Single-Cell Annotation Vulnerable to Companion Cell Removal

Many single-cell annotation tools enhance initial cell labels by considering nearby cells or employing cluster-level voting mechanisms. This research investigates the robustness of such refinement processes, specifically exploring whether they can be manipulated without altering the target cell itself. The study introduces a robustness audit called CohortHijack. CohortHijack works by selectively removing non-target cells, referred to as "companion cells," from the query cohort. Crucially, this removal is performed while preserving the target cell's expression profile, its base prediction, and the trained model. The researchers evaluated various removal methods, including random and structured approaches, along with greedy, multi-start, and beam search algorithms, on two datasets (PBMC3K and Paul15) using logistic regression and calibrated linear SVM classifiers. The findings indicate that structured removal methods were consistently more effective than random removal on the Paul15 dataset. Multi-start search, for instance, managed to change the refined labels of 24.33% of linear-SVM targets and 19.67% of logistic-regression targets by removing only a small fraction of the cohort, with minimal collateral changes. Ablation studies confirmed that this effect disappeared when neighborhood refinement was disabled. Even CellTypist's majority voting, while maintaining independent predictions, showed changes in refined labels after small companion-cell removals. These results highlight that the composition of the query cohort represents a significant, target-preserving attack surface in single-cell annotation.