Anatomy of Apple's Personal Knowledge Graph — Eighth Rank
8rank.ai
Every Mac since macOS 13 (2022) ships a pair of daemons whose only purpose in life is to build a graph about who you are, who you know, how those people are related to you and to each other, how you communicate with them, where you go, what you do and when. In this post, we look into how this system works and give you a tool to peek into your own graph.

This blog post is an account of some analysis work we carried out on what the knowledge graph actually does, so that you (the user) can get a better understanding of how this mechanism works, and some clarity on what the graph holds about you and your family and friends. Everything in it was collected on macOS 26 (26.6.2 at the time of writing).

  • NaibofTabr@infosec.pubEnglish
    5·
    18 hours ago

    Hmm, this must also be implemented in iOS right? Like there’s no way this isn’t also being used on mobile devices.

    Oh, yeah there it is:

    And even more recently, a forensics tool went looking on the phone: in September 2026, Alexis Brignoni taught iLEAPP to read the same store on iOS, where graph.db and the ontology.db that decodes its predicate codes sit under /private/var/mobile/Library/IntelligencePlatform; he writes it up in Reading the iPhone Knowledge Graph, and Checking Its Work.

    This links to https://leapps.org/blog-post?post=apple-intelligence-platform-knowledge-graph for more information.

    Your iPhone runs a daemon called knowledged. It sits in the background and does exactly what the name suggests. It builds knowledge. Not files, not logs, but a graph of things the phone has decided are true about you. Who your contacts are. Where you have been. Which apps you run and who made them. It ties all of that together and stores it on the device.

    Fucks’ sake. Everything is Big Brother. Makes me want to give up everything and move to a rural area in Africa or India or something, someplace away from cities and big tech corpos.

    Android must be doing similar things, though for Google it’s probably server-side and might not be available on the local device.