Image classification and recognition method and system, terminal equipment and storage medium
The original samples are mixed with adversarial samples through CutMix and Mixup methods, and the image classification recognition model is trained adversarially in combination with soft label strategies, which solves the problem of insufficient overfitting and generalization capabilities of the model in the existing technology, and improves the robustness and generalization capabilities of the model.
Patent Information
- Application Number
- CN202411928459.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-25
- Publication Date
- 2025-04-18
AI Technical Summary
When existing adversarial training techniques improve the robustness of the model to adversarial samples, they can easily lead to overfitting and insufficient generalization capabilities, especially in the face of new adversarial attacks.
The CutMix and Mixup methods are used to mix the original samples with the adversarial samples, generate new adversarial samples, and the image classification recognition model is adversarially trained through soft labeling strategies to enhance the robustness and generalization ability of the model.
The adversarial samples generated by the mixed method can effectively weaken the attack ability of the adversarial samples, reduce the overfitting of the model to the adversarial samples, and improve the generalization and stability of the model in complex environments.
Smart Images
Figure CN119851024A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of image classification and recognition, and in particular to an image classification and recognition method, system, terminal equipment and storage medium. Background Art
[0002] In response to the challenge of adversarial attacks, researchers have explored and implemented a variety of strategies to enhance the defense capabilities of models. Among them, adversarial training, as a core method, aims to improve the robustness of image classification models to potential perturbations in input data by deliberately introducing adversarial samples during the model training phase.
[0003] However, current adversarial training techniques generally face a thorny problem: overfitting to adversarial examples. Although the model can show good performance on the training set containing adversarial examples, its generalization ability is greatly reduced when faced with unseen data, resulting in insufficient defense against new adversarial attacks. In the context of adversarial training, the problem of overfitting is particularly severe because the model may rely too much on the specific and often unnatural features of the adversarial examples, while ignoring the diversity and complexity contained in real-world data.
[0004] Therefore, simply increasing the number of adversarial samples to improve the robustness of the model faces huge challenges and may cause the model to fall into a state of "blind reinforcement". Although it can resist known adversarial attack modes, it is helpless against more complex or variant forms of attacks that may appear in the future.
[0005] In summary, in order to effectively deal with adversarial attacks and improve the robustness of image classification and recognition models, we need to improve the robustness of image classification and recognition models to resist various adversarial attacks and improve the generalization and stability of image classification and recognition models in complex environments. Summary of the invention
[0006] In view of the above-mentioned defects, the purpose of the present invention is to propose an image classification and recognition method, system, terminal device and storage medium, aiming to improve the robustness of the image classification and recognition model to resist various adversarial attacks and improve the generalization and stability of the image classification and recognition model in complex environments.
[0007] To achieve this object, the present invention adopts the following technical solutions:
[0008] An image classification and recognition method, the image classification and recognition method comprising the following steps:
[0009] S1: Obtain the original sample, use the adversarial attack algorithm with the cross entropy loss function as the evaluation criterion to attack the image classification recognition model, and generate several different first adversarial samples corresponding to the original sample;
[0010] S2: Use the CutMix method to mix the original sample with the first adversarial sample to generate a second adversarial sample, and use the Mixup method to mix different second adversarial samples to generate a third adversarial sample;
[0011] S3: Perform adversarial training on the image classification and recognition model according to the third adversarial sample and the soft label strategy, and use the trained image classification and recognition model to classify and recognize images.
[0012] Preferably, before using the adversarial attack algorithm using the cross entropy loss function as the evaluation criterion to attack the image classification recognition model, it also includes setting the disturbance amplitude and the number of iterations;
[0013] The disturbance amplitude is set to 8 / 255, and the number of iterations is set to 10.
[0014] Preferably, the anti-attack algorithm is a PGD algorithm;
[0015] The PGD algorithm includes generating adversarial samples by repeatedly iterating and adjusting the perturbation using cross entropy loss, and satisfying the relationship:
[0016]
[0017] Among them, δ (t+1) represents the adversarial sample perturbation at the tth iteration, ∈ iter represents the iteration step size, which is used to adjust the perturbation size in each iteration. Represents the loss function L relative to the adversarial sample x+δ (t) The gradient of (t) Represents the perturbation generated after the t-1th iteration, and batch_multiply() indicates that the data is processed in batches.
[0018] Preferably, the mixing of the original sample with the first adversarial sample using the CutMix method comprises:
[0019] Select a random position, and crop a preset rectangular area at the random position of the original sample to obtain an original sub-sample;
[0020] Replace the original sub-sample with the rectangular areas at random positions of two different first adversarial samples to obtain two different second adversarial samples, and generate the second adversarial sample, and satisfy the relationship:
[0021] x cutmix1 =x·M+x1·(1-M);
[0022] x cutmix2 =x·M+x2·(1-M);
[0023] Where M is used to indicate the original subsample at a random position, x cutmix1 and x cutmix2 represents a different second adversarial sample, x represents the original sample, and x1 and x2 represent different first adversarial samples.
[0024] Furthermore, the Mixup method is used to mix different second adversarial samples to generate a third adversarial sample, satisfying the relationship:
[0025] x mixup =λ·x cutmix1 +(1-λ)·x cutmix2 ;
[0026] Among them, λ~Beta(α,α) represents a parameter randomly sampled from the Beta distribution, x cutmix1 and x cutmix2 Denotes different second adversarial examples.
[0027] Preferably, performing adversarial training on the image classification recognition model according to the third adversarial sample and the soft label strategy includes:
[0028] Use the soft label strategy to adjust the target label of the cross entropy loss function from a hard label to a soft label, satisfying the relationship:
[0029] y smooth =(1-∈)·y hard +∈ / K;
[0030] Among them, ∈ represents the smoothing factor, y hard represents the hard label, K represents the total number of categories, and y smooth Indicates a soft tag;
[0031] The third adversarial sample is input into the image classification and recognition model to be trained, and adversarial training is performed on the image classification and recognition model based on the cross entropy loss corresponding to the soft label.
[0032] An image classification and recognition system adopts the above-mentioned image classification and recognition method, and the image classification and recognition system comprises:
[0033] A sample generation module is used to obtain an original sample, use an adversarial attack algorithm with a cross entropy loss function as an evaluation criterion to attack the image classification recognition model, and generate a number of different first adversarial samples corresponding to the original sample;
[0034] A sample mixing module, used to mix the original sample with the first adversarial sample using the CutMix method to generate a second adversarial sample, and to mix different second adversarial samples using the Mixup method to generate a third adversarial sample;
[0035] The model training module is used to perform adversarial training on the image classification and recognition model according to the third adversarial sample and the soft label strategy, and classify and recognize images using the trained image classification and recognition model.
[0036] A terminal device comprises a memory, a processor and a program stored in the memory and executable on the processor, wherein the program is configured to implement the steps of the image classification and recognition method as described above.
[0037] A storage medium stores an image classification and recognition program, which implements the steps of the above-mentioned image classification and recognition method when executed by a processor.
[0038] One of the above technical solutions has the following advantages or beneficial effects:
[0039] First, the Cutmix method is used to mix the original samples with the adversarial samples to improve the model's resistance to various adversarial attacks and enhance the classification accuracy and robustness of the model in practical applications. Then, mixup is performed. Mixup uses interpolation to weaken the attack capability of the adversarial samples, plays a smoothing role, and reduces the overfitting of the model to the adversarial samples. The soft label strategy makes the label of each sample represented as a probability distribution, so that the model not only performs well on the training set, but also maintains high accuracy on new data that has not been seen, significantly improving the generalization ability of the model. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.
[0041] Figure 1 is a flow chart of an image classification and recognition method provided by an embodiment of the present invention;
[0042] Figure 2 It is a structural diagram of an image classification and recognition system provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0043] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.
[0044] In the present invention, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.
[0045] like Figure 1 As shown, the present invention proposes an image classification and recognition method, which includes the following steps:
[0046] S1: Obtain the original sample, use the adversarial attack algorithm with the cross entropy loss function as the evaluation criterion to attack the image classification recognition model, and generate several different first adversarial samples corresponding to the original sample;
[0047] S2: Use the CutMix method to mix the original sample with the first adversarial sample to generate a second adversarial sample, and use the Mixup method to mix different second adversarial samples to generate a third adversarial sample;
[0048] S3: Perform adversarial training on the image classification and recognition model according to the third adversarial sample and the soft label strategy, and use the trained image classification and recognition model to classify and recognize images.
[0049] Specifically, in step S1, the original sample refers to unprocessed image data, which can be derived from a public data set or actual application scenarios. The samples should be as diverse as possible to comprehensively evaluate the performance of the classification model. The purpose of adversarial attacks is to generate adversarial samples, which are visually almost the same as the original samples, but can mislead the classification model. For example, a picture of a cat may be transformed into a picture that still looks like a cat, but the model mistakenly classifies it as a dog. The cross-entropy loss function is used to measure the difference between the probability distribution predicted by the model and the true label distribution. In adversarial attacks, by minimizing the cross-entropy loss, the generation of adversarial samples can be made more effective. The attacker will choose to maximize this loss, thereby adjusting the input sample so that the probability of the model output is far from the true label. The first adversarial sample obtained corresponds to the original sample, but after perturbation, the model is prone to misclassification. The adversarial sample is used in the subsequent training process to enhance the robustness of the model.
[0050] In step S2, the CutMix method generates new training samples by mixing two images. The specific process is to randomly select a rectangular area in one image and replace it with the corresponding area of another image. It not only introduces new visual features, but also changes the distribution of labels, effectively improving the generalization ability of the model, helping the model to learn the characteristics of the region, thereby reducing overfitting of specific samples. Mixup is to linearly combine two different images to generate a new image, and also generate corresponding labels. Mixup can enable the model to establish better connections between different categories, increase the continuity of samples, and thus enhance the stability and robustness of the model. It is worth noting that if mixup is selected first and then cutmix is used, then the final image will have a part of the cut area containing the information of the original image, and then the uncut area is the adversarial sample after mixup smoothing, which will weaken the smoothing effect of the adversarial sample, and if the image classification recognition model pays too much attention to the area of the original sample, it will also lead to poor robustness of the final trained model.
[0051] In step S3, adversarial training refers to the use of adversarial samples to enhance the robustness of the image classification recognition model during the training process. By introducing adversarial samples, the image classification recognition model can learn how to maintain classification accuracy in the face of small perturbations. The model not only processes normal samples in each training batch, but also processes generated adversarial samples, so that the model continuously adapts to new perturbations during the learning process and improves its ability to resist adversarial attacks. In traditional training methods, the model usually uses hard labels, that is, each sample corresponds to only one clear category. The soft label strategy converts hard labels into soft labels, that is, probability distributions, which helps to reduce the overfitting of the model on specific labels and promote the similarity between model learning samples. After adversarial training, the model can process new image inputs, whether normal samples or samples that have been attacked by adversarial attacks, so as to perform classification and recognition. The trained model can maintain high accuracy and robustness when facing various situations in practical applications.
[0052] Preferably, before using the adversarial attack algorithm using the cross entropy loss function as the evaluation criterion to attack the image classification recognition model, it also includes setting the disturbance amplitude and the number of iterations;
[0053] The disturbance amplitude is set to 8 / 255, and the number of iterations is set to 10.
[0054] Specifically, the perturbation amplitude refers to the maximum amplitude of the modification of the input image, which is usually quantified by the range of pixel values. In image processing, 8 / 255 means that the maximum perturbation size that each pixel unit can withstand is 8 / 255 numerical units. The main purpose of setting the perturbation amplitude is to ensure that the generated adversarial sample is still visually similar to the original sample, while effectively misleading the classification model. Excessive perturbation may cause the visual features of the adversarial sample to change too much, which is easy to overfit the adversarial image. The set perturbation amplitude limits the step size of each update, thereby ensuring that the final generated adversarial sample is within the perturbation range. The number of iterations refers to the number of updates performed by the model when generating adversarial samples. The number of iterations set to 10 means that the input image will be updated 10 times. The setting of the number of iterations has a direct impact on the quality of the adversarial sample. A larger number of iterations can make the generation of adversarial samples more refined, can more effectively mislead the model, and allow the model to explore more perturbation distribution methods that increase the gradient loss under the constraint that the adversarial perturbation meets the norm. However, too many iterations will make the computational overhead too large. It is worth noting that a perturbation amplitude greater than 0.05 may make the adversarial sample too powerful, less than 0.01 may make the adversarial sample too weak in attack, less than 5 iterations may make the adversarial sample insufficient in attack, and greater than 20 iterations may result in excessive computational overhead.
[0055] Preferably, the anti-attack algorithm is a PGD algorithm;
[0056] The PGD algorithm includes generating adversarial samples by repeatedly iterating and adjusting the perturbation using cross entropy loss, and satisfying the relationship:
[0057]
[0058] Among them, δ (t+1) represents the adversarial sample perturbation at the tth iteration, ∈ iter represents the iteration step size, which is used to adjust the perturbation size in each iteration. Represents the loss function L relative to the adversarial sample x+δ (t) The gradient of (t) Represents the perturbation generated after the t-1th iteration, and batch_multiply() indicates that the data is processed in batches.
[0059] Specifically, δ (t+1) represents the adversarial sample perturbation at the tth iteration, and each iteration is updated based on the previous perturbation. It guides how to adjust the perturbation of the current adversarial sample in order to maximize the value of the loss function, that is, how to maximize the deception of the image classification recognition model. It is worth noting that PGD (Projected Gradient Descent) is an effective adversarial attack tool with flexibility, adjustable parameters and convergence. They can generate high-quality adversarial samples. By controlling the perturbation range, the samples are visually similar to the original samples. They are widely applicable to various models, support multiple attack modes, and improve the robustness of the model in adversarial training. Because of its simplicity and ease of implementation, it is widely used in research and development.
[0060] Preferably, the mixing of the original sample with the first adversarial sample using the CutMix method comprises:
[0061] Select a random position, and crop a preset rectangular area at the random position of the original sample to obtain an original sub-sample;
[0062] Replace the original sub-sample with the rectangular areas at random positions of two different first adversarial samples to obtain two different second adversarial samples, and generate the second adversarial sample, and satisfy the relationship:
[0063] x cutmix1 =x·M+x1·(1-M);
[0064] x cutmix2 =x·M+x2·(1-M);
[0065] Where M is used to indicate the original subsample at a random position, x cutmix1 and x cutmix2 represents a different second adversarial sample, x represents the original sample, and x1 and x2 represent different first adversarial samples.
[0066] Specifically, a position is randomly selected from the original sample, and a rectangular area is cropped at this position to form an original sub-sample, which ensures the randomness of the cropped area and makes the generated adversarial samples diverse. By retaining a part of the original sample in the new sample, the characteristics and information of the original sample can be effectively maintained. Due to random cropping at different positions, the generated adversarial samples have greater diversity in features and can cover a wider attack space, improving the generalization ability of the model. The generated adversarial samples are visually similar to the original samples, which can reduce the risk of misclassification of the model in the real world. Visual consistency helps to train more robust models, so that image classification and recognition models can handle changes in real scenes.
[0067] The Mixup method is used to mix different second adversarial samples to generate a third adversarial sample, satisfying the relationship:
[0068] xmixup =λ·x cutmix1 +(1-λ)·x cutmix2 ;
[0069] Among them, λ~Beta(α,α) represents a parameter randomly sampled from the Beta distribution, x cutmix1 and x cutmix2 Denotes different second adversarial examples.
[0070] The basic idea of the Mixup method is to perform a weighted combination of different samples to generate new training samples. Through the Mixup method, the model can learn a smoother decision boundary and enhance its adaptability to unseen data. Beta distribution is a continuous probability distribution, which is often used to model random variables between 0 and 1. By sampling from the Beta distribution, a λ value can be obtained. λ determines the weighted ratio of the two second adversarial samples. When λ is close to 1, the generated third adversarial sample is more biased towards the first adversarial sample x. cutmix1 , when λ is close to 0, the generated third adversarial sample is more similar to the second adversarial sample x cutmix2 , so that the generated samples have a certain diversity between the original samples and the adversarial samples, enhancing the diversity of the training data.
[0071] Preferably, performing adversarial training on the image classification recognition model according to the third adversarial sample and the soft label strategy includes:
[0072] Use the soft label strategy to adjust the target label of the cross entropy loss function from a hard label to a soft label, satisfying the relationship:
[0073] y smooth =(1-∈)·y hard +∈ / K;
[0074] Among them, ∈ represents the smoothing factor, y hard represents the hard label, K represents the total number of categories, and y smooth Indicates a soft tag;
[0075] The third adversarial sample is input into the image classification and recognition model to be trained, and adversarial training is performed on the image classification and recognition model based on the cross entropy loss corresponding to the soft label.
[0076] Soft labels provide a probability distribution rather than a definite category. Compared with hard labels, soft labels allow the model to make smoother decisions between different categories. The smoothing factor ∈ is used to control the smoothness of the soft label. A smaller ∈ will make the soft label closer to the hard label, while a larger ∈ will increase the degree of mixing between categories. ∈ / K ensures that each category has a minimum probability. Then, the third adversarial sample generated in step S2 is input into the image classification and recognition model. The cross entropy loss function is used to calculate the gap between the output of the image classification and recognition model and the soft label. The model parameters are updated according to the calculated gap, which enhances the robustness of the image classification and recognition model and improves its generalization ability, so that it can better cope with complex and changeable input data in the real world.
[0077] like Figure 2 As shown, an image classification and recognition system adopts the above-mentioned image classification and recognition method, characterized in that the image classification and recognition system includes:
[0078] The sample generation module 1 is used to obtain the original sample, use the adversarial attack algorithm with the cross entropy loss function as the evaluation criterion to attack the image classification recognition model, and generate a number of different first adversarial samples corresponding to the original sample;
[0079] A sample mixing module 2 is used to mix the original sample with the first adversarial sample using the CutMix method to generate a second adversarial sample, and to mix different second adversarial samples using the Mixup method to generate a third adversarial sample;
[0080] The model training module 3 is used to perform adversarial training on the image classification and recognition model according to the third adversarial sample and the soft label strategy, and classify and recognize images using the trained image classification and recognition model.
[0081] In addition, an embodiment of the present invention further proposes a terminal device, which includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein the program is configured to implement the steps of the image classification and recognition method as described above.
[0082] Since the program is configured to implement the steps of the image classification and recognition method as described above, the program at least has all the beneficial effects brought about by all the technical solutions of all the aforementioned embodiments, which will not be described one by one here.
[0083] In addition, an embodiment of the present invention further provides a storage medium, on which an image classification and recognition program is stored. When the image classification and recognition program is executed by a processor, the steps of the image classification and recognition method described above are implemented.
[0084] Since all the technical solutions of all the aforementioned embodiments are adopted when the image classification and recognition program is executed by the processor, it has at least all the beneficial effects brought by all the technical solutions of all the aforementioned embodiments, which will not be described one by one here.
[0085] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.
[0086] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.
Claims
1. An image classification and recognition method, characterized in that: The image classification and recognition method comprises the following steps: S1: Obtain the original sample, use the adversarial attack algorithm with the cross entropy loss function as the evaluation criterion to attack the image classification recognition model, and generate several different first adversarial samples corresponding to the original sample; S2: Use the CutMix method to mix the original sample with the first adversarial sample to generate a second adversarial sample, and use the Mixup method to mix different second adversarial samples to generate a third adversarial sample; S3: Perform adversarial training on the image classification and recognition model according to the third adversarial sample and the soft label strategy, and use the trained image classification and recognition model to classify and recognize images.
2. The image classification and recognition method according to claim 1, characterized in that: Before using the adversarial attack algorithm with the cross entropy loss function as the evaluation criterion to attack the image classification recognition model, the perturbation amplitude and the number of iterations are also set; The disturbance amplitude is set to 8 / 255, and the number of iterations is set to 10.
3. The image classification and recognition method according to claim 1, characterized in that: The anti-attack algorithm is the PGD algorithm; The PGD algorithm includes generating adversarial samples by repeatedly iterating and adjusting the perturbation using cross entropy loss, and satisfying the relationship: Among them, δ (t+1) represents the adversarial sample perturbation at the tth iteration, ∈ iter represents the iteration step size, which is used to adjust the perturbation size in each iteration. Represents the loss function L relative to the adversarial sample x+δ (t) The gradient of (t) Represents the perturbation generated after the t-1th iteration, and batch_multiply() indicates that the data is processed in batches.
4. The image classification and recognition method according to claim 1, characterized in that: The method of using the CutMix method to mix the original sample with the first adversarial sample includes: Select a random position, and crop a preset rectangular area at the random position of the original sample to obtain an original sub-sample; Replace the original sub-sample with the rectangular areas at random positions of two different first adversarial samples to obtain two different second adversarial samples, and generate the second adversarial sample, and satisfy the relationship: x cutmix1 =x·M+x1·(1-M); x cutmix2 =x·M+x2·(1-M); Where M is used to indicate the original subsample at a random position, x cutmix1 and x cutmix2 represents a different second adversarial sample, x represents the original sample, and x1 and x2 represent different first adversarial samples.
5. The image classification and recognition method according to claim 4, characterized in that: The Mixup method is used to mix different second adversarial samples to generate a third adversarial sample, satisfying the relationship: x mixup =λ·x cutmix1 +(1-λ)·x cutmix2 ; Among them, λ~Beta(α,α) represents a parameter randomly sampled from the Beta distribution, x cutmix1 and x cutmix2 Denotes different second adversarial examples.
6. The image classification and recognition method according to claim 1, characterized in that: The adversarial training of the image classification recognition model based on the third adversarial sample and soft label strategy includes: Use the soft label strategy to adjust the target label of the cross entropy loss function from a hard label to a soft label, satisfying the relationship: and smooth =(1-∈)·y hard +∈ / K; Among them, ∈ represents the smoothing factor, y hard represents the hard label, K represents the total number of categories, and y smooth Indicates a soft tag; The third adversarial sample is input into the image classification and recognition model to be trained, and adversarial training is performed on the image classification and recognition model based on the cross entropy loss corresponding to the soft label.
7. An image classification and recognition system, using the image classification and recognition method according to any one of claims 1 to 6, characterized in that: The image classification and recognition system comprises: A sample generation module is used to obtain an original sample, use an adversarial attack algorithm with a cross entropy loss function as an evaluation criterion to attack the image classification recognition model, and generate a number of different first adversarial samples corresponding to the original sample; A sample mixing module, used to mix the original sample with the first adversarial sample using the CutMix method to generate a second adversarial sample, and to mix different second adversarial samples using the Mixup method to generate a third adversarial sample; The model training module is used to perform adversarial training on the image classification and recognition model according to the third adversarial sample and the soft label strategy, and classify and recognize images using the trained image classification and recognition model.
8. A terminal device, characterized in that: The terminal device includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein the program is configured to implement the steps of the image classification and recognition method as described in any one of claims 1 to 6.
9. A storage medium, characterized in that: The storage medium stores an image classification and recognition program, which, when executed by a processor, implements the steps of the image classification and recognition method according to any one of claims 1 to 6.