Two security researchers at 8rank, Dario Pasquini and Michał Bazyli, have published an analysis of a personal knowledge graph that macOS builds on the device, and found that it uses “a pair of XGBoost classifiers” to decide who is family from 144 mostly behavioral features (8rank, Anatomy of Apple’s Personal Knowledge Graph).
The post, dated October 28, says the system is built by two daemons that every Mac has shipped since macOS 13 in 2022; the authors did their analysis on macOS 26.6.2. It reached 475 points on Hacker News on November 7.
Business Pill · On-device AI
An evergreen Business Engineer explainer on on-device AI. It teaches the general idea only and does not discuss Apple’s knowledge graph or the 8rank research.
The key insight: Researchers at 8rank wrote that macOS builds an on-device personal knowledge graph and that a pair of XGBoost classifiers decides who is family from 144 mostly behavioral features.
The authors write that the two daemons keep their work in a directory of 51 SQLite databases, “stored in plaintext but located in a zone protected by TCC Full Disk Access”. The main store, graph.db, is described as a triple store with a vocabulary of 181 entity classes and 278 predicates.
According to the post, the graph draws on Contacts, faces in Photos, Calendar, Family Sharing, the Medical ID emergency contact in Health, events and contacts that Siri Suggestions finds in Mail and Messages, people donated by apps, and installed apps. Separate tables hold a communication log, which the authors describe as “who, when, which app, which direction; no content”, plus location and device signals.
The authors write that the closest thing to an official description is the man page for knowledgeconstructiond, which reads: “A daemon that analyzes content on the device to build a general purpose knowledge graph”.
The 8rank researchers counted 17 relationship columns in the family-scores table on macOS 26.6.2 and found a shipped model behind two of them. 15 is our arithmetic (17 minus 2). Data: Dario Pasquini and Michał Bazyli, 8rank, 28 Oct 2026; not verified by Apple.
How the Family Scores Work
The post says the family scores sit in their own table, one row per person with seventeen relationship columns from family to mother to coworker, recomputed every day. Two CoreML models ship next to the ontology, the authors write, and they are binary classifiers that return a class and a probability.
The post is explicit about its limits: “Only two of those seventeen columns have a shipped model behind them”. By our arithmetic, that leaves 15 of the 17 columns, about 88%, with no mechanism the researchers could trace.
The authors also write that twelve analyzers in Photos score partner, parent, child, coworker and friend from who appears in pictures with the user, and that “Apple’s on-device LLM reads your messages to put a name and a relationship on a face (if Apple Intelligence is active)”.
How Anyone Can Check
The researchers released iKnow, an open-source local dashboard under the Apache 2.0 licence that reads the store on a user’s own Mac. The post credits earlier work by Nic Lydon on the same database, and by Alexis Brignoni, whose forensics tool iLEAPP reads the equivalent store on iOS.
What Apple Says
Apple’s Mac help page on privacy says Apple Intelligence is “grounded in your personal context” and that “In many cases, Apple Intelligence models run entirely on device so that a task can be completed without data leaving your device” (Apple, Apple Intelligence and privacy on Mac). That page does not describe the knowledge graph or the relationship scores. Apple researchers published a 2023 paper on growing and serving large open-domain knowledge graphs, which the 8rank post cites as a paper on the techniques behind this graph construction.
The post itself says the knowledge “is meant to stay local on your machine, protected by the Full Disk Access permission”, while adding that it “can be consumed by other services (but it is not entirely clear to us how and what can be accessed)”.
As we read the post, the graph is the plumbing under Apple’s personal-context pitch: it links people, messages, photos and calendars into one store on the Mac.
As we read it, the researchers are careful about their limits: they could not trace what fills 15 of the 17 relationship columns, and they describe the store as meant to stay local.
As we read Apple’s help page, it promises on-device processing in many cases but does not describe this layer, which is why the researchers built a tool for users to look for themselves.
Dario Pasquini and Michał Bazyli, 8rank
“The reality is that the amount of information in this store is really something else”
Three Implications
FOR APPLEApple’s help page says Apple Intelligence is grounded in your personal context; the researchers write that the closest thing to an official description of this graph is the man page.
FOR MAC USERS The researchers released iKnow, an open-source dashboard that reads the store on a user’s own Mac.
FOR RIVALS’ ASSISTANTS As we read it, the post describes a graph built on the device from Contacts, Photos, Calendar, Family Sharing and events found in Mail and Messages.
The analysis describes The Container Moat as “built by closed data loops inside a customer’s environment, nascent but the deepest position in the stack.”
As we read it, the 8rank post documents a closed data loop that lives on the user’s own device. The analysis does not discuss Apple, macOS or the 8rank research.
What Is Not Established
Every technical finding here is the researchers’ and has not been confirmed by Apple; we did not find an Apple statement responding to the post in our searches. The authors say they could not trace how 15 of the 17 relationship columns are filled or how the probabilities become confidence in the graph. The post does not show any of this data leaving the device. This piece makes no forecast.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
Researchers have documented an on-device graph in macOS that scores 17 kinds of relationship, from family to coworker, and found shipped models for two of them that judge family from 144 signals. Apple’s own privacy page promises on-device processing in many cases but does not describe this layer.
A note on sourcing. Technical findings are the 8rank researchers’ (post dated 28 October 2026) and were not confirmed by Apple. Apple’s position is quoted from its Mac help page on Apple Intelligence and privacy. Counts and percentages labelled as ours are our arithmetic.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
