Rethinking Mixture-of-Experts for Vulnerability Detection: An Empirical Study and Improved Design
Deep learning–based vulnerability detection (DLVD) has recently adopted the Mixture-of-Experts (MoE) paradigm to address vulnerability heterogeneity and the long-tailed distribution of Common Weakness Enumeration (CWE) categories. A representative framework, MoEVD, builds CWE-specific experts and a router for expert selection, but its assumptions about expert specialization and routing reliability remain underexplored. We reproduce MoEVD under the same dataset, splits, backbone, and evaluation protocol, and conduct a fine-grained empirical study of expert behavior and routing decisions. We find that CWE-based experts do not consistently develop stable or exclusive specialization, and their effectiveness is highly sensitive to non-target vulnerabilities, while router misassignment is non-negligible and disproportionately routes non-vulnerable samples to a few experts, increasing false positives. These results reveal structural limitations in the original design. Guided by these insights, we relax strict CWE-based expert binding to enable more abstract specialization and replace fixed top-k routing with probability-mass-based top-p selection and an OR-style voting rule. On BigVul, the combined design improves F1 from 0.38 to 0.42 and recall from 0.32 to 0.39 without sacrificing precision, showing that principled adjustments to expert construction and routing can outperform the original MoEVD framework.