CohortHijack: Robustness of Single Cell Annotation to Companion Cell Removal

TL;DR - An arXiv preprint introducing CohortHijack, a robustness audit showing that single-cell annotation tools which refine labels via neighboring cells or cluster voting can be flipped simply by removing other (non-target) cells from the query cohort. It matters because it exposes query cohort composition itself as a target-preserving attack surface in single-cell pipelines.

• The attack removes selected companion cells while leaving the target cell's expression profile, base prediction, and trained model unchanged; removal strategies include random and structured selection with greedy, multi-start, and beam search.
• On PBMC3K and Paul15 with logistic regression and calibrated linear SVM, multi-start search flipped 24.33% of linear-SVM targets and 19.67% of logistic-regression targets, removing only a small cohort fraction and keeping mean collateral changes under 0.4%.
• Structured removal consistently beat random removal on Paul15, and ablations showed the effect vanished when neighborhood refinement was disabled — pinning the vulnerability on the refinement step, not the classifier.
• With CellTypist, independent per-cell predictions never changed, but majority-voting refined labels did shift after small companion-cell removals.