On-policy distillation (OPD) trains a student on its own responses using token-level feedback from a teacher. As responses grow longer, the student's prefix can depart from the teacher's own reasoning, weakening its feedback on later tokens. Updates based on this feedback can reinforce the same deviations in later responses and destabilize training. Prior approaches such as length control and loss reweighting limit learning from problematic responses but leave their prefixes unchanged. Fixed cutoffs can also discard later reasoning. We propose \textbf{Adaptive Teacher Intervention for On-Policy Distillation (ATI-OPD)} to improve subsequent teacher guidance by revising the student's reasoning prefix. ATI-OPD replaces the earliest high-disagreement segment with a short teacher segment, then lets the student resume its own reasoning from the revised text. To handle renewed disagreement, it excludes persistently divergent suffixes from the distillation loss while retaining useful student continuation. Training diagnostics show less teacher-student disagreement, fewer gradient spikes, and fewer extremely long responses. Across five mathematical reasoning benchmarks and two teacher-student pairs, ATI-OPD improves average student-only accuracy over standard OPD.
Mingzhe Lu, Jian Qin, Ruize Qin, Jinhao Liu, Yunpeng Li, Hang Su
Narrative-driven recommendation allows users to express multifaceted needs through free-form text where stated preferences naturally qualify and condition one another. Existing methods typically treat narratives as flat keyword combinations or unconstrained generative queries, failing to capture how complex preferences hierarchically refine and contextualize each other. We propose the Preference Dependency Graph Framework (PDG-F), a narrative-driven recommendation framework centered on explicit preference dependencies. Specifically, PDG-A (PDG-Agent) first parses unstructured requests to organize user preferences and their mutual qualifications into a directed acyclic Preference Dependency Graph (PDG). Through this graph, candidate evidence from the open Web is acquired via directed path retrieval, and final recommendations are determined by topological path ranking. Comprehensive experiments across three diverse domains spanning English and Chinese contexts confirm that PDG-F consistently achieves superior recommendation performance over competitive baselines, open-domain retrieval agents, and frontier language models. Further diagnostic analyses show that our dependency-guided retrieval markedly raises the attainable candidate-pool ceiling, demonstrating the fundamental value of modeling preference dependencies in narrative-driven recommendation.
Command-and-control, data transfer, and censorship circumvention can hide in traffic to widely used services. DNS-bound access control grants permits based on resolved IP addresses, while shared edges route requests by tenant identity, creating a validation gap. An attacker can resolve an allowed anchor, obtain a permit for its shared edge address, and access a hidden tenant by presenting the tenant's name as both SNI and HTTP Host. To investigate this gap, we present the Domain Decoupling Attack (DDA), which exploits this gap in CDN and non-CDN hosting while preserving SNI--Host consistency. Across 1,069,048 domains, we conduct 18,025,068 successful probes. Overall, 95.8% of domains accept an external SNI, and 84.6% return content matching the named tenant. Exposure reaches 99.26% across 506,763 CDN domains and 92.75% across 562,285 non-CDN domains. The co-location graph places 666,413 exposed domains in cross-tenant components; 97.7% of 54,069 cross-tenant non-CDN addresses have a confirmed path to another tenant. None of the tested defenses bind tenant identity to the DNS-approved name. Cleartext inline IPS can block access based on SNI, but Encrypted Client Hello (ECH) hides it. The Windows Zero Trust DNS (ZTDNS) permit remains reusable in both cases, enabling the concealment of command-and-control and data-exfiltration traffic and facilitating censorship circumvention. The risk conceals command-and-control and data-exfiltration traffic and supports censorship.