CohortHijack: Robustness of Single Cell Annotation to Companion Cell Removal

# CohortHijack: Robustness of Single Cell Annotation to Companion Cell Removal
Source: [https://arxiv.org/html/2608.05900](https://arxiv.org/html/2608.05900)
Arash Vashagh∗and Yasmin Vashagh† ∗Faculty of Computer Science, University of New Brunswick, Fredericton, New Brunswick E3B 5A3, Canada †Farzanegan Amin 2 High School, Isfahan, Iran \{arash\.vashagh@unb\.ca, yasmin\.vashagh@gmail\.com\}

###### Abstract

Many single\-cell annotation tools refine an initial cell label using nearby cells or cluster\-level voting\. We study whether this refinement can be manipulated without changing the target cell\. We introduce CohortHijack, a robustness audit that removes selected non\-target cells from the query cohort while preserving the target expression profile, base prediction, and trained model\. We evaluate random and structured removal methods, together with greedy, multi\-start, and beam search, on PBMC3K and Paul15 using logistic regression and calibrated linear SVM classifiers\. Structured removal was consistently stronger than random removal on Paul15\. Multi\-start search changed 24\.33% of linear\-SVM targets and 19\.67% of logistic\-regression targets while removing a small fraction of the cohort and keeping mean collateral changes below 0\.4%\. Ablations confirmed that the effect disappeared when neighborhood refinement was disabled\. We also evaluated CellTypist majority voting, where independent predictions remained unchanged across all evaluations, but refined labels changed after small companion\-cell removals\. These findings identify query cohort composition as a target\-preserving attack surface in single\-cell annotation\.

## IIntroduction

Single\-cell RNA sequencing enables the measurement of gene expression at the level of individual cells and supports the study of complex tissues, immune populations, developmental processes, and disease states\. Modern analysis pipelines commonly include normalization, dimensionality reduction, clustering, visualization, and cell\-type annotation\[[1](https://arxiv.org/html/2608.05900#bib.bib1),[2](https://arxiv.org/html/2608.05900#bib.bib2)\]\. Since large datasets may contain thousands or millions of cells, manual annotation is slow and may vary between experts\. Automated cell\-type annotation has therefore become an important part of single\-cell analysis\[[3](https://arxiv.org/html/2608.05900#bib.bib3),[4](https://arxiv.org/html/2608.05900#bib.bib4),[5](https://arxiv.org/html/2608.05900#bib.bib5)\]\.

Existing annotation methods use different forms of prior knowledge and reference information\. Some methods project query cells onto annotated reference datasets, while others use probabilistic models, marker genes, integration methods, or consensus predictions\[[4](https://arxiv.org/html/2608.05900#bib.bib4),[6](https://arxiv.org/html/2608.05900#bib.bib6),[7](https://arxiv.org/html/2608.05900#bib.bib7),[8](https://arxiv.org/html/2608.05900#bib.bib8)\]\. Reference mapping methods such as Symphony place query cells within a stable reference representation and transfer known annotations to new datasets\[[9](https://arxiv.org/html/2608.05900#bib.bib9)\]\. Other frameworks combine annotation, integration, and label refinement to improve predictions across datasets\[[10](https://arxiv.org/html/2608.05900#bib.bib10),[11](https://arxiv.org/html/2608.05900#bib.bib11)\]\. These approaches show that the final annotation of a cell may depend not only on its own gene expression, but also on the surrounding cells, neighborhood structure, or cluster\-level information\.

Cohort information can improve annotation by correcting isolated or uncertain predictions\. Consensus methods combine outputs from several annotation algorithms, while neighborhood and niche\-based methods use nearby cells or local cellular composition\[[8](https://arxiv.org/html/2608.05900#bib.bib8),[12](https://arxiv.org/html/2608.05900#bib.bib12)\]\. However, this dependence also creates a robustness concern\. If the query cohort changes because some cells are removed, the neighborhood graph, cluster assignments, local class frequencies, and refined labels may also change\. As a result, the same target cell may receive a different final annotation even though its gene\-expression profile remains unchanged\.

Changes in cohort composition can occur during ordinary single\-cell analysis\. Low\-quality cells may be removed during quality control, rare cells may be lost during sampling, and large datasets may be reduced before downstream analysis\. Previous work has shown that random subsampling may discard rare populations or distort the structure of a single\-cell dataset\. This motivated methods that select cells more carefully, either to preserve cellular diversity or to retain cells with high value for downstream analysis\[[13](https://arxiv.org/html/2608.05900#bib.bib13),[14](https://arxiv.org/html/2608.05900#bib.bib14)\]\. These studies focus on preserving global dataset quality\. They do not examine whether a small and carefully selected set of removed cells can change the annotation of a specific unchanged target cell\.

Adversarial attacks provide a useful framework for studying such worst\-case behavior\. Early work showed that small input perturbations can cause accurate machine learning models to output incorrect predictions\[[15](https://arxiv.org/html/2608.05900#bib.bib15),[16](https://arxiv.org/html/2608.05900#bib.bib16)\]\. Later research has studied attacks against model utility, privacy, and explainability, together with defenses and target\-preserving attacks that alter external context rather than the target input\[[17](https://arxiv.org/html/2608.05900#bib.bib17),[18](https://arxiv.org/html/2608.05900#bib.bib18),[19](https://arxiv.org/html/2608.05900#bib.bib19)\]\. In single\-cell analysis, adverSCarial evaluates the vulnerability of RNA\-sequencing classifiers to adversarial perturbations of gene\-expression inputs\[[20](https://arxiv.org/html/2608.05900#bib.bib20)\]\. Such attacks modify the target cell’s features\. In contrast, the vulnerability studied here preserves the target cell and changes only the surrounding query cohort\.

A related idea appears in attacks against graph\-based learning\. Graph classifiers may be affected when edges, neighboring nodes, or graph structure are changed\[[21](https://arxiv.org/html/2608.05900#bib.bib21),[22](https://arxiv.org/html/2608.05900#bib.bib22)\]\. These studies demonstrate that a prediction can depend on relational context rather than only on the target node’s features\. However, they do not study single\-cell annotation pipelines, cell\-removal constraints, biological neighborhoods, or label\-refinement systems\. Hence, the effect of companion\-cell removal on an unchanged single\-cell target remains underexplored\.

On the other hand, annotation reliability is especially important for cells with uncertain or ambiguous identities\. Recent work has proposed consensus voting, hierarchical rejection, and training\-dynamics analysis to identify low\-confidence annotations, possible labeling errors, and intermediate cell states\[[23](https://arxiv.org/html/2608.05900#bib.bib23),[24](https://arxiv.org/html/2608.05900#bib.bib24)\]\.

We introduce*CohortHijack*, a robustness audit that removes selected non\-target companion cells and tests whether the target’s refined annotation changes\. Unlike feature\-based attacks, CohortHijack preserves the target expression vector, reference labels, classifier, and model parameters\.

We study random removal, nearest\-neighbor removal, same\-class removal, greedy search, multi\-start greedy search, and beam search\. The controlled experiments use two single\-cell datasets, two frozen classifier families, and three random seeds\. We also vary the neighborhood size, context weight, and voting rule to identify the source of the vulnerability\. Finally, we validate the same threat model using CellTypist majority voting\[[2](https://arxiv.org/html/2608.05900#bib.bib2)\], where the target’s independent prediction remains unchanged while its cohort\-refined label may change after a small fraction of companion cells is removed\. Figure[1](https://arxiv.org/html/2608.05900#S1.F1)illustrates the difference between ordinary cohort\-dependent annotation and the CohortHijack audit\.

![Refer to caption](https://arxiv.org/html/2608.05900v1/x1.png)Figure 1:Overview of the CohortHijack threat model\. Under ordinary annotation, the target cell is classified using its own expression profile and contextual information from the complete query cohort\. CohortHijack removes a small set of non\-target companion cells and recomputes the cohort\-dependent refinement\. The target expression vector, base classifier, and model parameters remain unchanged, but the final refined annotation may change because the neighborhood or clustering context has changed\.Our work makes three contributions\. First, we define companion\-cell removal as a target\-preserving threat to refined single\-cell annotation\. Second, we develop structured and search\-based removal methods and measure both target and collateral changes\. Third, we validate the threat across controlled pipelines and CellTypist majority voting\.111Code and reproduction scripts:[https://github\.com/arashVsh/CohortHijack](https://github.com/arashVsh/CohortHijack)

## IIMethod

This section presents the CohortHijack evaluation framework, including the annotation pipeline, removal strategies, search methods, evaluation measures, and CellTypist validation\. We use*audit*for the overall evaluation protocol and*attack*for a removal set selected to change a target label\.

### II\-AProblem Setup

Let𝒟=\{\(𝐱i,yi\)\}i=1n\\mathcal\{D\}=\\\{\(\\mathbf\{x\}\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{n\}denote a single\-cell dataset containingnncells\. The vector𝐱i∈ℝd\\mathbf\{x\}\_\{i\}\\in\\mathbb\{R\}^\{d\}contains the processed features of cellii, andyi∈𝒴y\_\{i\}\\in\\mathcal\{Y\}is its reference cell\-type label\. The set𝒴\\mathcal\{Y\}contains all cell types retained after preprocessing\. We divide𝒟\\mathcal\{D\}into disjoint training and test sets using a stratified split\. The test set is treated as the query cohort during the robustness audit\.

For a selected target cell indexed bytt, CohortHijack removes a subset𝒮\\mathcal\{S\}of non\-target test cells\. The target is never included in the removal set, sot∉𝒮t\\notin\\mathcal\{S\}\. The attacked query cohort is𝒟𝒮=𝒟test∖𝒮\\mathcal\{D\}\_\{\\mathcal\{S\}\}=\\mathcal\{D\}\_\{\\mathrm\{test\}\}\\setminus\\mathcal\{S\}\. The target feature vector, trained classifier, and base prediction remain unchanged\. Only the cells available to the cohort\-dependent refinement stage are modified\.

### II\-BData Processing and Base Classification

We use the PBMC3K and Paul15 datasets provided through Scanpy\. Classes with insufficient support are removed, and large classes are capped to reduce class imbalance and control runtime\. We then create stratified training and test sets\.

For nonnegative count data, each cell is library\-size normalized and log\-transformed\. Highly variable genes are retained, and the selected features are scaled before dimensionality reduction\. Datasets that are already transformed and contain negative values are not renormalized\. For those datasets, genes are selected according to expression variance\. Principal component analysis is then applied to obtain a lower\-dimensional representation\.

We train multinomial logistic regression and a calibrated linear support vector machine \(SVM\)\. Both classifiers use class balancing\. The linear SVM is calibrated to output class probabilities\.

LetC=\|𝒴\|C=\|\\mathcal\{Y\}\|be the number of retained cell types\. The frozen base classifier produces a probability vector𝐩i=\(pi​1,…,pi​C\)\\mathbf\{p\}\_\{i\}=\(p\_\{i1\},\\ldots,p\_\{iC\}\)for cellii, where∑c=1Cpi​c=1\\sum\_\{c=1\}^\{C\}p\_\{ic\}=1\. Its independent prediction isy^ibase=arg⁡maxc⁡pi​c\\hat\{y\}^\{\\,\\mathrm\{base\}\}\_\{i\}=\\arg\\max\_\{c\}p\_\{ic\}\.

### II\-CCohort\-Dependent Refinement

For each test cell, we construct a Euclidean nearest\-neighbor graph in the PCA feature space\. Let𝒩k​\(i\)\\mathcal\{N\}\_\{k\}\(i\)denote the indices of thekknearest test cells to cellii, excluding the cell itself\.

The confidence of neighborjjis defined asqj=maxc⁡pj​cq\_\{j\}=\\max\_\{c\}p\_\{jc\}\. For confidence\-weighted refinement, the neighborhood support assigned to classccis

hi​c=∑j∈𝒩k​\(i\)qj​pj​c∑j∈𝒩k​\(i\)qj\.h\_\{ic\}=\\frac\{\\sum\_\{j\\in\\mathcal\{N\}\_\{k\}\(i\)\}q\_\{j\}p\_\{jc\}\}\{\\sum\_\{j\\in\\mathcal\{N\}\_\{k\}\(i\)\}q\_\{j\}\}\.\(1\)
For uniform voting, allqjq\_\{j\}values in Eq\. \([1](https://arxiv.org/html/2608.05900#S2.E1)\) are replaced by one\. The base probabilities and neighborhood support are combined as

ri​c=α​pi​c\+λ​hi​c∑ℓ=1C\(α​pi​ℓ\+λ​hi​ℓ\),r\_\{ic\}=\\frac\{\\alpha p\_\{ic\}\+\\lambda h\_\{ic\}\}\{\\sum\_\{\\ell=1\}^\{C\}\\left\(\\alpha p\_\{i\\ell\}\+\\lambda h\_\{i\\ell\}\\right\)\},\(2\)
whereα\\alphais the base\-prediction weight andλ\\lambdais the context weight\. The refined label isy^i=arg⁡maxc⁡ri​c\\hat\{y\}\_\{i\}=\\arg\\max\_\{c\}r\_\{ic\}\.

After removing𝒮\\mathcal\{S\}, the base probability vectors of retained cells are reused without retraining\. The neighbor graph and refined probabilities are recomputed on𝒟𝒮\\mathcal\{D\}\_\{\\mathcal\{S\}\}\. This isolates the effect of query\-cohort composition\.

### II\-DTarget Selection

For each dataset, classifier, and random seed, we first identify test cells whose clean refined prediction is correct\. These cells are ranked by their maximum refined probability\. A candidate set is formed from lower\-confidence correctly annotated cells, after which targets are sampled without replacement\.

This policy focuses the audit on correctly annotated cells that are more likely to depend on cohort context\. The same target manifests are reused in follow\-up searches and ablations so that methods are compared on matched targets\.

### II\-ECompanion\-Cell Removal

For a removal fractionρ\\rho, the requested removal count isb=max⁡\(1,round⁡\(ρ​\(ntest−1\)\)\)b=\\max\(1,\\operatorname\{round\}\(\\rho\(n\_\{\\mathrm\{test\}\}\-1\)\)\), wherentestn\_\{\\mathrm\{test\}\}is the test\-cohort size\.

#### II\-E1Random Removal

The random baseline samplesbbnon\-target cells uniformly without replacement\. Each target\-budget combination is evaluated over repeated random removal sets\.

#### II\-E2Same\-Class Removal

Same\-class removal forms a pool containing non\-target cells whose clean refined label equals the clean refined label of the target\. Up tobbcells are sampled without replacement from this pool\. This method removes cells that support the target’s current class, but it does not use distance from the target\.

#### II\-E3Nearest\-Cell Removal

Nearest\-cell removal computes the Euclidean distance between the target and every other test cell in PCA space\. Thebbclosest non\-target cells are removed\. This method directly changes the target’s local neighborhood\.

### II\-FSearch\-Based Removal

The search methods optimize removals for one target at a time\. Their candidate pool contains the target’s clean first\-order neighbors and the neighbors of those cells\. If needed, this set is supplemented with additional cells selected by distance in PCA space\.

For the target’s clean refined label, letctc\_\{t\}denote its corresponding class index\. We measure its margin after removing𝒮\\mathcal\{S\}asmt​\(𝒮\)=rt​ct\(𝒮\)−maxc≠ct⁡rt​c\(𝒮\)m\_\{t\}\(\\mathcal\{S\}\)=r\_\{tc\_\{t\}\}^\{\(\\mathcal\{S\}\)\}\-\\max\_\{c\\neq c\_\{t\}\}r\_\{tc\}^\{\(\\mathcal\{S\}\)\}, wherert​c\(𝒮\)r\_\{tc\}^\{\(\\mathcal\{S\}\)\}is the refined probability recomputed on𝒟𝒮\\mathcal\{D\}\_\{\\mathcal\{S\}\}\. A negative margin implies that another class has overtaken the original class\.

Candidate removals are ranked lexicographically\. A target flip is preferred over a non\-flip\. Among outcomes with the same flip status, a lower value ofmt​\(𝒮\)m\_\{t\}\(\\mathcal\{S\}\)is preferred, followed by a lower collateral flip rate\.

#### II\-F1Greedy Search

The candidate ordering is divided into non\-overlapping groups\. At each step, every remaining group is temporarily added to the current removal set\. The highest\-ranked outcome is retained, and the selected group is removed from the candidate list\. The process stops after a successful flip, after reaching the search limit, or after exhausting the candidate pool\.

#### II\-F2Multi\-Start Greedy Search

The multi\-start method repeats the greedy procedure under several reproducible candidate orderings\. A successful trajectory is preferred over an unsuccessful one\. Successful trajectories are then ranked by fewer removed cells, lower final target margin, and lower collateral damage\.

#### II\-F3Beam Search

Beam search maintains several partial removal sets at each depth\. Every retained state is expanded using a restricted set of unused candidate groups, after which only the highest\-ranked non\-successful states are kept\. If one or more expansions flip the target, the method returns the successful path with the fewest removed cells and the best final score\.

### II\-GAttack Success and Collateral Changes

Lety^t\(0\)\\hat\{y\}^\{\(0\)\}\_\{t\}be the clean refined label of the target andy^t\(𝒮\)\\hat\{y\}^\{\(\\mathcal\{S\}\)\}\_\{t\}its refined label after removal\. The target\-flip indicator is

At​\(𝒮\)=𝕀​\[y^t\(𝒮\)≠y^t\(0\)\],A\_\{t\}\(\\mathcal\{S\}\)=\\mathbb\{I\}\\left\[\\hat\{y\}^\{\(\\mathcal\{S\}\)\}\_\{t\}\\neq\\hat\{y\}^\{\(0\)\}\_\{t\}\\right\],\(3\)
where𝕀​\[⋅\]\\mathbb\{I\}\[\\cdot\]is one when its condition is true and zero otherwise\. The target flip rate is the mean ofAt​\(𝒮\)A\_\{t\}\(\\mathcal\{S\}\)across evaluated targets\.

To measure unintended effects, we evaluate a subset of retained non\-target cells\. Letℰ𝒮\\mathcal\{E\}\_\{\\mathcal\{S\}\}denote this evaluation set\. The collateral flip rate is

Gt​\(𝒮\)=1\|ℰ𝒮\|​∑i∈ℰ𝒮𝕀​\[y^i\(𝒮\)≠y^i\(0\)\]\.G\_\{t\}\(\\mathcal\{S\}\)=\\frac\{1\}\{\|\\mathcal\{E\}\_\{\\mathcal\{S\}\}\|\}\\sum\_\{i\\in\\mathcal\{E\}\_\{\\mathcal\{S\}\}\}\\mathbb\{I\}\\left\[\\hat\{y\}^\{\(\\mathcal\{S\}\)\}\_\{i\}\\neq\\hat\{y\}^\{\(0\)\}\_\{i\}\\right\]\.\(4\)
We also report the removed fraction, target original\-class probability, target margin, clean accuracy, macro\-F1, and disagreement between base and refined predictions\.

### II\-HMechanism Ablations

We repeat the structured\-removal experiments while changing one refinement setting at a time\. The ablations vary the context weight, neighborhood size, and voting rule\. All ablations reuse the targets selected in the main experiment\.

Whenλ=0\\lambda=0, the model does not use information from neighboring cells\. Therefore, removing companion cells cannot change the target prediction\.

### II\-ICellTypist Validation

We further evaluate the threat model using CellTypist with a pretrained immune cell model and its built\-in majority\-voting procedure\. PBMC3K is stratified by its reference labels and reduced to a manageable query cohort\. Raw counts are normalized and log\-transformed before annotation\.

CellTypist first assigns an independent label to each cell and then performs over\-clustering and cluster\-level majority voting\. We select cells whose independent and majority\-voted labels disagree, as well as cells whose two labels agree\. These groups are referred to as context\-sensitive and initially stable targets, respectively\.

For each target, we remove a small fraction of the remaining cells using random, nearest\-cell, or same\-majority\-label removal\. Nearest cells are identified in a separate PCA space\. After every intervention, CellTypist reconstructs its over\-clustering and majority\-voted annotations\.

The target expression vector is hashed before and after removal, and execution stops if the hashes differ\. We separately record changes in the independent CellTypist label and the majority\-voted label\. This verifies whether a target flip is caused by cohort\-based refinement rather than a change to the target cell or its independent classifier output\.

## IIIResults

This section reports the main removal results, search\-based attacks, mechanism ablations, and CellTypist validation\. Experimental settings are given first, followed by the results for each experiment group\.

### III\-AExperimental Setup

The target expression vector, reference labels, trained classifier, classifier probabilities, and model parameters remain unchanged\. After each intervention, only the neighborhood graph and cohort\-dependent refinement are recomputed\.

We evaluated the controlled pipeline on PBMC3K and Paul15 using multinomial logistic regression and calibrated linear SVM\. Classes with fewer than 30 cells were removed, and each remaining class was limited to 500 cells\. We used a stratified 65–35 training\-test split\. Nonnegative data were normalized to10410^\{4\}counts per cell and log\-transformed\. Up to 1500 genes were retained, followed by scaling and PCA with 40 components\. The main refinement usedk=25k=25, with the base and context weights both set to one\.

Experiments used seeds 13, 37, and 73\. For each dataset, classifier, and seed, we selected 100 correctly annotated lower\-confidence targets, giving 1200 targets in total\. Random, nearest\-cell, and same\-class removal were evaluated at budgets of 0\.5%, 1%, 2%, 5%, and 10%\. Random removal was repeated ten times\.

Search experiments were performed on Paul15\. The candidate pool contained at most 120 cells and used groups of three\. The original greedy search used at most 15 steps\. Search V2 used eight multi\-start trajectories, at most 16 steps, and a maximum removal budget of 5%\. Beam search used width four and expanded each state with up to ten candidate groups\.

The ablations used context weights of 0, 0\.5, 1, and 2, neighborhood sizes of 10, 25, and 50, and both confidence\-weighted and uniform voting\. CellTypist validation used theImmune\_All\_Low\.pklmodel on 1200 PBMC3K cells per seed\. We selected ten context\-sensitive and ten initially stable targets per seed, giving 60 targets\. Random, nearest\-cell, and same\-majority\-label removal were evaluated at 1% and 2% budgets\.

The reported flip rates are measured on correctly annotated, lower\-confidence targets selected for robustness analysis\. Therefore, they should be interpreted as vulnerability rates within this targeted audit set, rather than as estimates over all cells in the dataset\. The same target manifests were reused across removal methods, searches, and ablations to support matched comparisons\.

### III\-BMain Companion\-Cell Removal Results

Figure[2](https://arxiv.org/html/2608.05900#S3.F2)compares the removal strategies at the 5% budget\. Random removal produced low target flip rates in all settings, while structured removal was substantially stronger on Paul15\.

For Paul15 with linear SVM, random removal changed 1\.63% of targets, compared with 11\.33% for nearest\-cell removal and 17\.39% for same\-class removal\. For logistic regression, the corresponding rates were 1\.37%, 9\.33%, and 15\.00%\.

PBMC3K was more stable\. With linear SVM, the flip rates were 0\.37% for random, 4\.67% for nearest\-cell, and 5\.67% for same\-class removal\. With logistic regression, all rates were at or below 1\.33%\.

Paired tests confirmed the Paul15 differences\. For linear SVM, nearest\-cell and same\-class removal exceeded random removal by 9\.70 and 15\.82 percentage points, respectively\. For logistic regression, the corresponding differences were 7\.97 and 13\.63 points\. All four comparisons were statistically significant\. Mean collateral flip rates in the controlled pipeline remained below approximately 1\.1%\.

![Refer to caption](https://arxiv.org/html/2608.05900v1/x2.png)Figure 2:Target flip rates under random, nearest\-cell, and same\-class companion\-cell removal at the 5% budget\. Structured removal is strongest on Paul15, while PBMC3K is more stable\. Results are aggregated across three seeds\.
### III\-CSearch\-Based Removal

The original greedy search changed 18\.0% of Paul15 linear\-SVM targets and 13\.7% of logistic\-regression targets\. Increasing the candidate pool and maximum budget reduced performance, showing that a larger search space does not always improve a myopic greedy method\.

Table[I](https://arxiv.org/html/2608.05900#S3.T1)summarizes the Search V2 results\. Multi\-start greedy changed 24\.33% of linear\-SVM targets and 19\.67% of logistic\-regression targets, while beam search reached 19\.33% and 15\.67%, respectively\.

TABLE I:Search V2 results on Paul15\. Removal and collateral rates are calculated over successful attacks\.Successful multi\-start attacks required a median removal of 0\.64% for linear SVM and 1\.27% for logistic regression\. As shown in Table[I](https://arxiv.org/html/2608.05900#S3.T1), mean collateral flip rates remained below 0\.4%, showing that the selected target could often be changed without broad disruption\.

### III\-DMechanism Ablations

Figure[3](https://arxiv.org/html/2608.05900#S3.F3)shows that no target flips occurred when the context weight was zero\. Vulnerability increased with the contribution of neighboring cells, reaching 31\.77% for linear SVM and 32\.67% for logistic regression at the largest tested weight\. Nearest\-cell removal was stronger with smaller neighborhoods, while same\-class removal remained effective across all tested neighborhood sizes\. Uniform voting also remained vulnerable, showing that the effect does not depend only on confidence weighting\.

![Refer to caption](https://arxiv.org/html/2608.05900v1/x3.png)Figure 3:Effect of context weight on target flip rates for same\-class removal on Paul15\. No flips occur when neighborhood refinement is disabled, while vulnerability increases as more weight is assigned to neighboring cells\.
### III\-ECellTypist Validation

Independent CellTypist predictions remained unchanged in all 840 evaluations, so all target flips were confined to majority voting\.

Table[II](https://arxiv.org/html/2608.05900#S3.T2)summarizes the CellTypist results\. Context\-sensitive targets were substantially more vulnerable than initially stable targets\. At the 1% budget, random removal changed 26\.67% of context\-sensitive targets, while nearest\-cell and same\-majority\-label removal each changed 46\.67%\. At the 2% budget, the corresponding rates were 27\.33%, 40\.0%, and 50\.0%\.

Initially stable targets had much lower flip rates, ranging from 3\.33% to 10\.0%\. At the 2% same\-majority\-label condition, the context\-sensitive group reached 50\.0%, compared with 3\.33% for the initially stable group\.

TABLE II:CellTypist majority\-voted target flip rates\.CellTypist produced mean collateral majority\-label changes of approximately 10%\. Unlike the controlled pipeline, it reconstructs the full neighborhood graph and over\-clustering after each intervention\. Its results therefore show real query\-cohort instability, but not a fully localized attack\.

## IVDiscussion

CohortHijack shows that clean annotation accuracy does not fully describe the reliability of cohort\-dependent pipelines\. A cell may be classified correctly while its final label still depends strongly on the companion cells present in the query cohort\.

The stronger results on Paul15 suggest that this risk is greater when cell populations overlap or lie along biological transitions\. In such settings, local support may have more influence than in datasets with clearly separated cell types\. This may also help explain why class frequency and clean confidence did not consistently predict vulnerability\.

The search results show that cohort manipulation is not monotonic\. Removing more cells or considering a larger candidate pool can produce a weaker result because each intervention changes the neighborhood structure\. Exploring multiple search paths is more useful than relying on one greedy trajectory or a small number of random subsamples\.

The CellTypist experiment also reveals a broader reproducibility issue\. Different filtering decisions can rebuild the graph and over\-clustering, leading to different refined labels even when the retained target cells are unchanged\. Annotation tools should therefore report independent and refined predictions separately and flag cells for which they disagree\.

A practical robustness check is to repeat annotation under several controlled subsamples and report label stability for each cell\. Unstable cells could be assigned a broader lineage label or sent for manual review\. This would provide information that ordinary confidence scores may miss\.

The study is limited to two datasets, two linear classifier families, and one CellTypist model\. Future work should examine other annotation systems and develop refinement methods that preserve the benefits of cohort context while reducing sensitivity to small cohort changes\.

## VConclusion

We introduced CohortHijack, a robustness audit for companion\-cell removal in single\-cell annotation\. Structured and search\-based removals changed selected target labels more often than random removal, while collateral effects remained limited in the controlled pipeline\. The ablations isolated neighborhood refinement as the source of the vulnerability, and CellTypist validation confirmed that the effect also appears in an established annotation tool\. These findings motivate stability testing as a standard part of evaluating single\-cell annotation systems\.

## References

- \[1\]F\. A\. Wolf, P\. Angerer, and F\. J\. Theis, “SCANPY: Large\-scale single\-cell gene expression data analysis,”*Genome Biology*, vol\. 19, no\. 1, p\. 15, 2018\.
- \[2\]C\. D\. Conde, C\. Xu, L\. B\. Jarvis, D\. B\. Rainbow, S\. B\. Wells, T\. Gomes, S\. K\. Howlett, O\. Suchanek, K\. Polanski, H\. W\. King, L\. Mamanova, N\. Huang, P\. A\. Szabo, L\. Richardson, L\. Bolt, E\. S\. Fasouli, K\. T\. Mahbubani, M\. Prete, L\. Tuck, N\. Richoz, Z\. K\. Tuong, L\. Campos, H\. S\. Mousa, E\. J\. Needham, S\. Pritchard, T\. Li, R\. Elmentaite, J\. Park, E\. Rahmani, D\. Chen, D\. K\. Menon, O\. A\. Bayraktar, L\. K\. James, K\. B\. Meyer, N\. Yosef, M\. R\. Clatworthy, P\. A\. Sims, D\. L\. Farber, K\. Saeb\-Parsy, J\. L\. Jones, and S\. A\. Teichmann, “Cross\-tissue immune cell analysis reveals tissue\-specific features in humans,”*Science*, vol\. 376, no\. 6594, p\. eabl5197, 2022\.
- \[3\]T\. Abdelaal, L\. Michielsen, D\. Cats, D\. Hoogduin, H\. Mei, M\. J\. T\. Reinders, and A\. Mahfouz, “A comparison of automatic cell identification methods for single\-cell rna sequencing data,”*Genome Biology*, vol\. 20, no\. 1, p\. 194, 2019\.
- \[4\]V\. Y\. Kiselev, A\. Yiu, and M\. Hemberg, “scmap: Projection of single\-cell RNA\-seq data across data sets,”*Nature Methods*, vol\. 15, no\. 5, pp\. 359–362, 2018\.
- \[5\]A\. W\. Zhang, C\. O’Flanagan, E\. A\. Chavez, J\. L\. P\. Lim, N\. Ceglia, A\. McPherson, M\. Wiens, P\. Walters, T\. Chan, B\. Hewitson, D\. Lai, A\. Mottok, C\. Sarkozy, L\. Chong, T\. Aoki, X\. Wang, A\. P\. Weng, J\. N\. McAlpine, S\. Aparicio, C\. Steidl, K\. R\. Campbell, and S\. P\. Shah, “Probabilistic cell\-type assignment of single\-cell rna\-seq for tumor microenvironment profiling,”*Nature Methods*, vol\. 16, no\. 10, pp\. 1007–1015, 2019\.
- \[6\]C\. Xu, R\. Lopez, E\. Mehlman, J\. Regier, M\. I\. Jordan, and N\. Yosef, “Probabilistic harmonization and annotation of single\-cell transcriptomics data with deep generative models,”*Molecular Systems Biology*, vol\. 17, no\. 1, p\. e9620, 2021\.
- \[7\]M\. Andreatta and S\. J\. Carmona, “Ucell: Robust and scalable single\-cell gene signature scoring,”*Computational and Structural Biotechnology Journal*, vol\. 19, pp\. 3796–3798, 2021\.
- \[8\]C\. Ergen, G\. Xing, C\. Xu, M\. Kim, M\. Jayasuriya, E\. McGeever, A\. Oliveira Pisco, A\. Streets, and N\. Yosef, “Consensus prediction of cell type labels in single\-cell data with popv,”*Nature Genetics*, vol\. 56, no\. 12, pp\. 2731–2738, 2024\.
- \[9\]J\. B\. Kang, A\. Nathan, K\. Weinand, F\. Zhang, N\. Millard, L\. Rumker, D\. B\. Moody, I\. Korsunsky, and S\. Raychaudhuri, “Efficient and precise single\-cell reference atlas mapping with symphony,”*Nature Communications*, vol\. 12, no\. 1, p\. 5890, 2021\.
- \[10\]Q\. Guo, M\. Yuan, L\. Zhang, and M\. Deng, “scplan: a hierarchical computational framework for single transcriptomics data annotation, integration and cell\-type label refinement,”*Briefings in Bioinformatics*, vol\. 25, no\. 4, p\. bbae305, 2024\.
- \[11\]M\. Goyal, G\. Serrano, J\. Argemi, I\. Shomorony, M\. Hernaez, and I\. Ochoa, “Jind: joint integration and discrimination for automated single\-cell annotation,”*Bioinformatics*, vol\. 38, no\. 9, pp\. 2488–2495, 2022\.
- \[12\]A\. Agrawal, S\. Thomann, S\. Basu, and D\. Grün, “Nico identifies extrinsic drivers of cell state modulation by niche covariation analysis,”*Nature Communications*, vol\. 15, no\. 1, p\. 10628, 2024\.
- \[13\]D\. Song, N\. M\. Xi, J\. J\. Li, and L\. Wang, “scsampler: fast diversity\-preserving subsampling of large\-scale single\-cell transcriptomic data,”*Bioinformatics*, vol\. 38, no\. 11, pp\. 3126–3127, 2022\.
- \[14\]L\. Huang, W\. Gong, and D\. Chen, “scvalue: value\-based subsampling of large\-scale single\-cell transcriptomic data for machine and deep learning tasks,”*Briefings in Bioinformatics*, vol\. 26, no\. 3, p\. bbaf279, 2025\.
- \[15\]C\. Szegedy, W\. Zaremba, I\. Sutskever, J\. Bruna, D\. Erhan, I\. Goodfellow, and R\. Fergus, “Intriguing properties of neural networks,”*arXiv preprint arXiv:1312\.6199*, 2013\.
- \[16\]I\. J\. Goodfellow, J\. Shlens, and C\. Szegedy, “Explaining and harnessing adversarial examples,”*arXiv preprint arXiv:1412\.6572*, 2014\.
- \[17\]A\. Vashagh, R\. Razavi\-Far, M\. Meymani, and B\. Biggio, “Recent advances in adversarial attacks on model utility, privacy, and explainability: A comprehensive survey,”*TechRxiv*, 2026\.
- \[18\]M\. Meymani, R\. Razavi\-Far, A\. Vashagh, and B\. Biggio, “Defense against adversarial attacks: Foundations, strategies, and future directions,”*Preprints*, 2026\.
- \[19\]A\. Vashagh and Y\. Vashagh, “Conformalshift: Targeted event reordering against adaptive ecg monitoring,”*arXiv preprint arXiv:2608\.03628*, 2026\.
- \[20\]G\. Fievet, J\. Broséus, D\. Meyre, and S\. Hergalant, “adverscarial: assessing the vulnerability of single\-cell rna\-sequencing classifiers to adversarial attacks,”*Bioinformatics*, vol\. 41, no\. 4, p\. btaf168, 2025\.
- \[21\]H\. Dai, H\. Li, T\. Tian, X\. Huang, L\. Wang, J\. Zhu, and L\. Song, “Adversarial attack on graph structured data,” in*Proceedings of the 35th International Conference on Machine Learning*, vol\. 80, 2018, pp\. 1115–1124\.
- \[22\]D\. Zügner, O\. Borchert, A\. Akbarnejad, and S\. Günnemann, “Adversarial attacks on graph neural networks: Perturbations and their patterns,”*ACM Transactions on Knowledge Discovery from Data \(TKDD\)*, vol\. 14, no\. 5, pp\. 1–31, 2020\.
- \[23\]L\. Theunissen, T\. Mortier, Y\. Saeys, and W\. Waegeman, “Uncertainty\-aware single\-cell annotation with a hierarchical reject option,”*Bioinformatics*, vol\. 40, no\. 3, p\. btae128, 2024\.
- \[24\]J\. Karin, R\. Mintz, B\. Raveh, and M\. Nitzan, “Interpreting single\-cell and spatial omics data using deep neural network training dynamics,”*Nature Computational Science*, vol\. 4, no\. 12, pp\. 941–954, 2024\.