Security researchers at Eighth Rank have detailed how Apple’s Personal Knowledge Graph on macOS compiles extensive personal data on-device, in an analysis published on its site. AppleInsider has also covered the findings.
The system runs a daemon called knowledgeconstructiond that analyses device content and builds a knowledge graph stored in the Library/IntelligencePlatform directory. That directory contains 51 SQLite databases in plaintext, protected only by TCC Full Disk Access. The main graph.db database uses 181 entity classes and 278 predicates. Entity types include person, group of humans, organism, person in the arts, sports organisation and political party. Predicates cover what kind of thing an entity is, its genre, religion, topics a person is interested in, and face cluster for a person.
Each relationship row carries a confidence score between 0 and 1. The system infers family relationships using 144 behavioural features and analysis of photos. It can determine household composition, ages, daycare attended, associated phone numbers and location patterns. Deleted data does not disappear immediately; it is moved to an expired_stable_graph table and pruned after 48 hours.
The knowledge graph has been present in macOS since version 13, launched in 2022. Apple Intelligence with Siri personal context relies on data compiled by this graph.