Two background processes, called daemons (programs that run silently without a visible window), power a system Apple calls the Personal Knowledge Graph. It has been present since macOS 13, released in 2022. The first process, knowledgeconstructiond, analyzes content stored on your device; the second, intelligenceplatformd, handles related processing, according to security research firm Eighth Rank.
Apple’s own technical documentation describes knowledgeconstructiond as analyzing on-device processing to build a general-purpose knowledge graph representing the device and its user. That description covers the daemon’s stated purpose, not a complete inventory of every data source the system uses.
Fifty-One Databases, One Central Map
The system stores its findings in plaintext databases protected by macOS access controls.
Eighth Rank found 51 SQLite databases (a SQLite database is a standard file format for storing structured information) inside the macOS Library/IntelligencePlatform directory. The central file, graph.db, reportedly contains 181 entity classes and 278 predicates. A predicate is a descriptor that defines how two entries relate to each other.
Entity types include people, groups, organizations, and political parties; predicates record topics of interest, relationship types, and connections to facial-recognition clusters in the Photos app. The databases are stored as plaintext but are generally protected by macOS TCC controls, which typically require an app to hold Full Disk Access permission before it can read them.
Beyond Logging: The System Makes Inferences
The graph does not just record facts; it draws conclusions your source data never explicitly stated.
When new information arrives, the system compares it against existing entries and infers relationships rather than simply adding isolated facts. According to Eighth Rank, family-related inferences draw on models that examine 144 mostly behavioral features alongside facial analysis from Photos.
The examined relationship records each receive a confidence score between 0 and 1, indicating the system tracks its own uncertainty rather than treating every inference as equally reliable. Reported examples from Eighth Rank’s analysis suggest the system can infer a child’s presence in a household, associated daycare details, related phone numbers, and likely destinations from combinations of ordinary messages, contacts, and location data. Those findings reflect specific observed database entries and should not be read as a guarantee the system produces all of those conclusions for every user. For further context on how surveillance app technology has been used to build similar inferences about individuals, real-world cases offer instructive parallels.
Deleting the Source Does Not Delete the Conclusion
Derived relationships may survive a source deletion for a period before the system removes them.
Removing a contact or message does not immediately clear every related row from the graph. Eighth Rank identified a second structure called expired_stable_graph, which retains retracted rows along with their confidence scores; entries in the tested databases appeared to be pruned after approximately 48 hours, though the researchers did not establish whether that interval reflects a fixed policy or an observed pattern under specific conditions.
This finding applies to the macOS databases Eighth Rank analyzed and should not be generalized to every Apple device or operating-system version.
What This Means for Siri, and What Remains Unclear
Apple says private cloud requests are not retained; current research does not confirm every graph field reaches Siri.
The Personal Knowledge Graph appears to serve as a local foundation for Apple Intelligence features, including Siri’s ability to search across messages, email, photos, and other personal data for more relevant answers. Apple says on-device processing is a core privacy measure; requests that require more computing power use Private Cloud Compute, where Apple says data is processed only to fulfill the request and is not retained. Separately, questions about how Apple’s Confidential Files can be exposed through the iCloud ecosystem underscore broader risks within Apple’s data infrastructure.
Available research does not confirm that every graph field is directly exposed to Siri or that every inference reaches Private Cloud Compute.
The privacy advantage Apple’s architecture offers is that analysis happens locally where possible, rather than on a remote provider’s servers. The privacy implication is that the inferences the system creates, covering family relationships, movement patterns, communications, and social connections, can be detailed and, in tested cases, may persist temporarily after the source data that produced them has been deleted.
