The Chinese University of Hong Kong (CUHK) PhD
Tsinghua University Master
Zhipu AI (Z.ai), China
Shanghai Artificial Intelligence Laboratory, ChinaI am now a Ph.D. candidate at The Chinese University of Hong Kong, focusing on the research and development of physical AI systems. As a participant of Tsinghua University’s National School of Excellence in Engineering, my research previously covered large‑scale models including LLMs and VLMs as well as unsupervised anomaly detection.
I previously worked as a GLM‑4 Pretraining Algorithm Research Assistant at Zhipu AI, where I improved the model’s mathematical reasoning capability via advanced techniques such as Chain‑of‑Thought (CoT). I have also participated in the development of state‑of‑the‑art algorithms including Qwen and DeepSeek. Beyond fundamental algorithm research, I lead a technical team for the National Key Research and Development Program (NKRDP), building forecasting models to support strategic decision‑making for China’s dual‑carbon objectives. During my tenure at the Shanghai Artificial Intelligence Laboratory , I achieved a 90‑% compression rate for the ViT visual model framework while preserving model accuracy. I also conducted research on AI‑powered anomaly‑detection algorithms at Pengcheng National Laboratory, and supported building‑system energy‑consumption optimization with digital‑twin technologies at Mercedes‑Benz Group .
Complementing my academic track record, I bring solid entrepreneurial experience. I co‑founded Nanjing Zhuyu Information Technology Co., Ltd., and took charge of multiple software‑development projects, accumulating hands‑on expertise in big‑data processing, algorithm optimization and industry‑market insights. My practice of translating academic research into real‑world deployable systems has shaped my goal of building practical, user‑centric AI solutions. I perform well under high‑pressure scenarios, excel at multi‑task management, and value cross‑team collaboration to deliver technological innovation. My personal interests include travelling, sports and reading.
") does not match the recommended repository name for your site ("").
", so that your site can be accessed directly at "http://".
However, if the current repository name is intended, you can ignore this message by removing "{% include widgets/debug_repo_name.html %}" in index.html.
",
which does not match the baseurl ("") configured in _config.yml.
baseurl in _config.yml to "".

Ruoyu Li *-, Yu Zhang *, Qing Li, Nengwu Wu, Yong Jiang, Weizhi Meng, Laizhong Cui (* equal contribution)
IEEE Transactions on Dependable and Secure Computing 2026 Received
Ano2Rule is a global interpretability method for unsupervised anomaly detection, which solves the opacity problem of black-box models through rule extraction. The method includes two core components: the internal clustering tree (IC-Tree) for decomposing complex data distributions into multiple sub-distributions, and the combined boundary exploration algorithm (CBE) for precisely inferring the decision boundaries of each sub-distribution. Experiments show that Ano2Rule has higher fidelity and robustness on real datasets such as network intrusion detection and Internet of Things security compared to baseline methods, while also supporting extended functions such as local interpretability and counterfactual explanations.
[IEEE Transactions on Dependable and Secure Computing] [PDF]
Ruoyu Li *-, Yu Zhang *, Qing Li, Nengwu Wu, Yong Jiang, Weizhi Meng, Laizhong Cui (* equal contribution)
IEEE Transactions on Dependable and Secure Computing 2026 Received
Ano2Rule is a global interpretability method for unsupervised anomaly detection, which solves the opacity problem of black-box models through rule extraction. The method includes two core components: the internal clustering tree (IC-Tree) for decomposing complex data distributions into multiple sub-distributions, and the combined boundary exploration algorithm (CBE) for precisely inferring the decision boundaries of each sub-distribution. Experiments show that Ano2Rule has higher fidelity and robustness on real datasets such as network intrusion detection and Internet of Things security compared to baseline methods, while also supporting extended functions such as local interpretability and counterfactual explanations.
[IEEE Transactions on Dependable and Secure Computing] [PDF]

Yu Zhang, Changsong Lei
(arXiv) 2025 On Process
RM-PoT, a three-stage framework that integrates problem reformulation (RM), code-aided reasoning (PoT), and domain-aware few-shot learning to address these limitations. Our approach first reformulates the input problem into diverse surface forms to reduce structural bias, then retrieves five semantically aligned examples from a pre-constructed domain-specific question bank to provide contextual guidance, and finally generates executable Python code for precise computation.
Yu Zhang, Changsong Lei
(arXiv) 2025 On Process
RM-PoT, a three-stage framework that integrates problem reformulation (RM), code-aided reasoning (PoT), and domain-aware few-shot learning to address these limitations. Our approach first reformulates the input problem into diverse surface forms to reduce structural bias, then retrieves five semantically aligned examples from a pre-constructed domain-specific question bank to provide contextual guidance, and finally generates executable Python code for precise computation.

Yu Zhang, Ruoyu Li, Nengwu Wu, Qing Li, Xinhan Lin, Yang Hu, Tao Li, Yong Jiang
(NeurIPS) 2024 NeurIPS
This paper introduces the Segmentation Clustering Decision Tree (SCD-Tree) for interpretable rule-based explanations in unsupervised anomaly detection. The SCD-Tree dissects black-box models by clustering normal data distributions, integrating anomaly detection insights to enhance segmentation. The Gaussian Boundary Delineation (GBD) algorithm then refines these clusters, distinguishing normal from anomalous data with resilience to data drift. This method transforms complex anomaly detection into interpretable rules, demonstrated to improve explanation accuracy and robustness across various datasets, which is crucial for high-stakes fields such as network and IoT security.
Yu Zhang, Ruoyu Li, Nengwu Wu, Qing Li, Xinhan Lin, Yang Hu, Tao Li, Yong Jiang
(NeurIPS) 2024 NeurIPS
This paper introduces the Segmentation Clustering Decision Tree (SCD-Tree) for interpretable rule-based explanations in unsupervised anomaly detection. The SCD-Tree dissects black-box models by clustering normal data distributions, integrating anomaly detection insights to enhance segmentation. The Gaussian Boundary Delineation (GBD) algorithm then refines these clusters, distinguishing normal from anomalous data with resilience to data drift. This method transforms complex anomaly detection into interpretable rules, demonstrated to improve explanation accuracy and robustness across various datasets, which is crucial for high-stakes fields such as network and IoT security.

Ruoyu Li, Qing Li#, Yu Zhang, Dan Zhao, Xi Xiao, Yong Jiang (# corresponding author)
IEEE INFOCOM 2024 - IEEE Conference on Computer Communications 2024 IEEE INFOCOM
Genos is an unsupervised anomaly-based network intrusion detection framework utilizing programmable switches for high-throughput, in-network deployment. Unlike existing solutions, Genos leverages rule extraction for model-agnostic detection, featuring a Model Compiler, Model Interpreter, and Model Debugger to enhance interpretability and maintainability. Through a tree-based clustering and divide-and-conquer approach, Genos partitions feature space into subspaces for accurate boundary estimation and reduces updating overhead by selectively fine-tuning affected subspaces. Evaluation on physical hardware shows its capabilities of achieving 100 Gbps throughput, high interpretability, and minimal maintenance costs.
Ruoyu Li, Qing Li#, Yu Zhang, Dan Zhao, Xi Xiao, Yong Jiang (# corresponding author)
IEEE INFOCOM 2024 - IEEE Conference on Computer Communications 2024 IEEE INFOCOM
Genos is an unsupervised anomaly-based network intrusion detection framework utilizing programmable switches for high-throughput, in-network deployment. Unlike existing solutions, Genos leverages rule extraction for model-agnostic detection, featuring a Model Compiler, Model Interpreter, and Model Debugger to enhance interpretability and maintainability. Through a tree-based clustering and divide-and-conquer approach, Genos partitions feature space into subspaces for accurate boundary estimation and reduces updating overhead by selectively fine-tuning affected subspaces. Evaluation on physical hardware shows its capabilities of achieving 100 Gbps throughput, high interpretability, and minimal maintenance costs.

Ruoyu Li, Qing Li#, Yu Zhang, Dan Zhao, Yong Jiang, Yong Yang (# corresponding author)
(NeurIPS) 2023 NeurIPS
This paper introduces a post-hoc interpretability method for unsupervised anomaly detection in security by leveraging rule extraction. We propose distribution decomposition rules using an Interior Clustering Tree and Compositional Boundary Exploration (CBE) algorithm to decompose normal data distributions and approximate model decision boundaries. This approach provides interpretable explanations for anomaly detection models and allows the creation of a rule-based surrogate model for deployment. Experimental results across multiple datasets demonstrate that our method enhances model fidelity, correctness, and robustness, outperforming existing interpretability techniques in unsupervised anomaly detection.
Ruoyu Li, Qing Li#, Yu Zhang, Dan Zhao, Yong Jiang, Yong Yang (# corresponding author)
(NeurIPS) 2023 NeurIPS
This paper introduces a post-hoc interpretability method for unsupervised anomaly detection in security by leveraging rule extraction. We propose distribution decomposition rules using an Interior Clustering Tree and Compositional Boundary Exploration (CBE) algorithm to decompose normal data distributions and approximate model decision boundaries. This approach provides interpretable explanations for anomaly detection models and allows the creation of a rule-based surrogate model for deployment. Experimental results across multiple datasets demonstrate that our method enhances model fidelity, correctness, and robustness, outperforming existing interpretability techniques in unsupervised anomaly detection.