Uncovering Apple's Undocumented Personal Knowledge Graph on macOS Systems
Hidden system daemons build detailed behavioral profiles of users and their social connections.
1Hidden macOS Knowledge Graph
Since macOS 13, Apple devices have silently operated two background daemons, knowledgeconstructiond and intelligenceplatformd. These processes function to build a comprehensive personal knowledge graph about the user. They track identity, social connections, communication patterns, location history, and behavioral signals, creating a detailed digital map of the user's daily life.
2Data Sources and Integration
The system constructs this graph by cross-referencing data across various native applications. Sources include Contacts, Calendar, Photos, Messages, Mail, and Screen Time. By analyzing this diverse information, the daemons infer relationships and activities. This data is reportedly used as a queryable store for Large Language Models running on the device.
3Limited Official Documentation
Official information regarding this mechanism remains extremely scarce. The man page for knowledgeconstructiond provides only a brief, vague description of its function. While Apple researchers published a paper on graph construction techniques in 2023, there is no public documentation detailing which macOS versions utilize these specific features or data.
4Technical Storage Architecture
The gathered information is stored within the ~/Library/IntelligencePlatform directory. This location contains fifty-one SQLite databases, which are stored in plaintext format. Although these files are protected by TCC Full Disk Access, they represent a centralized repository of highly sensitive personal information that is actively maintained by the operating system.
5Graph Database Structure
The primary file, graph.db, functions as a triple store utilizing 181 entity classes and 278 predicates. Each entry consists of a subject, predicate, and object. This structure allows the system to define complex relationships between people, applications, and events, assigning confidence scores and timestamps to every single recorded edge.
6Discovery and Security Research
Security researchers identified this system while analyzing the Apple Intelligence bundle in macOS 26 during August 2026. Independent researchers like Nic Lydon previously noted the existence of this database. The lack of transparency regarding how these daemons operate has prompted calls for better user visibility into these internal processes.
7New User Dashboard Tool
To address the lack of transparency, researchers have released an open-source tool called iKnow. This dashboard allows macOS users to inspect the contents of their own personal knowledge graph. It provides a way to visualize the entities and predicates that the system has inferred about the user and their contacts.
8Privacy Implications Analyzed
The existence of this centralized knowledge base creates a potential privacy single point of failure. If unauthorized parties gained access to these databases, they could reconstruct a user's entire social and behavioral history. Researchers warn that combining this data with LLM capabilities could lead to sophisticated, personalized threats against the user.
9Inference of Kinship
Beyond simple contact logging, the system performs complex kinship inference. It analyzes how individuals are related to the user and to each other based on communication frequency and shared events. This goes beyond standard address book entries, actively mapping the social structure surrounding the user without explicit user configuration.
10System Resource Management
The two daemons work in tandem to process heavy analytical tasks. While knowledgeconstructiond handles the initial analysis of device content, intelligenceplatformd assists in the actual generation of the graph. This division of labor ensures that the graph remains updated as new data is generated through daily device usage patterns.
11Data Integrity and Metadata
Every edge within the graph is accompanied by specific metadata, including source identifiers and confidence levels. This ensures the system can track where information originated and how certain it is about a specific relationship or event. This granular tracking is essential for the LLM to retrieve accurate, context-aware information.
12Future Security Considerations
As Apple continues to integrate more AI-driven features, the role of this knowledge graph will likely expand. Users should remain aware that their devices are constantly building these internal profiles. Future research will focus on how these systems can be hardened against exploitation while maintaining the intended user experience.