Search papers, labs, and topics across Lattice.
This study introduces CohortHijack, a robustness audit that examines the vulnerability of single-cell annotation tools to manipulation through the strategic removal of companion cells. By evaluating various removal strategies on datasets like PBMC3K and Paul15, the authors found that structured removal methods significantly outperformed random ones, leading to substantial changes in classification targets while maintaining low collateral effects. The results highlight the critical role of query cohort composition as a potential attack vector in single-cell annotation, raising concerns about the reliability of current annotation methods under adversarial conditions.
Removing just a few companion cells can drastically alter single-cell annotation outcomes, revealing a hidden vulnerability in existing tools.
Many single-cell annotation tools refine an initial cell label using nearby cells or cluster-level voting. We study whether this refinement can be manipulated without changing the target cell. We introduce CohortHijack, a robustness audit that removes selected non-target cells from the query cohort while preserving the target expression profile, base prediction, and trained model. We evaluate random and structured removal methods, together with greedy, multi-start, and beam search, on PBMC3K and Paul15 using logistic regression and calibrated linear SVM classifiers. Structured removal was consistently stronger than random removal on Paul15. Multi-start search changed 24.33% of linear-SVM targets and 19.67% of logistic-regression targets while removing a small fraction of the cohort and keeping mean collateral changes below 0.4%. Ablations confirmed that the effect disappeared when neighborhood refinement was disabled. We also evaluated CellTypist majority voting, where independent predictions remained unchanged across all evaluations, but refined labels changed after small companion-cell removals. These findings identify query cohort composition as a target-preserving attack surface in single-cell annotation.
