## 4 Evaluation and Results
### Explainable AI Visualization  
To explore the interpretability of YoloMal-XAI, we present visualizations of the explanations provided by various XAI heatmap methods across malware categories, along with a quantitative comparison of their performance. Figure 10 presents a comparative visualization of heatmaps generated by GradCAM, GradCAM++, EigenCAM, and HiResCAM for YOLO11n across five malware categories \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Predicted Class** & **Count** & **Average Confidence** \\ \hline Benign & 515 & 0.979 \\ SMS & 197 & 0.923 \\ Adware & 188 & 0.827 \\ Riskware & 53 & 0.648 \\ Banking & 47 & 0.610 \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Prediction distribution and average confidence of YOLO11n on the merged cross-corpus dataset (Drebin + CICAndMal2017). \begin{table}
\begin{tabular}{l c c c} \hline \hline
**Model** & **Accuracy (\%)** & **Precision (\%)** & **Recall (\%)** & **F1 Score (\%)** \\ \hline YOLO11n & 99.30 & 98.62 & 100.00 & 99.30 \\ YOLO11s & 99.10 & 98.23 & 100.00 & 99.11 \\ YOLO11m & 99.00 & 98.61 & 99.40 & 99.00 \\ YOLO11l & 99.10 & 99.60 & 98.60 & 99.10 \\ YOLO11x & 100.0 & 100.0 & 100.0 & 100.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Binary classification performance of YOLO11 variants on cross-corpus validation set. The heatmaps illustrate distinct attention patterns, showcasing how each XAI technique identifies critical regions for classification. GradCAM and GradCAM++ produce broad, diffuse activations with red-to-yellow gradients--especially prominent in SMS and Banking--indicating attention to dominant clusters such as repetitive bytecode sequences. EigenCAM emphasizes more structured vertical patterns, particularly in Adware, which may correspond to sequential permission declarations in the Manifest. HiResCAM of  
Figure 10: Comparison of heatmap methods across malware categories. Color intensity indicates attention strength: critical (red), high (orange), medium (yellow), and low (blue). fers the most spatially precise maps, with sharper focus regions in Riskware, suggesting localized feature interactions that are crucial for detection. Benign samples reveal compact attention zones, likely due to their simpler and more uniform structure, while Riskware and SMS exhibit more widespread activations, reflecting their structural complexity. The RGB encoding further aids interpretation: red (DEX) consistently dominates in SMS and Riskware, green (Manifest) stands out in Adware, and blue (Resources) becomes most relevant in Banking. These patterns confirm the DEX segment as the most influential component across categories, with Manifest and Resources playing complementary roles depending on malware type. To quantify these visual insights, Table 16 evaluates the heatmap methods across six interpretability metrics: faithfulness, flipping, localization accuracy, robustness, sparsity, and runtime efficiency. HiResCAM stands out with the highest localization accuracy (0.8447) and runtime efficiency (0.1039_s_), aligning with its refined focus on Riskware, while GradCAM++ achieves the highest sparsity (0.9998), supporting its concentrated attention in categories like Banking, though its faithfulness (0.3069) is lower than GradCAM's (0.3733), which offers reliable feature attribution across SMS and other categories. EigenCAM, despite strong localization accuracy (0.8100) in Adware, shows the lowest faithfulness (0.2255) and robustness (0.8597), suggesting potential limitations in diverse scenarios. These quantitative results complement the visual patterns, reinforcing HiResCAM and GradCAM as optimal choices for enhancing YoloMal-XAI's interpretability and supporting its high classification accuracy (99.56% multi-class). Collectively, these findings confirm that the DEX file is the primary component harboring malware features, as evidenced by the consistent dominance of the red channel across categories like SMS and Riskware, aligning with YOLO11n's effectiveness in detecting code-driven malicious behaviors in Android applications.