that was never hidden, only undocumented: a queryable graph of who you are, whom you know, and how those people relate to each other. Apple's own researchers published the construction technique in 2023. The integration has no documentation at all.

Two daemons and one sentence

The daemons are called knowledgeconstructiond and intelligenceplatformd. The authors say they have been present since macOS 13, "allegedly", because they did not verify that history; the analysis was done on macOS 26.6.2, build 25G83.

The closest thing to official documentation they found is a single man page. man 8 knowledgeconstructiond calls the binary "a daemon that analyzes content on the device to build a general purpose knowledge graph." That is all of it. An operating system component that models your household gets one sentence, and it is a category label.

The store is plaintext: 51 SQLite databases inside a zone protected by TCC Full Disk Access. The protection is a permission, and users hand it to terminals, editors and backup tools routinely, without asking what else it opens.

A vocabulary built for edges

graph.db is a triple store written in 181 entity classes and 278 predicates. Each row is a subject, a predicate and an object, and each carries a confidence, its sources, a sourceDuplicates list and a timestamp.

The design shows in something as ordinary as an employer. That edge is not one row. It is two rows sharing a relationshipId: one names the relationship type, the other points at the organisation entity. The reification exists so a relationship can hold a confidence of its own and be retracted later without touching either endpoint.

Fifty-seven of the 181 classes describe an activity, so nearly a third of the vocabulary went on what you are doing rather than who or where you are. Not every class is filled: the authors flag which ones they could tie to a mechanism, and call that inference work rather than ground truth.

Almost nothing had to be collected

The inputs are the parts you would expect: Contacts; faces from Photos; Calendar titles and attendees; Family Sharing, including the age of every member; the Medical ID emergency contact in Health; events and contacts Siri Suggestions scrapes out of Mail and Messages; people donated by apps through App Intents; installed apps.

Beside the graph sit the tables that make it useful. Who appears with whom in your photographs. A communication log recording who, when, which app and which direction, with no content, also pulling from your other devices. Location and movement. A tail of device signals: screen locked, Wi-Fi, Bluetooth, charging, ambient light. And a stream named ContextualUnderstanding.PhysicalSocial, whose record format lists people by name, phone and email with a start and end time, which reads like a log of who was physically nearby. The authors never saw it filled in.

Then there is the inference, which is where the post earns its title. Nobody stored a sleep schedule. The communication timestamps produce one anyway: on the authors' own machine, an unbroken six-hour quiet run from 01:00 to 07:00 Europe/London holds 402 of 18.4K events, two percent of the log. One machine, one timezone, one year: an anecdote that shows the mechanism working.

The classifier was the giveaway

The cleanest evidence of intent is not the graph but the two CoreML models shipped beside the ontology, EntityTagging_Family.mlmodelc and EntityTagging_FamilyAndFriends.mlmodelc. Both are binary XGBoost classifiers reading 144 features and returning a class with a probability. Their output goes into a separate table, entityTagging.db, one row per person and seventeen relationship columns, recomputed daily.

The feature names are plain text in each model's metadata.json, and they are the most direct statement of purpose in the system. Twenty features cover identity, including sameLastName, sharesHomeAddress and iCloudFamilyMember. Forty cover communication, including personPopularityGivenNight. Eighty-four cover photographs, and one is named photosPersonPosteriorProbabilityGivenSaturdayNight.

That string is a shipped input to a shipped classifier whose job is deciding whether someone is family. Whatever the graph is meant to be in general, this part was built for a specific question.

Only two of the seventeen columns have a shipped model behind them; what fills the other fifteen, the authors say they could not trace.

Withdrawal is a move, not a delete

The live graph forgets. Delete a contact and nothing re-derives them; the next run replaces the table wholesale. But the store keeps a second table, expired_stable_graph, and a retracted row moves there with its confidence and provenance intact.

How long it stays is unclear. A prune watermark suggests roughly 48 hours, but the authors could still read very old records in it on their own Mac. Conclusions also outlive their evidence: their scorecard still scored two people the graph had dropped the day before, both known to it only from a calendar invitation.

Apple shipped macOS 27 on 14 September 2026, and after the upgrade to 27.0.1 the graph withdrew most of the rows built from Contacts, Calendar, Siri Suggestions, Family Sharing and the app catalog, then rebuilt them over the following day. That looks like an ontology change between releases, and it is the same operation run in bulk. The post's framing lands harder than any threat model: there is no documented control, and the nearest thing to one moves the row instead of removing it. Where Apple's on-device machinery went in that release is a separate story, one we covered when the foundation-model CLI shipped.

What the tool proves

The dashboard, iKnow, is a Python standard-library server with no dependencies, binding 127.0.0.1 and refusing to change that. Every database handle opens mode=ro; nothing is written or logged; each start prints a token the page and its endpoints require. It reads the live stores in place, and needs Full Disk Access for its terminal. A commit on 8 November added a reminder to switch it off afterwards, which is the correct instinct: the grant covers everything launched from that app, not just the viewer.

The repository carries its own disclaimer, which is the right frame: "iKnow is fully LLM-generated and may not be 100% accurate." That applies to the code and the copy, not the database, but it sets the bar. What you can verify is your own store, queried locally. What you take on trust is somebody else's reading of it. The daemons have been seen before, too: the post credits Nic Lydon's earlier dev.to write-up and Alexis Brignoni's iLEAPP work reading the same store on iOS under /private/var/mobile/Library/IntelligencePlatform. Digital forensics arrived first, which is the tell.

The half you cannot check

The threat section is explicitly a thought experiment. A "privacy single point of failure" in the wrong hands, combined with an abliterated model, is a scenario the authors describe and do not demonstrate. They also say it generalises to any personalised assistant rather than being an Apple-specific flaw.

What remains unverified is the interesting part. Whether Apple Intelligence retrieves from this graph, how much of it any given feature reads, and what the retention policy is for the expired table are questions the post cannot answer, which is why "allegedly" keeps appearing beside the retrieval claims. Apple published the technique in 2023 and nothing about the integration since.

The checkable half is substantial; the other is a gap. You can confirm that a Mac holds a reified, provenance-carrying graph about your household, weighted by a classifier with a feature called photosPersonPosteriorProbabilityGivenSaturdayNight. You cannot confirm what reads it. Running iKnow settles the first question in about ten minutes, with Full Disk Access granted temporarily. It settles nothing about the second.