macOS internal EntityTagging_Family.mlmodelc file indeed contains the feature variable name photosPersonPosteriorProbabilityGivenSaturdayNight. This indicates a specific fact: the frequency with which two individuals appear together in Saturday-night photos is one of the 144 numerical signals used to determine “whether they are family.” Dario Pasquini and Michał Bazyli of the security research team 8rank.ai analyzed this file and published the open-source tool iKnow, allowing users to directly verify the family relationship estimates Apple derives on-device via machine learning, without server transmission 1.
All Macs running macOS 13 (2022) or later include two daemons (background system programs that run automatically): knowledgeconstructiond and intelligenceplatformd. These daemons build a personal knowledge graph (a network) on-device by cross-referencing contacts, faces in photos, calendars, and message participants. Analysis of macOS version 26.6.2 by the 8rank.ai team revealed that inference data combining users’ relationships, locations, and behavioral patterns with those of people in their circle is indeed stored 1, 2.
Same Surname, Address, Photo Frequency: A Classifier Built from 144 Signals
Two files serve as classifiers for estimating family and friend relationships: EntityTagging_Family.mlmodelc and EntityTagging_FamilyAndFriends.mlmodelc. The 8rank.ai team confirmed that these files are binary XGBoost classifiers (machine learning models that accept numerical inputs and compute the probability of a specific relationship) 1, 2. Both models receive 144 numerical features in a fixed order, grouped into three categories: identity, communication, and photos.
The 20 identity-related signals include matching surnames, home and work addresses, email domains, birthdays, nicknames, favorite/VIP designations, iCloud Family Sharing participation, and age differences. The 40 communication-related signals measure short- and long-term contact frequency, day-of-week and time-of-day patterns, contact locations, conditional frequency on weekdays versus weekends, and primary communication channels. Message contents themselves are not used in feature computation. The 84 photo-related signals compute co-appearance frequency within the same photo frame, segmented by day of week, time of day, and location 1.
Scores computed by the classifiers are stored in a separate file, entityTagging.db, not in the graph body itself. Each person occupies one row, with 17 relationship columns (mother, father, sibling, son, daughter, partner, colleague, friend, etc.), recalculated daily 1, 2. However, the model confirmed by the 8rank.ai team connects to only 2 of the 17 columns; how the remaining 15 columns are populated and how these probabilities convert into graph confidence levels were not traced in this analysis 1, 2.
Output on the 8rank.ai Analysis Mac: Only the “Mother” Column Reached the Highest Score
While “family estimate data” may evoke a complete family roster, the actual classifier output is closer to unconfirmed probabilities. The 8rank.ai team published results from directly reading the score table on the analysis Mac. Their findings showed that only the “mother” column reached the maximum score, while some individuals received low scores simultaneously across multiple family relationship columns such as sibling or child. Values recorded in the score table showed discrete values like 0.125, 0.25, 0.5, and 0.96, with most individuals never deviating from default values. Alumni or unverified entries received no scores at all 1.
This output format shows that the data are not confirmed family information but rather unfinished estimates, where scores form only when multiple weak signals overlap. Since the pathway from classifier score to graph confidence level was not confirmed in this analysis, interpreting score-table values as definitive judgments is difficult.
Identity Resolution Process and Data Storage Location
Inferring family relationships requires prior identity resolution—linking “this face” to “this person.” The graph store contains the predicate nm_hasVisualIdentifier, connecting person entities to face clusters, and the structure nm_entityAliasRelationship, which assesses name-face identity probabilistically. Software engineer Nic Lydon, who disclosed this storage structure in May 2026, extracted and presented evidence that alias relationships are recorded alongside nm_confirmationConfidence (confidence score) 3. This means the system attempts to establish connections even when faces in photos do not match user-assigned names.
The data reside on the user’s Mac at path ~/Library/IntelligencePlatform. Inside this folder, 51 SQLite database files are stored in plaintext (structure-readable without separate encryption), and this location is protected by TCC (Full Disk Access permissions protection) 1, 2.
The scope of stored communication records must be precisely defined. Communication metadata in the graph consists of “who,” “when,” “which app,” and “sent/received” information. Apple does not include message bodies in these metadata tables 1, 2. Signals such as location movement, screen lock status, and Wi-Fi connection status also exist in the same storage structure, but their declaration in the schema (data design structure) does not necessarily mean values are being actively collected for every category.
Query Relationship Scores Directly Using the iKnow Tool
The 8rank.ai team released the open-source tool iKnow so users can inspect data on their own devices. Built solely with the Python standard library, it is a local web dashboard that, when launched, binds to 127.0.0.1 (localhost—the user’s own device) and queries the database in read-only mode. It performs no writes or logging and functions even in network-blocked environments, ensuring displayed values never leave the device 1, 2.
Key information provided by the iKnow interface includes:
| Screen | Displayed Content | Characteristics and Cautions |
|---|---|---|
| Kinship score table | 17 relationship columns and parent categories (e.g., mother + father → parent) | Partner scores are not included in parent categories and require separate verification |
| Social relationship graph | Connections among people, employers, group chats, and shared calendars | Scores in the example screen are synthetic data |
| Photo face index | Network formed by face clusters linked through co-appearance in photos | Network forms based solely on co-appearance in photos, without contacts |
| Annual communication record | Sent/received counts and call frequency by day-of-week and time distribution | Message bodies are not included |
| Retraction record | Confidence and source of deleted facts | Enables verification of data persistence following deletion timing |
Estimation results may persist briefly even after contact deletion. The 8rank.ai team confirmed that deleted connections move to the expired_stable_graph table and persist for some time. Records appeared to be removed after about 48 hours, but older records were still readable on the analysis Mac, so the exact retention period remains unconfirmed. In one example, two individuals connected through a calendar invitation remained in the relationship score table the day after their graph connection was removed 1.
macOS System Settings does not offer an official UI for users to view or edit their relationship scores 2. Given the absence of an official query method and means to correct erroneous inferences, using tools like iKnow to directly check the score table’s state is a useful approach. In an environment upgraded to macOS 27 (27.0.1), most rows created from contacts, calendars, Siri Suggestions, Family Sharing, and app lists were observed to be temporarily retracted, then rebuilt over the following day 2.
Family relationship scores, computed daily from 144 numerical signals, are stored in SQLite files within the device. On the 8rank.ai team’s analysis Mac, only the “mother” column reached the highest score, while other relationships displayed low scores scattered across multiple columns, clearly indicating these are estimates rather than confirmed database entries. Running iKnow allows users to open and view the same score table in read-only mode on their own Mac.
References
- ↩
- Mac은 누구를 가족으로 추정할까 - macOS의 개인 지식 그래프 | GeekNews · news.hada.io↩
- ↩
