Mixture-of-Experts (MoE) offers flexible graph reasoning by combining multiple views of a graph through a learned router. We investigate routing-aware explanations for MoE graph models in malware detection using control flow graphs (CFGs). Our architecture builds diversity at two levels. At the node level, each layer computes multiple neighborhood statistics and fuses them with an MLP, guided by a degree reweighting factor rho and a pooling choice lambda in {mean, std, max}, producing distinct node representations that capture complementary structural cues in CFGs. At the readout level, six experts, each tied to a specific (rho, lambda) view, output graph-level logits that the router weights into a final prediction. Post-hoc explanations are generated with edge-level attributions per expert and aggregated using the router gates so the rationale reflects both what each expert highlights and how strongly it is selected. Evaluated against single-expert GNN baselines such as GCN, GIN, and GAT on the same CFG dataset, the proposed MoE achieves strong detection accuracy while yielding stable, faithful attributions under sparsity-based perturbations. The results indicate that making the router explicit and combining multi-statistic node encoding with expert-level diversity can improve the transparency of MoE decisions for malware analysis.

翻译：专家混合模型通过学习的路由器结合图的多种视图，提供灵活的图推理能力。本研究针对恶意软件检测中基于控制流图的专家混合图模型，探索路由感知的解释方法。我们的架构在两个层面构建多样性：在节点层面，每层计算多种邻域统计量，并通过多层感知机将其融合，同时引入度重加权因子ρ和池化选择λ∈{均值, 标准差, 最大值}作为指导，从而生成能够捕捉控制流图中互补结构特征的不同节点表示；在读出层面，六个专家（每个专家对应特定的(ρ, λ)视图）输出图级逻辑值，由路由器加权后形成最终预测。我们通过为每个专家生成边级归因，并利用路由器门控进行聚合，构建事后解释机制，使得解释依据既能反映各专家关注的重点，又能体现其被选择的权重强度。在与GCN、GIN、GAT等单专家图神经网络基线模型在同一控制流图数据集上的对比实验中，所提出的专家混合模型在保持较高检测精度的同时，在基于稀疏性的扰动下产生了稳定且可信的归因结果。研究表明，显式化路由器设计，并将多统计量节点编码与专家级多样性相结合，能够提升专家混合模型在恶意软件分析中的决策透明度。