Routing-Aware Explanations for Mixture of Experts Graph Models in Malware Detection

Mixture of Experts offers flexible graph reasoning by combining multiple views of a graph through a learned router. However, existing Graph-MoE approaches do not explicitly account for input-dependent expert routing when generating post-hoc explanations. To address this limitation, we propose a routing-aware explainable MoE framework for malware detection using control flow graphs. The framework introduces diversity at two levels. At the node level, multiple neighborhood statistics are combined using degree reweighting and complementary pooling functions. At the graph level, six experts, each associated with a specific structural and statistical view, produce graph-level predictions that are combined through Top-k routing with load balancing. A routing-aware post-hoc explanation mechanism generates expert-specific edge attributions and aggregates them according to the learned routing weights, thereby aligning the explanation with the experts that contribute to each prediction. Experimental results show that the complete Top-2 MoE achieves an accuracy of 93.49%, compared with 88.67% for the GMoE baseline, corresponding to a 4.82 percentage-point improvement. Perturbation-based evaluation further shows that routing-aware aggregation provides faithful explanations with respect to the model’s predictions across different sparsity levels.