Your Mac has been keeping a file on your family

Your Mac has been keeping a file on your family Since macOS 13 shipped in 2022, every Mac has run two daemons whose only job is to build a graph about you. Who you are, who you know, how those people relate to you and to each other, how you communicate, where you go, what you do and when. The daemons are called knowledgeconstructiond and intelligenceplatformd, and the closest thing Apple has ever documented about them is a two-sentence man page. A security duo going by The Bishop and The Knight took the system apart in October and published the anatomy. The graph lives in ~/Library/IntelligencePlatform, fifty-one plaintext SQLite databases protected by macOS's Full Disk Access permission. The core one, graph.db, is a triple store: 181 entity classes, 278 predicates, and a confidence score on every row. What goes into it is basically everything the OS can see. Contacts. Photos, with faces. Calendar titles and attendees. Family Sharing, including the age of every member. The emergency contact in your Medical ID. Events and people Siri Suggestions digs out of your mail and messages. Apps donated through App Intents. Beside the graph sit tables for who appears with whom in your photos, a communication log without content, location and movement, and a stream of device signals: screen locked, Wi-Fi, Bluetooth, charging, ambient light. Then there is the part the HN headline picked up: a pair of XGBoost classifiers, shipped as CoreML models, that decide who counts as family. They read 144 features and output a probability for seventeen relationship columns per person, recomputed every day. Twenty of the features are identity: same last name, shared home address, an iCloud Family flag, age difference. Forty are communication patterns. Eighty-four come from photographs. One shipped feature name is worth reading twice: photosPersonPosteriorProbabilityGivenSaturdayNight. A real input to a real classifier, and its job is deciding whether someone is your sister. The scores look mundane until you look at what produced them. A mother scored 0.960, the ceiling of that column. Nobody typed it. The post counts nine independent signals that land on the same person: the partner column, a composite score, a household entity, the Family Sharing token, an iCloud flag, top twelve-month contact, a Photos face cluster, a Contacts record, a reachable handle. The model joined them and concluded "partner" for someone the owner had never labeled. The joins are where it stops being about you. From one store, the authors worked out that there is a child in the household and roughly how old, which daycare the child attends along with both phone numbers, where the family will be and between which hours on a given Thursday, and which password manager is installed. A relationship is intelligence one level above the rows it was inferred from. Deletion does not fully retract any of it. The live graph drops a contact, but a second table, expired_stable_graph, keeps the retracted rows with their confidence and sources, about forty-eight hours by the authors' measurement, longer on their own machines. The scorecard still scored two people a day after the graph had dropped them, people it knew only from a calendar invitation. The authors also run a thought experiment that applies to any personalized system: what happens when this file ends up in the wrong hands, paired with a local model that has had its guardrails stripped. They call the graph a privacy single point of failure, and they play the scenario out in a second post. To be fair to Apple: everything happens on device. The databases sit behind the Full Disk Access permission, so other apps cannot read them without the user approving it. Apple's researchers published a paper on the graph techniques back in 2023. And the same store exists on iOS, where a forensics tool called iLEAPP has been reading it since September. The fair criticism is narrower and harder to wave off. The depth of the inference is undocumented. The kinship classifier is mentioned nowhere. And the graph does not just hold your data; it holds data about everyone who has ever emailed you, appeared in your photos, or been invited to a calendar event, and none of those people were asked. The authors open-sourced a dashboard called iKnow that reads your own graph locally, if you want to see the file your Mac keeps on you. I made a 56-second film about how the graph and the family classifier work: And if you want to cut a clip like this into a GIF, try the tool I used: https://gif-master.com/en/tools/video-to-gif