October 2026 teardown of Apple Intelligence's kinship classifier

On every Mac running macOS 13 or later there is a shipped machine-learning feature named photosPersonPosteriorProbabilityGivenSaturdayNight. It is one of 144 inputs to a binary XGBoost classifier, EntityTagging_Family.mlmodelc, whose job is to decide whether a person in your contacts and photos is family. The entire documentation for the daemon that runs it, knowledgeconstructiond, is a single section-8 man page.

The classifier belongs to Apple Intelligence’s Personal Knowledge Graph, reverse-engineered by Dario Pasquini and Michał Bazyli and written up in October 2026. On a Mac the data lives in ~/Library/IntelligencePlatform, a directory of fifty-one SQLite databases. They are stored in plaintext inside a zone protected by TCC Full Disk Access, so any process you grant that permission can read all of them.

The core file is graph.db, a triple store with a vocabulary of 181 entity classes and 278 predicates. Every row is a subject, a predicate and an object. The subject is an entity such as a person, an app or an event. The object is either a plain value or another entity, which is where the graph gets its edges. The predicate names the relationship the system believes holds, and each inference carries a confidence between 0 and 1.

Kinship is computed slightly off to the side. Two shipped models, EntityTagging_Family.mlmodelc and EntityTagging_FamilyAndFriends.mlmodelc, each take 144 features and return a class and a probability. Their output does not land in the triple store. It goes into entityTagging.db, one row per person, seventeen relationship columns running from family to mother to coworker, recomputed every day. Only two of those seventeen columns have a shipped model behind them. What fills the other fifteen, and how any of these probabilities turn into a confidence value in the graph, the authors could not trace.

The 144 feature names sit in metadata.json in plain text. Pasquini and Bazyli call this the clearest statement of what the system is that they found anywhere, which is the heart of the complaint: the most honest description of what the thing does is a config file inside the model bundle, not anything the vendor published.

One behaviour matters if you administer these machines. Deleting something does not delete it everywhere. A retracted row moves to a second table, expired_stable_graph, sitting next to the live graph, and keeps its confidence and its source attribution. The authors think it prunes after about 48 hours, going by a prune watermark and a recent snapshot that reached back no further, but on their own Mac they could still read much older records in it. Clearing it is a manual delete.

There is also a record type called ContextualUnderstanding.PhysicalSocial, whose format lists people by name, phone and email, each with a start and end time. It reads like a log of who was physically near you. The authors never saw it populated, so treat it as a schema that exists rather than a confirmed behaviour.

What’s on the endpoint, and who can read it

The data is local and gated behind TCC Full Disk Access. The problem Pasquini and Bazyli document is the distance between what ships and what gets written down. A classifier that scores whether someone is family, a seventeen-column kinship table recomputed every day, a physical-proximity schema and a retention side-table that outlives deletion all ship in an OS whose public account of this subsystem is one man page.

For privacy review, DFIR or threat modelling on a macOS fleet, ~/Library/IntelligencePlatform is now an artifact worth naming. The kinship table records inferred relationships and sits in plaintext, the physical-social record type is a presence schema the authors never saw filled, and retracted graph rows survive ordinary deletion inside expired_stable_graph. Anything holding Full Disk Access on the endpoint, including software you install and the MDM agents you already trust, can read the lot. A careless Full Disk Access grant now exposes inferred family structure, not just files.

To see what a given machine has concluded, the authors shipped a read-only dashboard called iKnow, built against the Python standard library with no npm and no CDN. It binds to 127.0.0.1, opens the stores read-only, renders them in a browser tab, and writes and logs nothing. It runs air-gapped. They tested it on macOS 26.6.2 and 26.7.1, and partially on 27.0.1. The first two pages to look at are the kinship scorecard, which is the daemon’s family bindings, and the face index, which holds a face cluster for everyone in your photos.