Expert-AD: Expert-Driven System Design

• Expert-AD is an umbrella term that defines systems integrating expert knowledge into modular architectures across varied domains such as anomaly detection, Alzheimer’s analysis, and cybersecurity.
• It replaces monolithic models with expert-annotated data, specialized subnetworks, frozen references, and agentic coordinators to enhance model interpretability and performance.
• Benchmark evaluations report improved metrics (e.g., AUROC, F1 score, collision reduction) across applications, confirming the practical benefits of expert-guided system design.

Searching arXiv for the referenced “Expert-AD” papers and closely related works to ground the article in current literature. {"^^^^^^^^8query8 OR title:\8^^^^^^^^"CableInspect-AD\" OR title:\8^^^^^^^^"ExpertAD\" OR title:\8^^^^^^^^"MECAD\" OR title:\8^^^^^^^^"AD-MIR\" OR title:\8^^^^^^^^"ADAgent\" OR title:\8^^^^^^^^"M^^^^8 OR title:\8^^^^AD\"^^^^^^^^8 OR title:\8^^^^^^^^"Reverse Distillation\"","max_results":^^^^8id:(Arodi et al., 2024) OR title:\8query8^^^^,"sort_by":"submittedDate","sort_order":"descending"} {"^^^^^^^^8query8 Active Directory provenance^^^^^^^^8 OR title:\8^^^^^^^^"PRIBOOT\" OR title:\8^^^^^^^^"LLM-AD\" OR title:\8^^^^^^^^"ExpertWeave\" OR title:\8^^^^^^^^"MTMD\" Pinterest","max_results":^^^^8id:(Arodi et al., 2024) OR title:\8query8^^^^,"sort_by":"submittedDate","sort_order":"descending"} “Expert-AD” does not denote a single standardized method in the recent arXiv literature. The cited work instead uses the label across several technically distinct settings in which expert knowledge, expert-specialized modules, or expert coordinators are embedded into systems whose target domain is abbreviated as AD. These settings include anomaly detection, Alzheimer’s disease analysis, advertising and ad ranking, autonomous driving, and Active Directory security. A common thread is the replacement of monolithic modeling with one or more of the following: expert-annotated data, hard- or soft-routed experts, frozen expert references, or agentic coordination over specialized tools (&&&^^^^8query8^^^^&&&, &&&^^^^8 OR title:\8^^^^&&&, &&&^^^^8 OR title:\8^^^^&&&, &&&^^^^8 OR title:\8^^^^&&&, &&&^^^^8 OR title:\8^^^^&&&, &&&^^^^8 OR title:\8^^^^&&&).

^^^^8id:(Arodi et al., 2024) OR title:\8^^^^. Semantic scope and unifying design patterns

The literature suggests that “Expert-AD” functions as an umbrella term rather than a single architecture. In industrial anomaly detection, the emphasis is on expert-grounded supervision: experts define what is anomalous, assign severity grades, and sometimes guide threshold calibration or feature reconstruction (&&&^^^^8query8^^^^&&&). In expert-routed architectures, the emphasis shifts to specialization: different experts handle different object classes, disease stages, tasks, or semantic subfunctions, with routing based on similarity, gates, or domain identity (&&&^^^^8 OR title:\8^^^^&&&, &&&^^^^8 OR title:\8^^^^&&&, &&&^^^^8 OR title:\8^^^^&&&). In agentic systems, “expert” denotes either an explicit expert tool or an LLM-mediated coordinator that reasons over multiple specialized predictors (&&&^^^^8 OR title:\8^^^^&&&, &&&^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^&&&).

AD context	Representative systems	Expert mechanism
Anomaly detection	CableInspect-AD, MECAD, RD-E	Expert annotation, expert memories, frozen expert encoder
Alzheimer’s disease	MPRESERVED_PLACEHOLDER_^^^^8query8^^^^AD, pGPE, ADAgent	MMoE, GP experts, tool coordination
Advertising / ad ranking	AD-MIR, MTMD	Marketing-expert reasoning, domain experts
Autonomous driving	ExpertAD, PRIBOOT	Sparse experts, privileged expert agent
Active Directory	HADES, edge-blocking defense	Provenance reasoning, graph-structured defense

A plausible implication is that “expert” has become a design axis rather than a domain label. Across the cited work, expertise may reside in the data curation process, in the model topology, in the routing logic, or in the orchestration layer that integrates heterogeneous predictors.

^^^^8 OR title:\8^^^^. Expert-grounded anomaly detection benchmarks

The clearest benchmark-oriented use of Expert-AD appears in “CableInspect-AD,” a publicly released industrial visual anomaly detection dataset for robotic power line cable inspection created with Hydro-Québec/IREQ domain experts (&&&^^^^8query8^^^^&&&). The dataset contains ^^^^8 OR title:\8^^^^,^^^^8 OR title:\8^^^^98 images, of which ^^^^8 OR title:\8^^^^,^^^^8 OR title:\8 OR title:\8^^^^9 are anomalous and ^^^^8 OR title:\8^^^^,^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^9 nominal, with ^^^^8id:(Arodi et al., 2024) OR title:\8max_results8 OR title:\8^^^^ unique anomalies and ^^^^8 OR title:\8^^^^,^^^^8query8 OR title:\8 OR title:\8^^^^ anomaly annotations. Acquisition used ^^^^8 OR title:\8^^^^ cables × ^^^^8 OR title:\8^^^^ sides × ^^^^8 OR title:\8^^^^ videos = ^^^^8id:(Arodi et al., 2024) OR title:\88^^^^ videos, recorded at ^^^^8id:(Arodi et al., 2024) OR title:\8max_results8 OR title:\8query8^^^^ × ^^^^8id:(Arodi et al., 2024) OR title:\8query88query8^^^^, RGBA, ^^^^8 OR title:\8query8^^^^ fps, then resampled to ^^^^8id:(Arodi et al., 2024) OR title:\8query8^^^^ fps for annotation. Labels include image-level anomaly status, bounding boxes, anomaly type, anomaly grade, and pixel-level masks for the first recorded video on each cable.

Its importance lies in the fact that the anomaly taxonomy is operational rather than generic. The seven anomaly types are welded strand, broken strand, spaced strand, bent strand, crushed, long scratch, and deposit, each with up to three severity grades. Annotation was performed by at least four experts, under agreed guidelines, with five iterative review rounds until consensus. The paper explicitly notes that older cables can exhibit wear, discoloration, and texture changes that are not anomalies according to experts, so the benchmark embeds domain judgments about what should and should not be detected.

The same work also introduces Enhanced-PatchCore, motivated by the practical difficulty of threshold selection when anomalous validation images are scarce. Standard PatchCore scores an image by the maximum nearest-neighbor distance between test patches and the nominal memory bank, while Enhanced-PatchCore estimates the nominal score distribution directly from the training set by a leave-self-out score,

PRESERVED_PLACEHOLDER_^^^^8id:(Arodi et al., 2024) OR title:\8^^^^

This supports thresholding without anomalous validation data. The evaluation protocol is also realism-driven: there is no validation set, training uses only nominal images, each fold contains ^^^^8id:(Arodi et al., 2024) OR title:\8query8query8^^^^ training images, and folds are generated by defect identifiers with buffers to avoid leakage. On image-level evaluation, Enhanced-PatchCore reports F^^^^8id:(Arodi et al., 2024) OR title:\8^^^^ ^^^^8query8^^^^.^^^^8 OR title:\8 OR title:\8^^^^ ± ^^^^8query8^^^^.^^^^8query8 OR title:\8^^^^, AUPR ^^^^8query8^^^^.8^^^^8 OR title:\8^^^^ ± ^^^^8query8^^^^.^^^^8query8 OR title:\8^^^^, and AUROC ^^^^8query8^^^^.^^^^8 OR title:\88^^^^ ± ^^^^8query8^^^^.^^^^8query8 OR title:\8^^^^; on the cropped segmentation benchmark it reports AUPRO ^^^^8query8^^^^.^^^^8 OR title:\8 OR title:\8^^^^ ± ^^^^8query8^^^^.^^^^8query88. The paper repeatedly emphasizes that subtle anomalies such as spaced strands (light) and long scratches (light) remain difficult, which is precisely the region where expert-defined severity becomes most informative.

^^^^8 OR title:\8^^^^. Expert modules and continual learning in anomaly detection

A second line of Expert-AD work operationalizes expertise as modular specialization. “MECAD” is a continual industrial anomaly detection system in which each expert is an independent PatchCore-style memory bank operating on a shared pretrained WideResNet^^^^8 OR title:\8query8^^^^ feature extractor (&&&^^^^8 OR title:\8^^^^&&&). New classes are introduced sequentially, and class-to-expert assignment is determined by cosine similarity between the class centroid PRESERVED_PLACEHOLDER_^^^^8 OR title:\8^^^^ and each expert centroid PRESERVED_PLACEHOLDER_^^^^8 OR title:\8^^^^,

PRESERVED_PLACEHOLDER_^^^^8 OR title:\8^^^^

with assignment threshold PRESERVED_PLACEHOLDER_^^^^8 OR title:\8^^^^. Replay is expert-specific, memory is budgeted at ^^^^8 OR title:\8query8query8^^^^ samples per class and ^^^^8 OR title:\8 OR title:\8query8query8^^^^ samples per expert, and replay uses a ratio of ^^^^8query8^^^^.^^^^8 OR title:\8^^^^. On MVTec AD, the ^^^^8 OR title:\8^^^^-expert configuration is selected as the best trade-off, achieving average image-level AUROC ^^^^8query8^^^^.8^^^^8 OR title:\8 OR title:\8^^^^9 with forgetting -^^^^8query8^^^^.^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8max_results8 OR title:\8^^^^, compared with ^^^^8query8^^^^.^^^^8 OR title:\8 OR title:\8max_results8 OR title:\8^^^^ AUROC and -^^^^8query8^^^^.^^^^8 OR title:\8 OR title:\8 OR title:\8 OR title:\8^^^^ forgetting for the ^^^^8id:(Arodi et al., 2024) OR title:\8^^^^-expert baseline.

A different interpretation appears in “Unlocking the Potential of Reverse Distillation for Anomaly Detection,” where the expert is not a routed subnetwork but a frozen normal-feature reference (&&&^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^&&&). The proposed Expert-Teacher-Student network extends reverse distillation by adding a frozen expert encoder, identical in architecture to the teacher, to supervise both teacher and student. Teacher–expert discrepancy is trained with synthetic anomaly masks so that teacher features on normal data remain close to expert features, while teacher features on synthetic anomalous regions become separable. Student outputs, for both normal and anomalous inputs, are then driven toward normal teacher/expert features. The paper also introduces Guided Information Injection, which uses higher-level teacher–student similarity to filter lower-level teacher features before injection into the decoder, avoiding direct anomaly leakage while recovering detail.

This design is targeted at two failure modes of vanilla reverse distillation: missed detections from weak anomaly contrast and false positives from poor detail reconstruction. On MVTec AD, RD-E reports P-AUC 99.^^^^8query8^^^^, P-AP ^^^^8 OR title:\8 OR title:\8^^^^.^^^^8 OR title:\8^^^^, and P-PRO 9^^^^8 OR title:\8^^^^.^^^^8 OR title:\8^^^^, improving substantially over RD’s 98.^^^^8query8^^^^ / ^^^^8 OR title:\8id:(Arodi et al., 2024) OR title:\8^^^^.^^^^8query8^^^^ / 9^^^^8 OR title:\8^^^^.^^^^8 OR title:\8^^^^. On MPDD and BTAD it likewise improves pixel-level localization, with averages of 99.^^^^8 OR title:\8^^^^ / ^^^^8 OR title:\8 OR title:\8^^^^.^^^^8 OR title:\8^^^^ / 9^^^^8 OR title:\8^^^^.^^^^8 OR title:\8^^^^ and 98.^^^^8id:(Arodi et al., 2024) OR title:\8^^^^ / ^^^^8 OR title:\8 OR title:\8^^^^.^^^^8 OR title:\8^^^^ / ^^^^8 OR title:\88^^^^.^^^^8 OR title:\8^^^^, respectively. In this variant of Expert-AD, expertise is encoded as a stable representation of normality rather than as a set of class-specific detectors.

^^^^8 OR title:\8^^^^. Alzheimer’s disease analysis

In Alzheimer’s disease, Expert-AD most often refers to expert-routed disease modeling. “MPRESERVED_PLACEHOLDER_^^^^8 OR title:\8^^^^AD” proposes a multi-task multi-gate mixture of experts for structural MRI-based diagnosis and cognitive transition prediction (&&&^^^^8 OR title:\8^^^^&&&). The model uses a hierarchical Swin Transformer V^^^^8 OR title:\8^^^^ backbone with an MMoE block in place of the standard transformer feed-forward stage, and it deploys 8 experts: ^^^^8 OR title:\8^^^^ shared experts, ^^^^8 OR title:\8^^^^ CN-specialized experts, ^^^^8 OR title:\8^^^^ MCI-specialized experts, and ^^^^8 OR title:\8^^^^ AD-specialized experts. Task-specific gates combine them according to

PRESERVED_PLACEHOLDER_^^^^8 OR title:\8^^^^

Training uses a two-stage protocol with SimMIM pretraining and multi-task fine-tuning. Across six datasets comprising ^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^,^^^^8query8 OR title:\8 OR title:\8^^^^ T^^^^8id:(Arodi et al., 2024) OR title:\8^^^^-weighted sMRI scans, the framework reports 9^^^^8 OR title:\8^^^^.^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^% accuracy for three-class NC/MCI/AD classification, 99.^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^% for binary NC/AD classification, and 9^^^^8 OR title:\8^^^^.^^^^8 OR title:\8 OR title:\8^^^^% accuracy for cognitive transition prediction.

A more classical expert ensemble appears in “Meta-Weighted Gaussian Process Experts for Personalized Forecasting of AD Cognitive Changes” (&&&^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^&&&). That system forecasts ADAS-Cog^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^ at ^^^^8 OR title:\8^^^^, ^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^, ^^^^8id:(Arodi et al., 2024) OR title:\88^^^^, and ^^^^8 OR title:\8 OR title:\8^^^^ months using three GP-based roles: a population-level source GP, a domain-adaptive personalized GP, and a target-subject-specific GP. The final prediction is a meta-weighted combination,

$$\hat{\mathbf{y}}^{(g)} = \alpha \mu^{(p)} + (1-\alpha)\mu^{(t)},$$

where $\alpha$ is itself predicted by a GP regressor from meta-features derived from the two experts’ forecasts and the current ADAS-Cog^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^. On a ^^^^8id:(Arodi et al., 2024) OR title:\8query8query8^^^^-subject ADNI/TADPOLE cohort, the proposed pGPE(PRESERVED_PLACEHOLDER_^^^^8id:(Arodi et al., 2024) OR title:\8query8^^^^) achieves average MAE ^^^^8 OR title:\8^^^^.^^^^8 OR title:\8 OR title:\8^^^^, versus ^^^^8 OR title:\8^^^^.^^^^8 OR title:\8 OR title:\8^^^^ for pGP alone and ^^^^8 OR title:\8^^^^.^^^^8 OR title:\8id:(Arodi et al., 2024) OR title:\8^^^^ for simple averaging.

“ADAgent” shifts the concept from routing to orchestration (&&&^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^&&&). It uses GPT-^^^^8 OR title:\8^^^^o as a reasoning engine and collaborative outcome coordinator over four medical tools: multi-modal diagnosis, multi-modal prognosis, MRI-only diagnosis, and PET-only diagnosis. These tools integrate models such as MedicalNet, nnMamba, ResNet variants, MCAD, and CMViM. On ADNI, ADAgent reports ^^^^8query8^^^^.^^^^8 OR title:\8 OR title:\8 OR title:\8^^^^ ± ^^^^8query8^^^^.^^^^8query8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^ accuracy for multi-modal diagnosis, ^^^^8query8^^^^.8^^^^8 OR title:\8 OR title:\8^^^^ ± ^^^^8query8^^^^.^^^^8query8id:(Arodi et al., 2024) OR title:\8query8^^^^ for multi-modal prognosis, ^^^^8query8^^^^.^^^^8 OR title:\8 OR title:\8 OR title:\8^^^^ ± ^^^^8query8^^^^.^^^^8query8query8 OR title:\8^^^^ for MRI-only diagnosis, and ^^^^8query8^^^^.^^^^8 OR title:\8max_results8 OR title:\8^^^^ ± ^^^^8query8^^^^.^^^^8query8 OR title:\8 OR title:\8^^^^ for PET-only diagnosis. Relative to the strongest baselines in the same tables, these correspond to improvements of ^^^^8 OR title:\8^^^^.^^^^8 OR title:\8^^^^ percentage points in multi-modal diagnosis, ^^^^8query8^^^^.^^^^8 OR title:\8^^^^ in multi-modal prognosis, and ^^^^8 OR title:\8^^^^.^^^^8 OR title:\8^^^^ in PET-only diagnosis. Here, Expert-AD means an expert-system-style coordinator rather than an MoE in the narrow neural sense.

^^^^8 OR title:\8^^^^. Advertising, ad ranking, and media understanding

In advertising-video understanding, “AD-MIR” treats the expert mechanism as a structured reasoning prior rather than a fixed model decomposition (&&&^^^^8 OR title:\8^^^^&&&). The system is organized into a Structure-Aware Memory Construction stage and a Structured Reasoning Agent. It preprocesses video into a multimodal database with frames, captions, ASR, OCR, embeddings, and a context-anchored subject registry, then uses tools such as Global Browse, Clip Search, Frame Inspect, and a domain-specific Communication Expert. The latter is prompted to act as an “Elite Advertising Forensics Expert & Visual Semiotics Analyst” and to analyze narrative arcs such as Hook PRESERVED_PLACEHOLDER_^^^^8id:(Arodi et al., 2024) OR title:\8id:(Arodi et al., 2024) OR title:\8^^^^ Problem PRESERVED_PLACEHOLDER_^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^ Product PRESERVED_PLACEHOLDER_^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^ CTA. On AdsQA, the strongest configuration, AD-MIR(o^^^^8id:(Arodi et al., 2024) OR title:\8^^^^), reaches ^^^^8 OR title:\88^^^^.^^^^8id:(Arodi et al., 2024) OR title:\8^^^^ strict accuracy and ^^^^8 OR title:\8query8^^^^.^^^^8query8^^^^ relaxed accuracy, surpassing DVD(o^^^^8id:(Arodi et al., 2024) OR title:\8^^^^) by ^^^^8id:(Arodi et al., 2024) OR title:\8^^^^.8% strict and 9.^^^^8 OR title:\8^^^^% relaxed.

A production-scale version of Expert-AD appears in “MTMD,” Pinterest’s Multi-Task Multi-Domain lightweight ad ranking framework (&&&^^^^8 OR title:\8query8^^^^&&&). MTMD preserves the classic two-tower interface required for low-latency pre-ranking, but each tower contains Domain Experts. The ^^^^^^^^8query8^^^^^^^^ tower is organized by serving surface, the item tower by ad product type, and only a single domain expert is activated for each request at serving time. Within each Domain Expert, the model combines task-specific deep experts, task-specific shallow experts, a task-shared expert, and a domain-shared expert via a routing layer. It also adds a domain adaptation module with per-domain BatchNorm and SE-style feature recalibration. Offline, MTMD improves LogMAE by ^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^% to ^^^^8 OR title:\8 OR title:\8^^^^% across domains and tasks; online, the deployed single model reports overall CTR +^^^^8 OR title:\8^^^^.^^^^8 OR title:\8id:(Arodi et al., 2024) OR title:\8^^^^%, GCTR +^^^^8 OR title:\8^^^^.^^^^8query8 OR title:\8^^^^%, CPC -^^^^8id:(Arodi et al., 2024) OR title:\8^^^^.9^^^^8 OR title:\8^^^^%, and click volume +^^^^8 OR title:\8^^^^.^^^^8 OR title:\8id:(Arodi et al., 2024) OR title:\8^^^^%, while replacing 9 production models.

A related but distinct meaning of AD appears in audio description. “LLM-AD” is not a mixture-of-experts system, but it demonstrates that expert-like Audio Description constraints can be induced at inference time through prompt engineering, subtitle context, and a tracking-based character recognition module (&&&^^^^8 OR title:\8id:(Arodi et al., 2024) OR title:\8^^^^&&&). Using GPT-^^^^8 OR title:\8^^^^V, it achieves CIDEr ^^^^8 OR title:\8query8^^^^.^^^^8 OR title:\8^^^^ on MAD-eval, slightly exceeding AutoAD-II at ^^^^8id:(Arodi et al., 2024) OR title:\8^^^^9.^^^^8 OR title:\8^^^^. This suggests that in some AD settings, expertise is encoded not as separate experts but as structured control over generation style and context.

^^^^8 OR title:\8^^^^. Autonomous driving and Active Directory security

In autonomous driving, “ExpertAD” is a direct MoE retrofit for end-to-end ADS stacks (&&&^^^^8 OR title:\8^^^^&&&). It inserts a Perception Adapter for task-aware channel selection in BEV features and a Mixture of Sparse Experts with eight experts grouped into environmental, ego-state, and navigation experts. Routing is noisy top-PRESERVED_PLACEHOLDER_^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^, and only the selected experts are active in the prediction module. Across UniAD, VAD, and VADv^^^^8 OR title:\8^^^^, the framework reports up to ^^^^8 OR title:\8query8^^^^% reduction in average collision rates and ^^^^8 OR title:\8 OR title:\8^^^^% reduction in inference latency. For example, UniAD’s average collision drops from ^^^^8query8^^^^.^^^^8 OR title:\8id:(Arodi et al., 2024) OR title:\8^^^^ to ^^^^8query8^^^^.^^^^8 OR title:\8 OR title:\8^^^^, latency from ^^^^8 OR title:\8 OR title:\8 OR title:\8^^^^ ± ^^^^8id:(Arodi et al., 2024) OR title:\88^^^^ ms to ^^^^8 OR title:\8 OR title:\8 OR title:\8^^^^ ± ^^^^8 OR title:\8query8^^^^ ms, and Driving Score rises from ^^^^8 OR title:\8 OR title:\8^^^^.^^^^8 OR title:\8 OR title:\8^^^^ to ^^^^8 OR title:\8 OR title:\8^^^^.^^^^8 OR title:\8^^^^9.

“PRIBOOT” uses “expert” in a different driving sense: it is a privileged-information expert agent for CARLA Leaderboard ^^^^8 OR title:\8^^^^.^^^^8query8^^^^, intended primarily to generate high-quality demonstrations rather than to serve as a deployable real-world policy (&&&^^^^8 OR title:\8 OR title:\8^^^^&&&). Its RGB BEV representation, EfficientNet encoder, measurement MLP, and GRU waypoint decoder are trained from limited human logs augmented with simulator state. The paper reports that PRIBOOT is the first model it cites to achieve roughly ^^^^8 OR title:\8 OR title:\8^^^^% Route Completion on Leaderboard ^^^^8 OR title:\8^^^^.^^^^8query8^^^^, together with Driving Score ^^^^8 OR title:\8query8^^^^% and IRS ^^^^8 OR title:\8 OR title:\8^^^^%, making it a data engine for subsequent imitation-learning pipelines.

In cybersecurity, AD denotes Active Directory rather than anomaly detection or advertising. “HADES” addresses AD attacks via whole-network provenance analytics (&&&^^^^8 OR title:\8 OR title:\8^^^^&&&). It combines a stage-^^^^8id:(Arodi et al., 2024) OR title:\8^^^^ authentication anomaly detector with an on-demand stage-^^^^8 OR title:\8^^^^ provenance engine whose key innovation is logon session-based execution partitioning. Cross-machine provenance edges are created only when a specific session on one host is shown, through authentication and logon evidence, to have caused a specific session on another host. On three emulated datasets—APT^^^^8 OR title:\8^^^^9, WizardSpider, and Oilrig—stage ^^^^8id:(Arodi et al., 2024) OR title:\8^^^^ produces ^^^^8 OR title:\8query8^^^^, ^^^^8 OR title:\8 OR title:\8^^^^, and ^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8 OR title:\8^^^^ false positives, respectively, while stage ^^^^8 OR title:\8^^^^ reduces these to ^^^^8query8^^^^, ^^^^8 OR title:\8^^^^, and ^^^^8 OR title:\8^^^^ without introducing false negatives. The graph-level threat score is computed from edge-level tactic evidence and boosted when domain-admin credentials are involved:

PRESERVED_PLACEHOLDER_^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^

Complementing detection, “Scalable Edge Blocking Algorithms for Defending Active Directory Style Attack Graphs” formulates AD defense as a Stackelberg game in which a defender blocks a limited number of edges in an attack graph leading to Domain Admin (&&&^^^^8 OR title:\8^^^^&&&). The paper proves NP-hardness even when the maximum attack path length is constant, then exploits tree-likeness and a new parameter, the number of non-splitting paths, to obtain scalable exact and approximate algorithms. Experimentally, the proposed methods scale to synthetic AD graphs with tens of thousands of nodes. This line of work broadens Expert-AD beyond neural experts: expertise is embedded in graph structure, causal tracing, and defense optimization.

^^^^8 OR title:\8^^^^. Serving and acquiring expertized models

As expert specialization becomes more common, two secondary problems arise: how to serve expert-specialized models efficiently and how to acquire expert knowledge under budget constraints. “ExpertWeave” addresses the first for Expert-Specialized Fine-Tuning on MoE LLMs (&&&^^^^8 OR title:\8 OR title:\8^^^^&&&). Its core idea is to serve many replacement-style expert adapters over one shared MoE backbone via a unified virtual expert tensor and a fused rerouting kernel. On a ^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^B MoE model, it can serve ^^^^8 OR title:\8query8^^^^ adapters with only ^^^^8 OR title:\8^^^^–^^^^8id:(Arodi et al., 2024) OR title:\8id:(Arodi et al., 2024) OR title:\8^^^^% latency overhead relative to the base model alone, provide up to 9^^^^8 OR title:\8^^^^× more KV-cache capacity than merged-model baselines, and achieve up to ^^^^8id:(Arodi et al., 2024) OR title:\88^^^^% higher throughput under skewed multi-tenant demand.

“PU-ADKA” addresses the second problem by reframing domain adaptation as budgeted expert consultation (&&&^^^^8 OR title:\8 OR title:\8^^^^&&&). The setting is a fixed-budget acquisition loop in which the system must decide which question to annotate and which expert to ^^^^^^^^8query8 under heterogeneous expertise, cost, and repeated-use constraints. The method combines positive-unlabeled expert matching with multi-agent reinforcement learning and is evaluated under a repeated \$^^^^8id:(Arodi et al., 2024) OR title:\8query8query8^^^^ budget scenario. On the CKAD benchmark, PU-ADKA reports WR ^^^^8id:(Arodi et al., 2024) OR title:\88^^^^.^^^^8 OR title:\8^^^^ and LC_WR ^^^^8 OR title:\8 OR title:\8^^^^.^^^^8 OR title:\8^^^^ with a GPT-^^^^8 OR title:\8^^^^o judge, outperforming all baselines, and retains gains in human-involved experiments. In this broader sense, Expert-AD becomes a resource-allocation problem: expertise is valuable, partial, and costly, so acquisition itself must be optimized.

Taken together, these systems suggest a broader trajectory for Expert-AD. The literature points toward architectures in which expertise is explicitly represented, whether as curated taxonomies, routed subnetworks, privileged expert references, structured memory, or human-in-the-loop consultation. It also suggests that the main unresolved issues are no longer just predictive accuracy. Recurring bottlenecks include threshold calibration under scarce anomalies, interpretability of routing or coordination decisions, cross-domain transfer, deployment latency, and the operational cost of obtaining or serving expert knowledge (&&&^^^^8query8^^^^&&&, &&&^^^^8id:(Arodi et al., 2024) OR title:\8 OR title:\8^^^^&&&, &&&^^^^8 OR title:\8query8^^^^&&&, &&&^^^^8 OR title:\8 OR title:\8^^^^&&&).