## 5 Discussion  
YoloMal-XAI exhibits strong potential for practical Android malware detection by combining accuracy, generalizability, efficiency, and interpretability. Across binary and multi-class tasks, YOLO11 variants consistently outperform baseline CNNs (e.g., ResNet-50, MobileNetV2), and deliver up to 3.5\(\times\) faster training compared to YOLOv8--underscoring their computational advantage for resource-limited environments. Unlike earlier CNN-based approaches that relied heavily on grayscale representations of DEX bytecode [19; 28], YoloMal-XAI's RGB multi-component approach achieves higher accuracy (99.87% binary, 99.56% multi-class) and enhances interpretability, surpassing grayscale-based methods.  
Ablation studies highlight the complementary contributions of DEX, Manifest, and Resources components. While DEX alone captures executable behavior effectively [15; 17], integrating all three into an RGB image yields the best performance, similar to multi-component fusion approaches [20]. This multi-view representation enhances robustness and reflects real-world complexity across different malware types.  
\begin{table}
\begin{tabular}{l c c c c c c} \hline \hline
**Heatmap Method** & **Faithfulness** & **Flipping** & \
\begin{tabular}{c} **Localization** \\ **Accuracy** \\ \end{tabular} & **Robustness** & **Sparsity** &
\begin{tabular}{c} **Runtime** \\ **Efficiency (s)** \\ \end{tabular} \\ \hline GradCAM & 0.3733 & 0.2683 & 0.7800 & 0.9023 & 0.9617 & 0.1301 \\ GradCAM++ & 0.3069 & 0.2662 & 0.7717 & 0.8878 & 0.9998 & 0.1644 \\ EigenCAM & 0.2255 & 0.5452 & 0.8100 & 0.8597 & 0.5219 & 0.1569 \\ HiResCAM & 0.3013 & 0.2859 & 0.8447 & 0.8902 & 0.9258 & 0.1039 \\ \hline \hline \end{tabular}
\end{table}
Table 16: Quantitative interpretability metrics of heatmap methods in YoloMal-XAI.  
Cross-corpus validation using Drebin and CICAndMal2017 confirms that YOLO11 generalizes well to unseen samples, achieving up to 100% accuracy without retraining. This demonstrates resilience against dataset-specific overfitting and strengthens confidence in deployment scenarios involving diverse app ecosystems. This outperforms models like TuneDroid [17] and DTDroid [18], which rely on single-feature or runtime behavior analysis.  
Interpretability analyses using Grad-CAM variants and HiResCAM show that DEX content (red channel) predominantly drives predictions, particularly for SMS and Riskware. Manifest (green) and Resources (blue) contribute more to Adware and Banking malware, respectively. While Grad-CAM has been previously applied to RGB malware images [24], HiResCAM achieved the highest localization IoU (0.8447), confirming its value for forensic analysis and decision transparency.  
Although lightweight models such as YOLO11n (1.6 M parameters) show strong potential for mobile deployment, their practical integration into Android environments necessitates further evaluation--particularly regarding inference latency, memory footprint, and resilience to obfuscation or encryption. These aspects are left for future exploration.  
Security-wise, adversarial manipulation is a critical challenge. Byte-level perturbations could mislead predictions or disrupt explanations. Although robustness was not explored here, it is a key priority for future work, including adversarial training and defense-aware architectures. Explainability further supports ethical deployment by increasing transparency and minimizing unintended harm from misclassification.  
Despite promising results, the primary dataset (CICMalDroid2020) may not fully reflect malware diversity. Although cross-corpus testing mitigates this limitation, broader validation across larger and more heterogeneous datasets is needed.  
In future work, we will enhance YoloMal-XAI's adversarial robustness, analyze interpretability under attack conditions, and investigate on-device deployment. We also plan to expand evaluation to large-scale, multi-family malware datasets to better assess scalability and real-world readiness.