Vulnerabilities of five scRNA-seq classifiers to single-gene and max-change adversarial attacks. After a training step on the PBMC3k training set, five modification types are sequentially applied on the nine cell types of the test set. Heatmaps reporting (A) the number of successful single-gene attacks (lower is better), and (B) the signature length of max-change attacks (higher is better) by classifier, cell type and modification type. For single-gene, counts > 0 point out vulnerabilities, while classifiers are considered robust to max-change attacks with high counts. (C) Boxplots summarizing the impact of each modification (sum over each cell type) for both attack modes, by classifier. Data are represented in log10 scale.