🤖 AI Summary
This study investigates whether single-cell annotation methods can be misled by manipulating the composition of neighboring cells without altering the expression profile of target cells. To this end, we propose CohortHijack, a novel robustness auditing framework that reveals, for the first time, the query cohort composition as an attack surface that preserves target features. Our approach combines random and structured cell removal strategies with greedy, multi-start, and beam search algorithms to evaluate neighborhood- or clustering-based classifiers—specifically logistic regression and calibrated linear SVM—on the PBMC3K and Paul15 datasets. Experiments demonstrate that removing only a small fraction of non-target cells (average perturbation <0.4%) suffices to flip 19.67%–24.33% of target labels; this effect vanishes when neighborhood mechanisms are disabled, confirming the attack’s specific dependence on local cellular context.
📝 Abstract
Many single-cell annotation tools refine an initial cell label using nearby cells or cluster-level voting. We study whether this refinement can be manipulated without changing the target cell. We introduce CohortHijack, a robustness audit that removes selected non-target cells from the query cohort while preserving the target expression profile, base prediction, and trained model. We evaluate random and structured removal methods, together with greedy, multi-start, and beam search, on PBMC3K and Paul15 using logistic regression and calibrated linear SVM classifiers. Structured removal was consistently stronger than random removal on Paul15. Multi-start search changed 24.33% of linear-SVM targets and 19.67% of logistic-regression targets while removing a small fraction of the cohort and keeping mean collateral changes below 0.4%. Ablations confirmed that the effect disappeared when neighborhood refinement was disabled. We also evaluated CellTypist majority voting, where independent predictions remained unchanged across all evaluations, but refined labels changed after small companion-cell removals. These findings identify query cohort composition as a target-preserving attack surface in single-cell annotation.