CohortHijack: Robustness of Single Cell Annotation to Companion Cell Removal
Ranking
Observed public metrics from 1 member.
Merged summary
TL;DR - An arXiv preprint introducing CohortHijack, a robustness audit showing that single-cell annotation tools which refine labels via neighboring cells or cluster voting can be flipped simply by removing other (non-target) cells from the query cohort. It matters because it exposes query cohort composition itself as a target-preserving attack surface in single-cell pipelines.
- The attack removes selected companion cells while leaving the target cell's expression profile, base prediction, and trained model unchanged; removal strategies include random and structured selection with greedy, multi-start, and beam search.
- On PBMC3K and Paul15 with logistic regression and calibrated linear SVM, multi-start search flipped 24.33% of linear-SVM targets and 19.67% of logistic-regression targets, removing only a small cohort fraction and keeping mean collateral changes under 0.4%.
- Structured removal consistently beat random removal on Paul15, and ablations showed the effect vanished when neighborhood refinement was disabled — pinning the vulnerability on the refinement step, not the classifier.
- With CellTypist, independent per-cell predictions never changed, but majority-voting refined labels did shift after small companion-cell removals.
Sources (1)
CohortHijack: Robustness of Single Cell Annotation to Companion Cell Removal
TL;DR - An arXiv preprint introducing CohortHijack, a robustness audit showing that single-cell annotation tools which refine labels via neighboring cells or cluster voting can be flipped simply by removing other (non-target) cells from the query cohort. It matters because it exposes query cohort composition itself as a target-preserving attack surface in single-cell pipelines.
- The attack removes selected companion cells while leaving the target cell's expression profile, base prediction, and trained model unchanged; removal strategies include random and structured selection with greedy, multi-start, and beam search.
- On PBMC3K and Paul15 with logistic regression and calibrated linear SVM, multi-start search flipped 24.33% of linear-SVM targets and 19.67% of logistic-regression targets, removing only a small cohort fraction and keeping mean collateral changes under 0.4%.
- Structured removal consistently beat random removal on Paul15, and ablations showed the effect vanished when neighborhood refinement was disabled — pinning the vulnerability on the refinement step, not the classifier.
- With CellTypist, independent per-cell predictions never changed, but majority-voting refined labels did shift after small companion-cell removals.