What Do GNNs Learn from Malware Call Graphs? A Multimodal Decomposition Study

Graph neural networks (GNNs) for Android malware detection are increasingly popular, with prior work crediting call graph topology for detection performance. We present a systematic multimodal decomposition on 4,409 Android samples across 16 classes that challenges this assumption. Our central finding: node attributes carry approximately 94% of graph signal—randomizing call graph topology reduces accuracy by only 2.3 percentage points (pp), while randomizing node features causes a 33.3pp drop. A mean-pooling baseline without message passing matches GIN in multimodal fusion (86.1% vs. 85.6%, 10 seeds), and topology share on the 23-class 8,811-sample set is consistently low across GIN (12%), GAT (17%), and GCN (20%), confirming redundancy is architecture-independent. Cross-dataset replication on 8,520 AndroZoo APKs confirms this generalizes: mean-pooling matches GIN exactly (90.3%). XGBoost on static features achieves the highest accuracy (91.0% ± 0.5%); neural gated fusion (85.6%) trades accuracy for per-prediction modality decomposition and superior unknown detection (energy-based AUROC 0.874 vs. XGBoost 0.589). Per-family gate means over 10 seeds order families consistently from static-leaning (IRATA: g=0.81) to graph-leaning (Coper: g=0.43), although seed-level SD is ≈0.09; the gate is corroborated by five independent approaches including mutual information (r=0.75, p=0.005). These findings suggest that for large, sparse attributed graphs, topology is broadly redundant: a Cora citation network comparison (70.7% topology share vs. our 12%) confirms the mechanism is spectral rather than domain-specific, with implications for any GNN system operating on sparse graphs with rich node attributes.