Image recognition model training method and device, electronic equipment and medium

Abstract

The application discloses a kind of training method, device, electronic equipment and medium of image recognition model, belong to artificial intelligence field.The method comprises: first test sample set is input to image recognition model, the image recognition model is based on first training sample set Training obtains, at least with one first target sample after image processing is included in first training sample set, image processing includes at least one of following: data enhancement processing, countermeasure processing;M first image classification results corresponding to M test samples in first test sample set are output;In the case where the number of first image classification result meeting first condition in M first image classification result is less than N, adjust the image processing parameter corresponding to first target sample, to obtain second training sample set;Image recognition model is trained based on second training sample set, and target image recognition model is obtained;Wherein, first condition includes: the classification confidence corresponding to first image classification result is greater than predetermined threshold.

Description

Technical Field

[0001] This application belongs to the field of artificial intelligence, and specifically relates to a training method, apparatus, electronic device and medium for an image recognition model. Background Technology

[0002] In the rapid development of the Internet, hundreds of millions of images are generated every day. These images may contain various sensitive information and are considered high-risk sensitive samples. If there is no review process for these images, these high-risk sensitive samples containing sensitive information will flow into the platform, causing a poor user experience and serious negative impacts.

[0003] In related technologies, image content review services in content review platforms mainly refer to using image recognition models to detect image content and accurately identify whether there is sensitive information in the image, thereby effectively helping businesses avoid such risks.

[0004] However, the image recognition models in the current review platform have limited defense capabilities and weak generalization ability, resulting in insufficient classification accuracy and failing to meet users' requirements for the accuracy of image recognition models. Summary of the Invention

[0005] The purpose of this application is to provide a training method, apparatus, electronic device, and medium for an image recognition model, which can solve the problem that image recognition models have limited defensive capabilities and weak generalization capabilities, resulting in insufficient classification accuracy.

[0006] In a first aspect, embodiments of this application provide a training method for an image recognition model. The training method includes: inputting a first test sample set into the image recognition model, wherein the image recognition model is trained based on a first training sample set, the first training sample set containing at least one first target sample after image processing, the image processing including at least one of the following: data augmentation processing, adversarial processing; outputting M first image classification results corresponding to M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; if the number of first image classification results satisfying a first condition among the M first image classification results is less than N, adjusting the image processing parameters corresponding to the first target sample to obtain a second training sample set; training the image recognition model based on the second training sample set to obtain a target image recognition model; wherein the first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, M and N are both integers greater than 1; the classification confidence is used to characterize the classification corresponding to the first image classification result.

[0007] Secondly, embodiments of this application provide a training apparatus for an image recognition model, comprising: a processing module and an update module; the processing module is configured to input a first test sample set into the image recognition model, wherein the image recognition model is trained based on the first training sample set, the first training sample set containing at least one first target sample after image processing, the image processing including at least one of the following: data augmentation processing, adversarial processing; the processing module 701 is further configured to output M first image classification results corresponding to M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; the processing module 701 is further configured to adjust the image processing parameters corresponding to the first target sample to obtain a second training sample set when the number of first image classification results satisfying a first condition among the M first image classification results is less than N; the processing module 701 is further configured to train the image recognition model based on the second training sample set to obtain a target image recognition model; wherein the first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, M and N are both integers greater than 1; the classification confidence is used to characterize the classification corresponding to the first image classification result.

[0008] Thirdly, embodiments of this application provide an electronic device including a processor and a memory, wherein the memory stores programs or instructions executable on the processor, and the programs or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0009] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0010] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the method as described in the first aspect.

[0011] In a sixth aspect, embodiments of this application provide a computer program product stored in a storage medium, which is executed by at least one processor to implement the method described in the first aspect.

[0012] In this embodiment, a first test sample set is input into an image recognition model, which is trained based on a first training sample set. The first training sample set contains at least one first target sample after image processing. The image processing includes at least one of the following: data augmentation processing and adversarial processing. M first image classification results corresponding to M test samples in the first test sample set are output, where each test sample corresponds to one first image classification result. If the number of first image classification results satisfying a first condition among the M first image classification results is less than N, the image processing parameters corresponding to the first target sample are adjusted to obtain a second training sample set. The image recognition model is trained based on the second training sample set to obtain a target image recognition model. The first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, where M and N are both integers greater than 1. The classification confidence is used to characterize the classification corresponding to the first image classification result. Thus, by training the image recognition model with samples processed in different ways, the defensive capability of the trained image recognition model is improved. Furthermore, by updating the image processing parameters and retraining the image recognition model with the updated training sample set, the accuracy of the image classification results of the image recognition model is improved. Attached Figure Description

[0013] Figure 1 This is one of the flowcharts illustrating a training method for an image recognition model provided in an embodiment of this application;

[0014] Figure 2 This is a second schematic flowchart of a training method for an image recognition model provided in an embodiment of this application;

[0015] Figure 3 This is one of the structural schematic diagrams of a training device for an image recognition model provided in an embodiment of this application;

[0016] Figure 4 This is a second schematic diagram of the structure of a training device for an image recognition model provided in an embodiment of this application;

[0017] Figure 5 This is one of the hardware structure diagrams of an electronic device provided in the embodiments of this application;

[0018] Figure 6 This is a second schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0021] The following explains some concepts and / or terms involved in the training methods, apparatuses, electronic devices and media of the image recognition models provided in the embodiments of this application.

[0022] 1) Data augmentation: This refers to performing operations on samples in the dataset during the preprocessing stage, such as random rotation, scaling, cropping, and other geometric transformations of the image; adjusting parameters such as contrast, saturation, and sharpness of the image; and adding appropriate noise to the image to make it blurry. After the above operations, data augmented samples are formed.

[0023] 2) Adversarial Training: Adversarial training is an important way to enhance the robustness of neural networks. During adversarial training, samples are mixed with some small perturbations, and then the neural network adapts to these changes, thus becoming robust to adversarial examples.

[0024] 3) Adversarial examples: These are examples obtained by adding tiny perturbations that are imperceptible to the human eye to the original samples, causing the model to make a misjudgment, which is called an adversarial attack.

[0025] The training method, apparatus, electronic device, and medium of the image recognition model provided in this application will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.

[0026] In the rapid development of the Internet, hundreds of millions of images are generated every day. These images may contain various sensitive information and are considered high-risk sensitive samples. If there is no review process for these images, these high-risk sensitive samples containing sensitive information will flow into the platform, causing a poor user experience and serious negative impacts.

[0027] In related technologies, image content review services in content review platforms mainly refer to using image recognition models to detect image content and accurately identify whether there is sensitive information in the image, thereby effectively helping businesses avoid such risks.

[0028] Currently, attackers employ the following two methods to bypass image content moderation services:

[0029] 1. Adding subtle perturbations to the original image to generate adversarial examples. These adversarial perturbations are difficult for humans to detect. For example, adversarial examples can be generated on a sensitive image using an adversarial generation algorithm. After adding adversarial perturbations, the original sample is indistinguishable from the original sample to the human eye. However, the sample can bypass the review platform and be misjudged as a normal image.

[0030] 2. By augmenting the original image through methods such as rotation and color adjustment, data augmentation can bypass the review platform. For example, in user reviews of a certain app, images containing sensitive information often appear that successfully bypass the review platform. These images are only rotated 180 degrees compared to the original image, and to the human eye, they can still be identified as containing sensitive information. It should be noted that since these images do not require the use of adversarial algorithms to generate, they are not considered adversarial examples. Furthermore, compared to the generation process of adversarial examples, the generation of data augmentation examples is simpler, more effective, and lower in cost, and can be done without the need for professional attackers.

[0031] To counter the two attack methods mentioned above, the image content moderation platform primarily employs a defense strategy that trains adversarial samples alongside normal samples. This enhances the model's ability to recognize adversarial samples, effectively reducing the success rate of such attacks. Furthermore, data-augmented samples are created by performing operations such as resizing and filtering on the original images and are then trained alongside the original samples to improve the model's ability to recognize these augmented samples.

[0032] However, current review platforms and similar patents only defend against attacks targeting adversarial examples and data-augmented examples, failing to consider combined attack methods such as adversarial-data-augmented examples and data-augmented-adversarial examples, thus limiting the model's defense capabilities. In this application's embodiments, by first performing data augmentation on samples and then using adversarial algorithms to generate data-augmented-adversarial examples, and by first using adversarial algorithms on samples and then performing data augmentation on the samples to generate adversarial-data-augmented examples, thus increasing the number of sample types, the trained image recognition model can defend against combined attacks, improving the image recognition model's defense capabilities.

[0033] Furthermore, current data augmentation methods are relatively simple and fixed, leaving room for alternative image augmentation methods to bypass content moderation platforms, thus resulting in weak model generalization ability. This application's embodiments improve the accuracy of image classification results from image recognition models by adding data augmentation methods.

[0034] In this embodiment, a first test sample set is input into an image recognition model, which is trained based on a first training sample set. The first training sample set contains at least one first target sample after image processing. The image processing includes at least one of the following: data augmentation processing and adversarial processing. M first image classification results corresponding to M test samples in the first test sample set are output, where each test sample corresponds to one first image classification result. If the number of first image classification results satisfying a first condition among the M first image classification results is less than N, the image processing parameters corresponding to the first target sample are adjusted to obtain a second training sample set. The image recognition model is trained based on the second training sample set to obtain a target image recognition model. The first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, where M and N are both integers greater than 1. The classification confidence is used to characterize the classification corresponding to the first image classification result. Thus, by training the image recognition model with samples processed in different ways, the defensive capability of the trained image recognition model is improved. Furthermore, by updating the image processing parameters and retraining the image recognition model with the updated training sample set, the accuracy of the image classification results of the image recognition model is improved.

[0035] This application provides a method for training an image recognition model. Figure 1 A flowchart illustrating a training method for an image recognition model according to an embodiment of this application is shown. This method can be applied to a training device for an image recognition model. In this embodiment, the training device for the image recognition model can be an electronic device. Figure 1 As shown, the training method for the image recognition model provided in this application embodiment may include the following steps 201 to 204.

[0036] Step 201: Input the first test sample set into the image recognition model.

[0037] In this embodiment of the application, the image recognition model is trained based on the first training sample set.

[0038] In this embodiment of the application, the image recognition model described above may be a convolutional neural network model.

[0039] In this embodiment of the application, the first training sample set may be automatically acquired by an electronic device or selected by a user.

[0040] In this embodiment of the application, the first training sample set includes at least one first target sample that has undergone image processing.

[0041] In this embodiment of the application, the first target sample is an image containing sensitive information after image processing.

[0042] In this embodiment of the application, the first test sample set includes at least one second target sample that has undergone image processing.

[0043] In the embodiments of this application, the first test sample set may be automatically acquired by an electronic device or selected by a user.

[0044] In the embodiments of this application, the above image processing includes at least one of the following: data augmentation processing and adversarial processing.

[0045] For example, the data augmentation process described above includes at least one of the following methods:

[0046] Method 1) Rotate the image;

[0047] Method 2) Crop the image;

[0048] Method 3) Adjust image brightness;

[0049] Method 4) Adjust image contrast;

[0050] Method 5) Filter the image.

[0051] For example, in method 1), the image is input into the image recognition model, and the image is rotated within a predetermined rotation range. The predetermined rotation range can be set based on the formula transform.functyional{min=0, max=360}, where min=0 and max=360 indicates that the image rotation angle is from 0° to 360°, and a fixed rotation value, such as a rotation angle of 5°, is used to rotate the image.

[0052] For example, in method 2), the image is input into the image recognition model, and the image is cropped within a predetermined cropping range. The predetermined cropping range can be set based on the formula transforms.CenterCrop(size={min=size1,max=size2}), where (size1,size2) represents the cropping range of the image, and the image is cropped using the set cropping values.

[0053] For example, in methods 3) and 4), the image is input into the image recognition model, and the brightness and contrast of the image are adjusted. The formula g(x) = αf(x) + β can be used to adjust the brightness and contrast of the image, where α and β are the gain and bias parameters, respectively. α controls the contrast, and β controls the brightness; a larger value indicates higher contrast and brightness. When β = a, the brightness range of the image is set to (1-a, 1+a) based on the formula transform.ColorJitter(brightness = {min = 1-a, max = 1+a}). Here, a is a predetermined value, and the brightness is used as a reference; for example, increasing the brightness factor by 0.1 adjusts the image brightness. When α = b, the contrast range of the image is set to (1-b, 1+b) based on the formula transform.ColorJitter(contrast = {min = 1-b, max = 1+b}). Here, b is a predetermined value, and the contrast is used as a reference; for example, increasing the contrast factor by 0.1.

[0054] For example, in method 5), the image is input into the image recognition model and filtered. The image can be filtered using the formula bilateralFilter(src, n, sigmaColor, sigmaSpace, borderType), where sigmaColor and sigmaSpace are the standard deviations of the bilateral filter, with values ​​of sigmaColor = {min = 10, max = 100}, and incremented by predetermined values.

[0055] For example, adversarial processing of images involves using adversarial sample generation algorithms to process the images. Examples include CW, FGSM, and BIM.

[0056] Step 202: Output the classification results of the M first images corresponding to the M test samples in the first test sample set.

[0057] In the embodiments of this application, each of the above test samples corresponds to a first image classification result.

[0058] For example, for one of the M test samples, the test sample is input into the image recognition model for classification, the first image classification result corresponding to the test sample is obtained, and the image recognition model is output.

[0059] In the embodiments of this application, the first image classification result can be a probability value, such as a probability of 90% belonging to a certain category. It can also be a result value, such as a result of 0 or 1 belonging to a certain category.

[0060] Step 203: If the number of first image classification results that satisfy the first condition is less than N among the M first image classification results, adjust the image processing parameters corresponding to the first target sample to obtain the second training sample set.

[0061] In the embodiments of this application, both M and N are integers greater than 1.

[0062] In this embodiment of the application, the first condition includes: the classification confidence level corresponding to the first image classification result is greater than a predetermined threshold.

[0063] In this embodiment of the application, the classification confidence level is used to characterize the classification corresponding to the first image classification result.

[0064] For example, the aforementioned predetermined threshold may be system-defined or user-set.

[0065] In this embodiment, the image recognition model sets multiple classification confidence levels corresponding to different sample categories. Each classification confidence level represents the probability that a sample belongs to that category.

[0066] For example, taking the first target sample containing sensitive information as violent information as an example, the classification confidence of violent samples containing violent information is set to 0.5. If the confidence of a sample is greater than 0.5, the sample is judged to be a violent sample; if it is less than 0.5, the sample is judged to be another sample.

[0067] For example, the value of N in the above-mentioned first image classification result number less than N can be system-defined or user-set.

[0068] For example, if M is 40 and N is 20, and the classification confidence of 10 of the first image classification results of the 40 images (i.e. the first target sample mentioned above) is greater than a predetermined threshold, then the image processing parameters corresponding to these 40 images are adjusted to obtain a new training sample set (i.e. the second training sample set mentioned above).

[0069] In the embodiments of this application, the above-mentioned image processing parameters may be the rotation angle of the image, the brightness and contrast of the image, the cropping size of the image, or image filtering.

[0070] Optionally, in this embodiment of the application, the process of step 203, "adjusting the image processing parameters corresponding to the first target sample to obtain the second training sample set", includes the following steps 203a and 203b:

[0071] Step 203a: Adjust the image processing parameters corresponding to at least one image-processed first target sample according to the target adjustment amount, and perform image processing on the original sample corresponding to the at least one image-processed first target sample according to the adjusted image processing parameters to obtain at least one third target sample.

[0072] For example, the target adjustment amount mentioned above can be customized by the electronic device or set by the user.

[0073] For example, the target adjustment amount mentioned above can be random or fixed.

[0074] In one example, the electronic device can adjust each image processing parameter corresponding to the first target sample according to multiple target adjustment amounts.

[0075] Step 203b: Replace at least one image-processed first target sample in the training sample set with at least one third target sample to obtain a second training sample set.

[0076] For example, the second training sample set mentioned above contains at least one third target sample.

[0077] In this way, the defensive capabilities of the image recognition model can be improved by adjusting the image processing parameters, updating the training sample set, and training the image recognition model based on the updated training sample set.

[0078] Step 204: Train the image recognition model based on the second training sample set to obtain the target image recognition model.

[0079] For example, the second training sample set is input into the image recognition model to train and adjust the image recognition model.

[0080] In one possible embodiment, a first test sample set is input into the target image recognition model to obtain M second image classification results. If the number of second image classification results satisfying the first condition among these M results is still less than N, it indicates that the target image recognition model is not yet mature. Therefore, the electronic device continues to adjust the image processing parameters corresponding to at least one of the image-processed first target samples until the number of image classification results corresponding to the test samples recognized by the image recognition model trained on the updated training sample set that satisfy the first condition is greater than N. Finally, this image recognition model is used as the target image recognition model.

[0081] For example, the updated training sample set (i.e., the second training sample set mentioned above) is input into the image recognition model after the i-th training, and the image recognition model is trained again to obtain the image recognition model after the (i+1)-th training. Then, the test sample set is input into the image recognition model after the (i+1)-th training to obtain the (i+1)-th image classification result. If the number of image classification results that satisfy the first condition mentioned above is greater than N, the training ends, and the final trained target image recognition model is obtained; if the number of image classification results that satisfy the first condition mentioned above is still less than N, the image recognition model is updated again until the number of image classification results that satisfy the first condition mentioned above for each test sample is still less than N.

[0082] In this way, by continuously updating the training sample set, the image recognition model is trained, so that the accuracy of the image classification results output by the image recognition model meets the user's needs.

[0083] In the training method of the image recognition model provided in this application embodiment, a first test sample set is input into the image recognition model, wherein the image recognition model is trained based on the first training sample set. The first training sample set contains at least one first target sample after image processing. The image processing includes at least one of the following: data augmentation processing, adversarial processing; outputting M first image classification results corresponding to M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; if the number of first image classification results satisfying a first condition among the M first image classification results is less than N, adjusting the image processing parameters corresponding to the first target sample to obtain a second training sample set; training the image recognition model based on the second training sample set to obtain a target image recognition model; wherein the first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, and M and N are both integers greater than 1; the classification confidence is used to characterize the classification corresponding to the first image classification result. In this way, by training the image recognition model with samples that have undergone image processing in different ways, the defensive capability of the trained image recognition model can be improved. Furthermore, by updating the image processing parameters and retraining the image recognition model with the updated training sample set, the accuracy of the image classification results of the image recognition model can be improved.

[0084] Optionally, in this embodiment of the application, after step 204 "training the image recognition model based on the second training sample set to obtain the target image recognition model", the training method for the image recognition model provided in this embodiment of the application further includes the following steps 301 and 302:

[0085] Step 301: Input the first test sample set into the target image recognition model and output the M second image classification results corresponding to the M test samples.

[0086] For example, each of the above test samples corresponds to a second image classification result.

[0087] For example, the first test sample set mentioned above is the same test sample set as the test sample set of the input image recognition model. That is, the sample content in the test sample set remains unchanged.

[0088] Step 302: If the number of second image classification results that satisfy the first condition is greater than N among the M second image classification results, input the image to be identified into the target image recognition model and output the image classification result corresponding to the image to be identified.

[0089] For example, the first test sample set is input into the target image recognition model to obtain M second image classification results. If the number of second image classification results that satisfy the first condition among these M second image classification results is greater than N, it indicates that the target image recognition model is mature. The image to be recognized can be directly input into the target recognition model to finally obtain the image classification result corresponding to the image to be recognized.

[0090] In this way, by continuously updating the image recognition model, a target image recognition model with high accuracy can be obtained, thereby accurately recognizing the image that the user wants to recognize.

[0091] Optionally, in this embodiment of the application, before step 201 "inputting the first test sample set into the image recognition model" as described above, the training method for the image recognition model provided in this application further includes steps 401 to 404:

[0092] Step 401: Obtain the original sample set.

[0093] For example, the original sample set mentioned above includes the original sensitive sample set and the original normal sample set.

[0094] For example, the original sensitive sample set mentioned above contains at least one sensitive sample, and the original normal sample set mentioned above contains at least one normal sample.

[0095] For example, the original sample set mentioned above may be automatically acquired by an electronic device or selected by the user.

[0096] For example, sensitive samples are images containing sensitive information; normal samples are images that do not contain sensitive information.

[0097] Step 402: Divide the original sample set into a third training sample set and a third test sample set.

[0098] For example, the third training sample set mentioned above includes a first sensitive sample set and a first normal sample set; the third test sample set includes a second sensitive sample set and a second normal sample set.

[0099] In one example, the original sample set is divided into a third training sample set and a third test sample set according to a specific ratio. For example, the original sample set is divided in an 8:2 ratio.

[0100] It should be noted that the ratio of the number of sensitive samples to the number of normal samples in the third training sample set and the third test sample set should be as consistent as possible.

[0101] Step 403: Perform image processing on the sensitive samples in the first sensitive sample set to obtain the third sensitive sample set, and perform image processing on the sensitive samples in the second sensitive sample set to obtain the fourth sensitive sample set.

[0102] For example, image processing of sensitive samples in a first sensitive sample set includes at least one of the following steps:

[0103] Adversarial processing is applied to a subset of sensitive samples within the first set of sensitive samples.

[0104] Data augmentation processing is performed on a subset of sensitive samples from the first set of sensitive samples.

[0105] Adversarial processing is first applied to a subset of sensitive samples in the first set of sensitive samples, followed by data augmentation.

[0106] Data augmentation is first performed on a subset of sensitive samples from the first set of sensitive samples, followed by adversarial processing.

[0107] As a further example, the third sensitive sample set is obtained by performing image processing on the first sensitive sample set through the above steps.

[0108] Specifically, the samples in the aforementioned third sensitive sample set include at least one of the following:

[0109] Adversarial samples obtained after adversarial processing;

[0110] Data-augmented samples obtained after data augmentation processing;

[0111] Adversarial data augmentation samples are obtained by first performing adversarial processing and then performing data augmentation processing.

[0112] The data-augmented adversarial sample is obtained by first performing data augmentation and then performing adversarial processing.

[0113] For example, image processing of sensitive samples in a second sensitive sample set includes at least one of the following steps:

[0114] Adversarial processing is applied to a subset of sensitive samples within the second set of sensitive samples.

[0115] Data augmentation processing is performed on a subset of sensitive samples in the second set of sensitive samples.

[0116] Adversarial processing is first applied to a subset of sensitive samples in the second sensitive sample set, followed by data augmentation.

[0117] Data augmentation is first performed on a subset of sensitive samples in the second set of sensitive samples, followed by adversarial processing.

[0118] As a further example, the first sensitive sample set is processed through the above steps to obtain the fourth sensitive sample set.

[0119] Specifically, the samples in the aforementioned fourth sensitive sample set include at least one of the following:

[0120] Adversarial samples obtained after adversarial processing;

[0121] Data-augmented samples obtained after data augmentation processing;

[0122] Adversarial data augmentation samples are obtained by first performing adversarial processing and then performing data augmentation processing.

[0123] The data-augmented adversarial sample is obtained by first performing data augmentation and then performing adversarial processing.

[0124] Step 404: Construct a first training sample set based on the first sensitive sample set, the first normal sample set, and the third sensitive sample set, and construct a first test sample set based on the second sensitive sample set, the second normal sample set, and the fourth sensitive sample set.

[0125] For example, firstly, after acquiring a large number of raw samples, the electronic device divides all the raw sensitive samples and raw normal sample sets in the raw samples into a third training sample set and a third measurement sample set. Then, image processing is performed on the sensitive samples in the first sensitive sample set in the third training sample set and the second sensitive sample set in the third test sample set, respectively, to obtain the third sensitive sample set and the fourth sensitive sample set.

[0126] It should be noted that after the electronic device acquires the original sample set, it can first perform image processing on all the original samples before dividing them into training and test sample sets. Alternatively, it can first divide the training and test sample sets and then perform image processing on the samples in the two sets separately. This application embodiment does not impose any restrictions.

[0127] In this way, the defensive capabilities of image recognition models can be improved by increasing the variety of training samples.

[0128] The training method of the image recognition model provided in this application is illustrated below. Specifically, as shown below... Figure 2As shown, the method may include the following steps 1 to 8.

[0129] Step 1: First, collect high-quality normal samples and sensitive samples to form the original sample set. Divide the original dataset into training sample set and test sample set according to a specific ratio.

[0130] It should be noted that the number of samples collected is generally in the tens of thousands, and the training sample set and the test sample set are usually divided according to an 8:2 allocation ratio.

[0131] Step 2: The process of creating the training set is as follows:

[0132] 1) Divide the sensitive sample set into four equal parts: A1, A2, A3, and A4.

[0133] 2) Perform adversarial processing on the sensitive sample set A1, and generate adversarial sample set A using mainstream adversarial sample generation algorithms in the industry, including but not limited to CW, FGSM, and BIM.

[0134] 3) Divide the sensitive sample set A2 into 5 equal parts, and perform data augmentation processing on each of these 5 parts to generate a data augmentation set A. The data augmentation processing methods include: rotating the image; cropping the image; adjusting the image brightness; adjusting the image contrast; and filtering the image.

[0135] 4) Perform adversarial processing on the sensitive sample set A3 first, and then perform data augmentation processing. The adversarial algorithm and data augmentation processing method are the same as those described above, generating an "adversarial-data augmentation" sample set.

[0136] 5) Perform data augmentation on the sensitive sample set A4, followed by adversarial processing. The adversarial algorithm and data augmentation method are the same as those described above, generating a "data augmentation-adversarial" sample set.

[0137] Step 3: Creating the test sample set: Same as step 2.

[0138] Step 4: Set the classification confidence scores of the image recognition model for normal samples and sensitive samples to M and N. That is, when the image recognition model classifies a sample, there will be a confidence score, which represents the probability that the sample is a positive sample. For example, the threshold for violent samples is N = 0.5. Based on this threshold, the samples are divided. Samples with a confidence score greater than 0.5 are judged as violent samples, and samples with a confidence score less than 0.5 are judged as normal samples.

[0139] Step 5: Input the training sample set into the image recognition model for training to obtain the trained image recognition model. Input the test sample set into the trained image recognition model for testing, and record the classification results and confidence scores of the samples in the test set.

[0140] Step 6: Based on the classification results, check the classification accuracy and misclassification rate of each type of sample in the test sample set. Correct classification means: for example, if a violent sample is processed using adversarial data augmentation and the model's confidence level for that sample is 0.6, then the sample is correctly classified as a violent sample. Conversely, if the confidence level is 0.4, then the sample is incorrectly classified as a non-violent sample, meaning that the sample can bypass the image content review platform.

[0141] Step 7: If there are cases of misclassification of images, such as: the classification confidence of a normal sample is 0.6, a normal sample has a confidence of 0.8 in the image recognition model before training and is classified correctly; but has a confidence of 0.5 in the image recognition model after training and is classified incorrectly, it means that this sample caused misclassification during the defense phase.

[0142] If the above misjudgment occurs, the intensity of the five data augmentation methods will be adjusted during the data augmentation process. The parameters of each part will be corrected according to the original data augmentation method. For example, the rotation angle is 0 + 5*i, where i is the number of iterations, and a new training sample set will be generated.

[0143] Step 8: Input the new training sample set into the trained image recognition model for training. After obtaining the new trained image recognition model, input the test sample set into the new trained image recognition model for classification. If the confidence scores of both malicious samples and normal samples are greater than the corresponding thresholds, it indicates that the model can resist attacks on malicious samples without affecting the classification results of normal samples. The model's defense capability and classification accuracy are effectively improved. Otherwise, iterate through steps 2-7.

[0144] This enhances the image content moderation platform's ability to detect single data-augmented samples, single adversarial samples, adversarial-data-augmented samples, and data-augmentation-adversarial sample attacks. It also strengthens the platform's defense against different types of malicious samples. Furthermore, by using data augmentation thresholds, it improves the generalization ability of the image recognition model, increases its accuracy, and reduces its false positive rate.

[0145] It should be noted that the image recognition model training method provided in this application embodiment can be executed by an image recognition model training device, an electronic device, or a functional module or entity within an electronic device. This application embodiment uses an image recognition model training device executing the image recognition model training method as an example to illustrate the image recognition model training device provided in this application embodiment.

[0146] Figure 3 A schematic diagram of a possible structure of a training device for an image recognition model involved in an embodiment of this application is shown. For example... Figure 3As shown, the training device 700 for the image recognition model may include a processing module 701.

[0147] The processing module 701 is configured to input a first test sample set into an image recognition model, wherein the image recognition model is trained based on a first training sample set, the first training sample set containing at least one first target sample after image processing, and the image processing including at least one of the following: data augmentation processing, adversarial processing; the processing module 701 is further configured to output M first image classification results corresponding to M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; the processing module 701 is further configured to adjust the image processing parameters corresponding to the first target sample to obtain a second training sample set when the number of first image classification results satisfying a first condition among the M first image classification results is less than N; the processing module 701 is further configured to train the image recognition model based on the second training sample set to obtain a target image recognition model; wherein the first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, and M and N are both integers greater than 1; the classification confidence is used to characterize the classification corresponding to the first image classification result.

[0148] Optionally, in this embodiment of the application, the processing module 701 is further configured to input the first test sample set into the target image recognition model and output M second image classification results corresponding to M test samples, wherein each test sample corresponds to one second image classification result; the processing module 701 is further configured to input the image to be recognized into the target image recognition model and output the image classification result corresponding to the image to be recognized when the number of second image classification results satisfying the first condition among the M second image classification results is greater than N.

[0149] Optionally, in the embodiments of this application, combined with Figure 3 ,like Figure 4As shown, the above-mentioned device 700 further includes: an acquisition module 702; the acquisition module 702 is used to acquire an original sample set, wherein the original sample set includes an original sensitive sample set and an original normal sample set, the original sensitive sample set contains at least one sensitive sample, and the original normal sample set contains at least one normal sample; the processing module 701 is further used to divide the original sample set into a third training sample set and a third test sample set, wherein the third training sample set includes a first sensitive sample set and a first normal sample set, and the third test sample set includes a second sensitive sample set and a second normal sample set; the processing module 701 is further used to perform image processing on the sensitive samples in the first sensitive sample set to obtain a third sensitive sample set, and to perform image processing on the sensitive samples in the second sensitive sample set to obtain a fourth sensitive sample set; the processing module 701 is further used to construct a first training sample set based on the first sensitive sample set, the first normal sample set, and the third sensitive sample set, and to construct a first test sample set based on the second sensitive sample set, the second normal sample set, and the fourth sensitive sample set.

[0150] Optionally, in the embodiments of this application, the samples in the third sensitive sample set and the fourth sensitive sample set mentioned above include at least one of the following:

[0151] Adversarial samples obtained after adversarial processing;

[0152] Data-augmented samples obtained after data augmentation processing;

[0153] Adversarial data augmentation samples are obtained by first performing adversarial processing and then performing data augmentation processing.

[0154] The data-augmented adversarial sample is obtained by first performing data augmentation and then performing adversarial processing.

[0155] Optionally, in this embodiment of the application, the above-mentioned processing module 701 is specifically used to: adjust the image processing parameters corresponding to at least one image-processed first target sample according to the target adjustment amount, and perform image processing on the original sample corresponding to at least one image-processed first target sample according to the adjusted image processing parameters to obtain at least one third target sample; and replace at least one image-processed first target sample in the first training sample set with at least one third target sample to obtain a second training sample set.

[0156] In the image recognition model training apparatus provided in this application embodiment, the apparatus inputs a first test sample set into the image recognition model, wherein the image recognition model is trained based on the first training sample set. The first training sample set contains at least one first target sample after image processing. The image processing includes at least one of the following: data augmentation processing, adversarial processing; outputting M first image classification results corresponding to M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; if the number of first image classification results satisfying a first condition among the M first image classification results is less than N, adjusting the image processing parameters corresponding to the first target sample to obtain a second training sample set; training the image recognition model based on the second training sample set to obtain a target image recognition model; wherein the first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, and M and N are both integers greater than 1; the classification confidence is used to characterize the classification corresponding to the first image classification result. In this way, by training the image recognition model with samples that have undergone image processing in different ways, the defensive capability of the trained image recognition model can be improved. Furthermore, by updating the image processing parameters and retraining the image recognition model with the updated training sample set, the accuracy of the image classification results of the image recognition model can be improved.

[0157] The training device for the image recognition model in this application embodiment can be an electronic device or a component within an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or other devices besides a terminal. For example, the electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. It can also be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not specifically limit the scope of the device.

[0158] The training device for the image recognition model in this embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this embodiment does not impose specific limitations.

[0159] The image recognition model training device provided in this application embodiment can achieve Figure 1 and Figure 2 The various processes implemented in the method implementation examples will not be described again here to avoid repetition.

[0160] Optionally, such as Figure 5 As shown, this application embodiment also provides an electronic device 800, including a processor 801 and a memory 802. The memory 802 stores a program or instructions that can run on the processor 801. When the program or instructions are executed by the processor 801, they implement the various steps of the above-described image recognition model training method embodiment and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0161] It should be noted that the electronic devices in the embodiments of this application include the mobile electronic devices and non-mobile electronic devices described above.

[0162] Figure 6 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of this application.

[0163] The electronic device 100 includes, but is not limited to, components such as: radio frequency unit 101, network module 102, audio output unit 103, input unit 104, sensor 105, display unit 106, user input unit 107, interface unit 108, memory 109, and processor 110.

[0164] Those skilled in the art will understand that the electronic device 100 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 110 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 6 The electronic device structure shown does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here.

[0165] The processor 110 is configured to input a first test sample set into an image recognition model, wherein the image recognition model is trained based on a first training sample set, the first training sample set containing at least one first target sample after image processing, and the image processing including at least one of the following: data augmentation processing, adversarial processing; the processor 110 is further configured to output M first image classification results corresponding to M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; the processor 110 is further configured to adjust the image processing parameters corresponding to the first target sample to obtain a second training sample set when the number of first image classification results satisfying a first condition among the M first image classification results is less than N; the processor 110 is further configured to train the image recognition model based on the second training sample set to obtain a target image recognition model; wherein the first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, and M and N are both integers greater than 1; the classification confidence is used to characterize the classification corresponding to the first image classification result.

[0166] Optionally, in this embodiment of the application, the processor 110 is further configured to input the first test sample set into the target image recognition model and output M second image classification results corresponding to M test samples, wherein each test sample corresponds to one second image classification result; the processor 110 is further configured to input the image to be recognized into the target image recognition model and output the image classification result corresponding to the image to be recognized when the number of second image classification results satisfying the first condition among the M second image classification results is greater than N.

[0167] Optionally, in this embodiment, the processor 110 is configured to acquire an original sample set, wherein the original sample set includes an original sensitive sample set and an original normal sample set, the original sensitive sample set contains at least one sensitive sample, and the original normal sample set contains at least one normal sample; the processor 110 is further configured to divide the original sample set into a third training sample set and a third test sample set, wherein the third training sample set includes a first sensitive sample set and a first normal sample set, and the third test sample set includes a second sensitive sample set and a second normal sample set; the processor 110 is further configured to perform image processing on the sensitive samples in the first sensitive sample set to obtain a third sensitive sample set, and perform image processing on the sensitive samples in the second sensitive sample set to obtain a fourth sensitive sample set; the processor 110 is further configured to construct a first training sample set based on the first sensitive sample set, the first normal sample set, and the third sensitive sample set, and construct a first test sample set based on the second sensitive sample set, the second normal sample set, and the fourth sensitive sample set.

[0168] Optionally, in the embodiments of this application, the samples in the third sensitive sample set and the fourth sensitive sample set mentioned above include at least one of the following:

[0169] Adversarial samples obtained after adversarial processing;

[0170] Data-augmented samples obtained after data augmentation processing;

[0171] Adversarial data augmentation samples are obtained by first performing adversarial processing and then performing data augmentation processing.

[0172] The data-augmented adversarial sample is obtained by first performing data augmentation and then performing adversarial processing.

[0173] Optionally, in this embodiment of the application, the processor 110 is specifically configured to: adjust the image processing parameters corresponding to at least one image-processed first target sample according to the target adjustment amount, and perform image processing on the original sample corresponding to at least one image-processed first target sample according to the adjusted image processing parameters to obtain at least one third target sample; and replace at least one image-processed first target sample in the first training sample set with at least one third target sample to obtain a second training sample set.

[0174] In the electronic device provided in this application embodiment, the electronic device inputs a first test sample set into an image recognition model, wherein the image recognition model is trained based on a first training sample set. The first training sample set contains at least one first target sample after image processing. The image processing includes at least one of the following: data augmentation processing, adversarial processing; outputting M first image classification results corresponding to M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; if the number of first image classification results satisfying a first condition among the M first image classification results is less than N, adjusting the image processing parameters corresponding to the first target sample to obtain a second training sample set; training the image recognition model based on the second training sample set to obtain a target image recognition model; wherein the first condition includes: the classification confidence corresponding to the first image classification result is greater than a predetermined threshold, and M and N are both integers greater than 1; the classification confidence is used to characterize the classification corresponding to the first image classification result. Thus, by using samples processed in different ways to train the image recognition model, the defense capability of the trained image recognition model is improved, and by updating the image processing parameters and using the updated training sample set to retrain the image recognition model, the accuracy of the image classification results of the image recognition model is improved.

[0175] It should be understood that, in this embodiment, the input unit 104 may include a graphics processing unit (GPU) 1041 and a microphone 1042. The GPU 1041 processes image data of still images or videos obtained by an image capture device (such as a camera) in video capture mode or image capture mode. The display unit 106 may include a display panel 1061, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, or the like. The user input unit 107 includes at least one of a touch panel 1071 and other input devices 1072. The touch panel 1071 is also called a touch screen. The touch panel 1071 may include a touch detection device and a touch controller. Other input devices 1072 may include, but are not limited to, a physical keyboard, function keys (such as volume control buttons, power buttons, etc.), a trackball, a mouse, and a joystick, which will not be described in detail here.

[0176] The memory 109 can be used to store software programs and various data. The memory 109 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 109 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 109 in the embodiments of this application includes, but is not limited to, these and any other suitable types of memory.

[0177] Processor 110 may include one or more processing units; optionally, processor 110 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into processor 110.

[0178] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described image recognition model training method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0179] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0180] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described image recognition model training method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0181] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0182] This application provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above-described image recognition model training method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0183] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0184] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0185] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A training method for an image recognition model, characterized in that, The method includes: The first test sample set is input into the image recognition model, wherein the image recognition model is trained based on the first training sample set, the first training sample set contains at least one first target sample after image processing, and the image processing includes: data augmentation processing and adversarial processing. Output the M first image classification results corresponding to the M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; If the number of first image classification results that satisfy the first condition among the M first image classification results is less than N, the image processing parameters corresponding to the first target sample are adjusted to obtain a second training sample set. The image recognition model is trained based on the second training sample set until the number of image classification results corresponding to the test samples identified by the image recognition model trained on the updated training sample set that satisfy the first condition is greater than N, so as to obtain the target image recognition model. The first condition includes: the classification confidence level corresponding to the first image classification result is greater than a predetermined threshold, where M and N are both integers greater than 1; the classification confidence level is used to characterize the probability that the test sample belongs to the category corresponding to the first image classification result.

2. The method according to claim 1, characterized in that, After training the image recognition model based on the second training sample set to obtain the target image recognition model, the method further includes: The first test sample set is input into the target image recognition model, and M second image classification results corresponding to the M test samples are output, wherein each test sample corresponds to one second image classification result; If the number of second image classification results that satisfy the first condition is greater than N among the M second image classification results, the image to be identified is input into the target image recognition model, and the image classification result corresponding to the image to be identified is output.

3. The method according to claim 1, characterized in that, Before inputting the first test sample set into the image recognition model, the method further includes: Obtain the original sample set, wherein the original sample set includes an original sensitive sample set and an original normal sample set, the original sensitive sample set contains at least one sensitive sample, and the original normal sample set contains at least one normal sample; The original sample set is divided into a third training sample set and a third test sample set, wherein the third training sample set includes a first sensitive sample set and a first normal sample set, and the third test sample set includes a second sensitive sample set and a second normal sample set; The sensitive samples in the first sensitive sample set are processed to obtain the third sensitive sample set, and the sensitive samples in the second sensitive sample set are processed to obtain the fourth sensitive sample set. Based on the first sensitive sample set, the first normal sample set, and the third sensitive sample set, the first training sample set is constructed, and based on the second sensitive sample set, the second normal sample set, and the fourth sensitive sample set, the first test sample set is constructed.

4. The method according to claim 3, characterized in that, The samples in the third sensitive sample set and the fourth sensitive sample set include: The adversarial sample obtained after the adversarial processing; The data augmentation sample obtained after the aforementioned data augmentation process; Adversarial data augmentation samples are obtained by first performing adversarial processing and then performing data augmentation processing. The data-augmented adversarial sample is obtained by first performing data augmentation and then performing adversarial processing.

5. The method according to claim 1, characterized in that, Adjusting the image processing parameters corresponding to the at least one image-processed first target sample to obtain a second training sample set includes: According to the target adjustment amount, adjust the image processing parameters corresponding to the at least one image-processed first target sample, and perform image processing on the original sample corresponding to the at least one image-processed first target sample according to the adjusted image processing parameters to obtain at least one third target sample; The first training sample set is obtained by replacing at least one image-processed first target sample in the first training sample set with at least one third target sample.

6. A training device for an image recognition model, characterized in that, The training device for the image recognition model includes: a processing module; The processing module is used to input the first test sample set into the image recognition model, wherein the image recognition model is trained based on the first training sample set, the first training sample set contains at least one first target sample after image processing, and the image processing includes: data augmentation processing and adversarial processing. The processing module is further configured to output M first image classification results corresponding to M test samples in the first test sample set, wherein each test sample corresponds to one first image classification result; The processing module is further configured to adjust the image processing parameters corresponding to the first target sample to obtain a second training sample set when the number of first image classification results satisfying the first condition among the M first image classification results is less than N. The processing module is further configured to train the image recognition model based on the second training sample set until the number of image classification results corresponding to the test samples identified by the image recognition model trained by the updated training sample set that satisfy the first condition is greater than N, so as to obtain the target image recognition model. The first condition includes: the classification confidence level corresponding to the first image classification result is greater than a predetermined threshold, where M and N are both integers greater than 1; the classification confidence level is used to characterize the probability that the test sample belongs to the category corresponding to the first image classification result.

7. The apparatus according to claim 6, characterized in that, The processing module is further configured to input the first test sample set into the target image recognition model and output M second image classification results corresponding to the M test samples, wherein each test sample corresponds to one second image classification result; The processing module is further configured to, when the number of second image classification results satisfying the first condition among the M second image classification results is greater than N, input the image to be identified into the target image recognition model and output the image classification result corresponding to the image to be identified.

8. The apparatus according to claim 6, characterized in that, The device further includes: an acquisition module; The acquisition module is used to acquire an original sample set, wherein the original sample set includes an original sensitive sample set and an original normal sample set, the original sensitive sample set contains at least one sensitive sample, and the original normal sample set contains at least one normal sample; The processing module is further configured to divide the original sample set into a third training sample set and a third test sample set, wherein the third training sample set includes a first sensitive sample set and a first normal sample set, and the third test sample set includes a second sensitive sample set and a second normal sample set. The processing module is further configured to perform image processing on the sensitive samples in the first sensitive sample set to obtain a third sensitive sample set, and to perform image processing on the sensitive samples in the second sensitive sample set to obtain a fourth sensitive sample set; The processing module is further configured to construct the first training sample set based on the first sensitive sample set, the first normal sample set, and the third sensitive sample set, and to construct the first test sample set based on the second sensitive sample set, the second normal sample set, and the fourth sensitive sample set.

9. The apparatus according to claim 8, characterized in that, The samples in the third sensitive sample set and the fourth sensitive sample set include: The adversarial sample obtained after the adversarial processing; The data augmentation sample obtained after the aforementioned data augmentation process; Adversarial data augmentation samples are obtained by first performing adversarial processing and then performing data augmentation processing. The data-augmented adversarial sample is obtained by first performing data augmentation and then performing adversarial processing.

10. The apparatus according to claim 6, characterized in that, The processing module is specifically used for: According to the target adjustment amount, adjust the image processing parameters corresponding to the at least one image-processed first target sample, and perform image processing on the original sample corresponding to the at least one image-processed first target sample according to the adjusted image processing parameters to obtain at least one third target sample; The first training sample set is obtained by replacing at least one image-processed first target sample in the first training sample set with at least one third target sample.

11. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the training method for the image recognition model as described in any one of claims 1 to 5.

12. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the training method for the image recognition model as described in any one of claims 1 to 5.

Images