Researchers map Apple's undocumented on-device relationship graph in macOS

What happened

Macs running macOS 13 or later, a line that began in 2022, include two background daemons that assemble an on-device graph of a user's relationships, communications, movements and activities, Eighth Rank reported. The authors said the system draws on Photos, Messages, Mail, Contacts, Calendar, Screen Time and location data, and that Apple's only official description is a brief man page for knowledgeconstructiond.

According to the analysis, carried out on macOS 26.6.2, the data sits in fifty-one SQLite databases under ~/Library/IntelligencePlatform. The files are unencrypted but shielded by the Full Disk Access permission. The central file, graph.db, is a triple store with 181 entity classes and 278 predicates, and each entry carries a confidence score from 0 to 1. Two CoreML models built on XGBoost weigh 144 mostly behavioral features to estimate whether a person is family.

The authors said those scores go into a separate entityTagging.db table with seventeen relationship columns that are refreshed daily, though only two of the columns have a shipped model behind them. They also found that rows removed from the live graph move to a table named expired_stable_graph, where some lingered well beyond an apparent 48-hour window. The team released iKnow, an open-source local dashboard that lets users inspect their own graph.

Context

Apple researchers published a paper on the graph-building techniques in 2023, but the authors said little is public about which macOS versions run the system or what it collects and infers, including kinship scoring. Nic Lydon wrote about the same database a few months earlier. The authors said, while noting it is alleged, that LLMs retrieve from the store. They added that Apple's on-device model can read messages to label faces when Apple Intelligence is on.