🤖 machine learning

CohortHijack: Robustness of Single Cell Annotation to Companion Cell Removal

The paper introduces CohortHijack, a robustness audit demonstrating that single-cell annotation tools relying on neighborhood refinement or cluster-level voting are vulnerable to manipulation, where removing a small fraction of non-target companion cells can alter the predicted label of a target cell without changing its expression profile.

Original authors: Arash Vashagh, Yasmin Vashagh

Published 2026-08-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Arash Vashagh, Yasmin Vashagh

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to guess what a person's favorite movie is. You could just look at their face and ask them directly, but what if you also asked their friends? If their friends all say, "Oh, they love sci-fi!" you might change your guess, even if the person's own answer was a bit vague. This is how scientists often figure out what kind of cell a tiny speck of life is. They use a technique called single-cell RNA sequencing, which is like taking a photo of the genes inside one single cell to see what it's doing. But because cells are so tiny and messy, scientists often use a "group vote" to help. They look at a cell's neighbors in a sample and say, "Well, most of the cells around this one are 'T-cells,' so this one probably is too." This group thinking helps fix mistakes, but it also means the final answer depends on who is in the room.

The big question is: what happens if someone quietly swaps out a few of those neighbors? Does the cell's identity change just because the crowd changed? This is the puzzle scientists are solving. They want to know if these "group vote" systems are strong enough to handle a crowd that shifts slightly, or if a sneaky change in the group can trick the system into misidentifying a perfectly healthy cell. It's a bit like asking: if you remove a few people from a classroom, does the teacher suddenly decide the quiet kid in the back is actually the class clown?

The "CohortHijack" Experiment

In this paper, the researchers introduce a new way to test these cell-identifying tools, which they call CohortHijack. Think of it as a "security audit" for the group vote. Instead of trying to trick the cell itself (which would be like changing the kid's face), they keep the target cell exactly the same. Instead, they quietly remove a small, carefully chosen group of "companion cells" from the sample and see if the final label for the target cell changes.

The researchers found that this "crowd manipulation" works surprisingly well. They tested this on two different sets of cell data (called PBMC3K and Paul15) using two common computer models (Logistic Regression and Linear SVM).

Here is what they discovered:

Random vs. Sneaky: If you just randomly kick a few cells out of the group, the system usually stays calm. The target cell keeps its label. However, if you use a "structured" approach—meaning you carefully pick which cells to remove based on who they are or how close they are to the target—the system gets confused much more easily.
The Numbers: On one of the datasets (Paul15), using a smart, search-based method to remove just a tiny fraction of the group (less than 1% to 2% of the cells), the researchers were able to flip the label of the target cell 24.33% of the time for one model and 19.67% for the other.
The "Sneaky" Part: The most interesting part is that the target cell didn't change at all. Its genetic code was identical. The only thing that changed was the company it kept. The researchers showed that by removing specific neighbors, they could make a cell labeled as a "Cytotoxic T cell" suddenly get re-labeled as an "NK cell" (a different type of immune cell), even though the cell itself was untouched.

How they did it:
They used different strategies to pick which cells to remove:

Random Removal: Just picking cells by chance (like closing your eyes and pointing). This didn't work very well.
Nearest-Neighbor Removal: Removing the cells that are physically closest to the target in the data.
Same-Class Removal: Removing other cells that have the same label as the target. Surprisingly, removing cells that agree with the target was often the most effective way to change the target's label!
Search Methods: They used computer algorithms (like "Multi-Start Greedy" and "Beam Search") to hunt for the perfect combination of cells to remove. These smart searches found that they could flip the label while causing very little "collateral damage" (meaning other cells in the group didn't get mislabeled).

Why it matters:
The study confirmed that this vulnerability comes specifically from the "neighborhood refinement" step. When they turned off the part of the software that looks at neighbors, the attacks stopped working completely. This proves that the problem isn't the cell itself, but the way the software relies on the crowd.

They also tested a popular real-world tool called CellTypist. Even though CellTypist's initial, independent guess for a cell never changed, its final "majority vote" label did change after they removed a few companion cells. For cells that were already a bit uncertain (called "context-sensitive"), removing just 1% or 2% of the group caused the label to flip nearly 50% of the time in some cases.

The Takeaway:
The paper suggests that the way we label cells might be more fragile than we thought. A cell's final identity in these tools isn't just about what the cell is, but also about who is standing next to it. If a few neighbors are lost or removed during analysis, the final answer might shift. The authors conclude that scientists need to check if their cell labels are stable even when the group composition changes slightly, because right now, a small change in the crowd can hijack the identity of the individual.

Technical Summary: CohortHijack – Robustness of Single Cell Annotation to Companion Cell Removal

1. Problem Statement

Single-cell RNA sequencing (scRNA-seq) analysis pipelines increasingly rely on automated annotation tools that refine initial cell labels using contextual information, such as neighborhood graphs, cluster-level voting, or consensus predictions. While these methods improve accuracy by correcting isolated or uncertain predictions, they introduce a dependency on the composition of the query cohort.

The paper identifies a specific robustness vulnerability: the final annotation of a target cell can change significantly if a small, carefully selected subset of non-target "companion" cells is removed from the cohort, even if the target cell's gene expression profile, the trained classifier, and the model parameters remain entirely unchanged. This phenomenon, termed CohortHijack, represents a "target-preserving" attack surface where the manipulation of the surrounding context alters the output without modifying the target input itself.

2. Methodology

The authors introduce CohortHijack, a robustness audit framework designed to test the stability of refined annotations against companion-cell removal.

Experimental Setup: The study utilizes two datasets (PBMC3K and Paul15) and two frozen classifier families (multinomial logistic regression and calibrated linear SVM). The test set serves as the query cohort.
Annotation Pipeline:
1. Base Classification: A frozen classifier generates independent probability vectors for each cell.
2. Refinement: A cohort-dependent refinement stage computes a refined label based on the base prediction and neighborhood support (using Euclidean nearest neighbors in PCA space). This support can be uniform or confidence-weighted.
Removal Strategies: The audit removes a subset $S$ $S$ of non-target cells ( $t \notin S$ $t \in / S$ ) and recomputes the refinement. The study evaluates:
- Random Removal: Uniform sampling of non-target cells.
- Structured Removal:
  - Same-Class Removal: Removing cells that share the target's clean refined label.
  - Nearest-Cell Removal: Removing the $k$ closest cells to the target in PCA space.
- Search-Based Removal: Optimizing the removal set to flip the target label using Greedy Search, Multi-Start Greedy Search, and Beam Search. These methods optimize for a negative margin (where a new class overtakes the original) while minimizing collateral damage to other cells.
Evaluation Metrics:
- Target Flip Rate: The proportion of correctly annotated, lower-confidence targets whose refined label changes after removal.
- Collateral Flip Rate: The proportion of non-target cells whose labels change, measuring unintended disruption.
Validation: The threat model is validated using CellTypist, a widely used annotation tool, specifically examining its majority-voting refinement mechanism.

3. Key Results

Structured vs. Random Removal: Structured removal methods (Same-Class and Nearest-Cell) were consistently more effective than random removal. On the Paul15 dataset, structured removal changed significantly more targets (e.g., 17.39% for Same-Class vs. 1.63% for Random on Linear SVM at a 5% budget) compared to the more stable PBMC3K dataset.
Search-Based Efficiency: Search-based methods achieved high success rates with minimal removal fractions.
- Multi-Start Greedy Search changed 24.33% of Linear SVM targets and 19.67% of Logistic Regression targets on Paul15.
- These attacks required removing a median of only 0.64% to 1.27% of the cohort.
- Crucially, collateral damage (unintended label changes in other cells) remained low, with mean collateral flip rates below 0.4% in the controlled pipeline.
Mechanism Ablations: The vulnerability was isolated to the neighborhood refinement stage. When the context weight ( $\lambda$ ) was set to zero (disabling neighborhood influence), no target flips occurred. Vulnerability increased linearly with the weight assigned to neighboring cells.
CellTypist Validation: In CellTypist, independent predictions remained unchanged across all evaluations. However, refined labels changed after small companion-cell removals.
- Context-sensitive targets (where independent and majority-voted labels initially disagreed) were highly vulnerable, with flip rates reaching 50.0% under Same-Label removal at a 2% budget.
- Initially stable targets showed much lower vulnerability (3.33%–10.0%).
- Unlike the controlled pipeline, CellTypist showed higher collateral changes (~10%) because it reconstructs the full neighborhood graph and over-clustering after each intervention.

4. Contributions

The paper makes three primary contributions:

Definition of a New Threat: It defines "companion-cell removal" as a target-preserving threat to refined single-cell annotation, distinct from traditional adversarial attacks that perturb input features.
Development of Audit Methods: It introduces structured and search-based removal strategies (including Multi-Start and Beam Search) and establishes metrics to measure both target manipulation and collateral damage.
Empirical Validation: It validates the threat across controlled synthetic pipelines and a real-world annotation tool (CellTypist), demonstrating that the effect is not limited to specific model architectures but is inherent to cohort-dependent refinement systems.

5. Significance and Claims

The authors claim that clean annotation accuracy is insufficient to describe the reliability of cohort-dependent pipelines. A cell may be classified correctly based on its own expression, yet its final label remains fragile and dependent on the specific composition of the surrounding cohort.

The paper argues that:

Query cohort composition is an attack surface. Small, targeted removals can alter annotations without modifying the target cell.
Vulnerability is context-dependent. The risk is higher in datasets with overlapping cell populations or biological transitions (e.g., Paul15) compared to those with clearly separated types.
Stability testing is necessary. The authors suggest that stability testing—repeating annotation under controlled subsamples to report label stability—should become a standard part of evaluating single-cell annotation systems. This would help identify cells that require manual review or broader lineage labeling, providing information that standard confidence scores may miss.

The study is modest in scope, limited to two datasets, linear classifiers, and one CellTypist model, but it establishes a foundational framework for understanding and auditing the robustness of context-aware biological annotation tools.