A sensitive content real-time filtering method combined with manual review

Abstract

The present application belongs to the field of content review, and in particular to a sensitive content real-time filtering method combined with manual review, which reconstructs an event stream with timing context by receiving discrete data reported by Internet of Things terminals, combining device identification, time stamp proximity and event semantic association graph, adopts a pre-trained multi-modal model to complete feature extraction and sensitive preliminary screening, generates a semantic tuple containing sensitive topics, confidence, and trigger feature vector, and comprehensively calculates the review value by combining confidence difference, prediction distribution Shannon entropy, and sample feature Mahalanobis distance. If the numerical value exceeds the threshold, the content is pushed to the manual review end. According to the artificial feedback optimization mechanism parameters: after receiving the corrected classification label, the loss gradient is calculated to lock the key attribution features, the explicit regular rules are generated by referring to the feature value and floating range, and the rules are used as loss penalty items to iteratively update the model parameters, thereby continuously improving the accuracy of sensitive content filtering.

Description

Technical Field

[0001] This application belongs to the field of content moderation, and in particular relates to a real-time filtering method for sensitive content that combines human review. Background Technology

[0002] With the rapid development and widespread adoption of IoT technology, a large number of smart terminal devices are connected to the network in real time, generating massive amounts of discrete sensing data in diverse forms. IoT terminals are highly vulnerable to being exploited to upload sensitive content containing illegal information, necessitating the establishment of a real-time sensitive content filtering mechanism. The data reported by IoT devices is often fragmented and isolated. Traditional content moderation systems only analyze individual data nodes independently, lacking the ability to utilize the temporal sequence and contextual information between devices, and thus failing to accurately identify hidden sensitive events formed by piecing together data fragments.

[0003] In their paper, "Research on Multimodal Real-time Content Review for E-commerce Live Streaming Based on End-Edge-Cloud Collaboration," Chen Mao et al. constructed a layered detection framework of filtering, fine-tuning, and review for security detection scenarios involving high concurrency and continuous streaming data. They also designed a closed-loop governance mechanism covering security compliance and human-machine collaborative review, providing a reference framework for human-machine collaboration in content review. However, in the process of using manual review to ensure accuracy in existing technologies, the lack of a scientific sample value assessment mechanism leads to low-value data being blindly pushed to the manual review queue, resulting in a sharp increase in review manpower costs and serious delays in data processing.

[0004] Typically, the system first uses a pre-trained deep learning model to perform preliminary feature extraction and sensitivity scoring on the incoming data stream. When the confidence level of the model's output falls below a specific fixed threshold, a manual review process is triggered. Manually corrected label data is collected and periodically merged into the training set for overall model fine-tuning or retraining, thus achieving machine iteration of human review experience. However, in the evaluation phase, existing solutions struggle to measure the true review value of samples, resulting in low efficiency in human-machine collaboration and a lack of ability to dynamically adjust review thresholds. Traditional methods merely use human feedback as target labels for black-box backpropagation updates, lacking effective means to abstract the logic behind human corrections into explicit regularization rules to constrain the model's feature learning direction. This leads to a lag in the system's defense against new variants of sensitive content and hinders the accumulation and evolution of human-machine collaboration rules. Summary of the Invention

[0005] To improve the accuracy and efficiency of real-time filtering of sensitive content in the Internet of Things (IoT), this invention provides a real-time filtering method for sensitive content that combines manual review.

[0006] According to one aspect of the present invention, a method for real-time filtering of sensitive content combined with manual review is provided, comprising the following steps: Receive discrete data reported by IoT terminals, and reconstruct the discrete data into an event stream with contextual temporal relationships based on device identifier, timestamp proximity and a preset event semantic association graph; The event stream is subjected to feature extraction and initial sensitivity screening using a pre-trained multimodal content understanding model to obtain probabilistic semantic tuples containing sensitive topics, confidence levels, and trigger feature vectors. The review value of the probabilistic semantic tuples is calculated. The review value is obtained by linearly combining the difference between 1 and the confidence level, the Shannon entropy of the model's predicted distribution, and the Mahalanobis distance between the trigger feature vectors and the centroids of historically confirmed sensitive samples through weighted coefficients. When the review value exceeds the adjustment threshold, the event stream and the probabilistic semantic tuples are pushed to the manual review terminal and the review value is recorded. Upon receiving feedback labels, if the feedback label indicates low necessity for review, the weighting coefficient is negatively adjusted based on the difference between the recorded review value and the adjustment threshold. If the feedback label indicates a corrected classification label, the gradient of the loss function based on the label with respect to the parameters of the associated network layer is calculated. The feature dimension with the highest gradient magnitude is extracted as the key attribution feature. Based on the value of the key attribution feature in the current trigger feature vector and a preset floating margin, an explicit regularization rule is generated for the value range of the key attribution feature. In subsequent iterations, the explicit regularization rule is used as a penalty term input to the loss function to update the model parameters.

[0007] Optionally, the step of receiving discrete data reported by IoT terminals and reconstructing the discrete data into an event stream with contextual temporal relationships based on device identifiers, timestamp proximity, and a preset event semantic association graph includes: The received discrete data is parsed to extract the hardware media access control address as the device identifier, as well as the absolute timestamp at the microsecond level. The corresponding discrete data is allocated to the device-independent aggregation pool in memory according to the device identifier; In the device's independent collection pool, the absolute offset distance between the timestamps of adjacent first data and second data is calculated. When the absolute offset distance is less than a preset time step threshold, the first data and the second data are concatenated into an initial data chain. Using the device semantic node mapped by the device identifier of the first data in the initial data chain as the leaf node, traverse upwards in the preset event semantic association graph to query the parent node with the connection indication relationship, and extract the historical context data associated with the parent node. The historical context data is concatenated with the initial data chain in a time sequence to generate the event stream with contextual time sequence relationship.

[0008] Optionally, the step of using a pre-trained multimodal content understanding model to perform feature extraction and initial sensitivity screening on the event stream to obtain a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors includes: Extract the text data and image data consisting of RGB three channels from the event stream; The text data is input into the natural semantic branch of the multimodal content understanding model to extract text feature vectors of a preset dimension; The image data is input into the visual network branch of the multimodal content understanding model, and image feature vectors of the same dimension are extracted through residual connections and global pooling layers. The text feature vector and the image feature vector are concatenated and then reduced to 128 dimensions through a fully connected network layer to obtain the trigger feature vector; The trigger feature vector is input into the classification network layer of the multimodal content understanding model, and the probability prediction distribution corresponding to multiple preset sensitive categories is output. The maximum probability value is selected as the confidence level, and the sensitive category corresponding to the maximum probability value is selected as the sensitive topic. The sensitive topic, the confidence level, and the trigger feature vector are packaged and output as the probabilistic semantic tuple.

[0009] Optionally, the calculation of the review value of the probabilistic semantic tuple, wherein the review value is obtained by a linear combination of 1 and the confidence difference, the Shannon entropy of the model prediction distribution, and the Mahalanobis distance between the trigger feature vector and the centroid of the historically confirmed sensitive sample features through weighted coefficients, includes: The prediction distribution output by the multimodal content understanding model is obtained, and the Shannon entropy of the prediction distribution is obtained by calculating the sum of the products of the negative logarithms of each probability and the probability itself. Extract the 128-dimensional feature centroid vectors and corresponding covariance inverse matrices of historically confirmed sensitive samples stored in the system. Based on the trigger feature vector, the feature centroid vector, and the covariance inverse matrix, the Mahalanobis distance of the current trigger feature vector in the feature space is calculated. The difference between 1 and the confidence level, the Shannon entropy, and the Mahalanobis distance are obtained and multiplied by three independent weighting coefficients configured by the system, respectively. The audit value is obtained by summing the three product results.

[0010] Optionally, the step of pushing the event stream and probabilistic semantic tuple to the manual review terminal and recording the review value when the review value exceeds the adjustment threshold includes: Obtain the currently calculated audit value and load the preset floating-point adjustment threshold from the system cache; Compare the audit value with the adjustment threshold; When the review value exceeds the adjustment threshold, a push instruction is triggered, and a data packet containing the event stream and the probabilistic semantic tuple is pushed to the manual review terminal through an encrypted channel. Extract the current timestamp of the system, and write the audit value and the timestamp as traceability records into the security mechanism log table to complete the recording operation.

[0011] Optionally, the step of negatively adjusting the weighting coefficient based on the difference between the recorded audit value and the adjustment threshold includes: Read the review value recorded when the push was previously triggered from the system log table, and obtain the adjustment threshold at that time; Calculate the difference between the audit value and the adjustment threshold, and use it as a positive deviation value; Obtain the system's preset step drop ratio parameter, multiply the positive deviation value by the step drop ratio parameter, and obtain the baseline adjustment reduction; For the three weighted coefficients corresponding to 1 and the confidence difference, the Shannon entropy, and the Mahalanobis distance, the product of the baseline adjustment reduction and the absolute value of each weighted coefficient is calculated as the actual reduction amount. For weighted coefficients with a positive initial sign, the current value minus the actual reduction amount is divided by the preset positive lower limit threshold, and the maximum value is taken. For weighted coefficients with a negative initial sign, the current value plus the actual reduction amount is divided by the preset negative upper limit threshold, and the minimum value is taken. This ensures that each weight dimension does not become invalid and the logical attributes are not reversed, thus obtaining the final updated weighted coefficients, which are then overwritten by the original weighted coefficients and stored in the system.

[0012] Optionally, the step of generating an explicit regularization rule for the value range of the key attribution feature based on the value of the key attribution feature in the current triggering feature vector and a preset floating margin, and using the explicit regularization rule as a penalty term in the loss function to update the model parameters in subsequent iterations, includes: Determine whether the output value of the key attribution feature in the current forward propagation falls within the value range defined by the explicit regularization rule; If the value falls within the range, a penalty condition is triggered. The absolute deviation of the output value from the center of the range is calculated, and the difference between the half-width of the range and the absolute deviation is multiplied by a preset penalty coefficient to obtain a compensation difference. The compensation difference is used as a regularization penalty term and added to the original classification loss value calculated based on the corrected classification label to generate a global loss function; Based on the global loss function, the multimodal content understanding model is backpropagated and differentiated. The network layer parameters are updated using the gradient descent algorithm to limit the drift of the key attribution features into the value range.

[0013] According to another aspect of the present invention, a real-time filtering system for sensitive content combined with manual review is provided, comprising the following modules: The reconstruction module is used to receive discrete data reported by IoT terminals and reconstruct the discrete data into an event stream with contextual temporal relationships based on device identifiers, timestamp proximity, and a preset event semantic association graph. The calculation module is used to perform feature extraction and initial sensitivity screening on the event stream using a pre-trained multimodal content understanding model, to obtain a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors. The module calculates the review value of the probabilistic semantic tuple, which is obtained by linearly combining the difference between 1 and the confidence level, the Shannon entropy of the model's predicted distribution, and the Mahalanobis distance between the trigger feature vector and the centroid of the historically confirmed sensitive sample features through weighted coefficients. When the review value exceeds an adjustment threshold, the event stream and the probabilistic semantic tuple are pushed to the manual review terminal and the review value is recorded. The update module receives feedback labels. If the feedback label indicates low necessity for review, the weighting coefficient is negatively adjusted based on the difference between the recorded review value and the adjustment threshold. If the feedback label indicates a corrected classification label, the gradient of the loss function based on the label with respect to the parameters of the associated network layer is calculated. The feature dimension with the highest gradient magnitude is extracted as the key attribution feature. Based on the value of the key attribution feature in the current trigger feature vector and a preset floating margin, an explicit regularization rule is generated for the value range of the key attribution feature. In subsequent iterations, the explicit regularization rule is used as a penalty term input to the loss function to update the model parameters.

[0014] Preferably, the step of receiving discrete data reported by IoT terminals and reconstructing the discrete data into an event stream with contextual temporal relationships based on device identifiers, timestamp proximity, and a preset event semantic association graph includes: The received discrete data is parsed to extract the hardware media access control address as the device identifier, as well as the absolute timestamp at the microsecond level. The corresponding discrete data is allocated to the device-independent aggregation pool in memory according to the device identifier; In the device's independent collection pool, the absolute offset distance between the timestamps of adjacent first data and second data is calculated. When the absolute offset distance is less than a preset time step threshold, the first data and the second data are concatenated into an initial data chain. Using the device semantic node mapped by the device identifier of the first data in the initial data chain as the leaf node, traverse upwards in the preset event semantic association graph to query the parent node with the connection indication relationship, and extract the historical context data associated with the parent node. The historical context data is concatenated with the initial data chain in a time sequence to generate the event stream with contextual time sequence relationship.

[0015] Preferably, the step of using a pre-trained multimodal content understanding model to perform feature extraction and initial sensitivity screening on the event stream to obtain a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors includes: Extract the text data and image data consisting of RGB three channels from the event stream; The text data is input into the natural semantic branch of the multimodal content understanding model to extract text feature vectors of a preset dimension; The image data is input into the visual network branch of the multimodal content understanding model, and image feature vectors of the same dimension are extracted through residual connections and global pooling layers. The text feature vector and the image feature vector are concatenated and then reduced to 128 dimensions through a fully connected network layer to obtain the trigger feature vector; The trigger feature vector is input into the classification network layer of the multimodal content understanding model, and the probability prediction distribution corresponding to multiple preset sensitive categories is output. The maximum probability value is selected as the confidence level, and the sensitive category corresponding to the maximum probability value is selected as the sensitive topic. The sensitive topic, the confidence level, and the trigger feature vector are packaged and output as the probabilistic semantic tuple.

[0016] Preferably, the calculation of the review value of the probabilistic semantic tuple, wherein the review value is obtained by a linear combination of 1 and the confidence difference, the Shannon entropy of the model prediction distribution, and the Mahalanobis distance between the trigger feature vector and the centroid of the historically confirmed sensitive sample features through weighted coefficients, includes: The prediction distribution output by the multimodal content understanding model is obtained, and the Shannon entropy of the prediction distribution is obtained by calculating the sum of the products of the negative logarithms of each probability and the probability itself. Extract the 128-dimensional feature centroid vectors and corresponding covariance inverse matrices of historically confirmed sensitive samples stored in the system. Based on the trigger feature vector, the feature centroid vector, and the covariance inverse matrix, the Mahalanobis distance of the current trigger feature vector in the feature space is calculated. The difference between 1 and the confidence level, the Shannon entropy, and the Mahalanobis distance are obtained and multiplied by three independent weighting coefficients configured by the system, respectively. The audit value is obtained by summing the three product results.

[0017] Preferably, the step of pushing the event stream and probabilistic semantic tuple to the manual review terminal and recording the review value when the review value exceeds the adjustment threshold includes: Obtain the currently calculated audit value and load the preset floating-point adjustment threshold from the system cache; Compare the audit value with the adjustment threshold; When the review value exceeds the adjustment threshold, a push instruction is triggered, and a data packet containing the event stream and the probabilistic semantic tuple is pushed to the manual review terminal through an encrypted channel. Extract the current timestamp of the system, and write the audit value and the timestamp as traceability records into the security mechanism log table to complete the recording operation.

[0018] Preferably, the step of negatively adjusting the weighting coefficient based on the difference between the recorded audit value and the adjustment threshold includes: Read the review value recorded when the push was previously triggered from the system log table, and obtain the adjustment threshold at that time; Calculate the difference between the audit value and the adjustment threshold, and use it as a positive deviation value; Obtain the system's preset step drop ratio parameter, multiply the positive deviation value by the step drop ratio parameter, and obtain the baseline adjustment reduction; For the three weighted coefficients corresponding to 1 and the confidence difference, the Shannon entropy, and the Mahalanobis distance, the product of the baseline adjustment reduction and the absolute value of each weighted coefficient is calculated as the actual reduction amount. For weighted coefficients with a positive initial sign, the current value minus the actual reduction amount is divided by the preset positive lower limit threshold, and the maximum value is taken. For weighted coefficients with a negative initial sign, the current value plus the actual reduction amount is divided by the preset negative upper limit threshold, and the minimum value is taken. This ensures that each weight dimension does not become invalid and the logical attributes are not reversed, thus obtaining the final updated weighted coefficients, which are then overwritten by the original weighted coefficients and stored in the system.

[0019] Preferably, the step of generating an explicit regularization rule for the value range of the key attribution feature based on the value of the key attribution feature in the current triggering feature vector and a preset floating margin, and using the explicit regularization rule as a penalty term in the loss function to update the model parameters in subsequent iterations, includes: Determine whether the output value of the key attribution feature in the current forward propagation falls within the value range defined by the explicit regularization rule; If the value falls within the range, a penalty condition is triggered. The absolute deviation of the output value from the center of the range is calculated, and the difference between the half-width of the range and the absolute deviation is multiplied by a preset penalty coefficient to obtain a compensation difference. The compensation difference is used as a regularization penalty term and added to the original classification loss value calculated based on the corrected classification label to generate a global loss function; Based on the global loss function, the multimodal content understanding model is backpropagated and differentiated. The network layer parameters are updated using the gradient descent algorithm to limit the drift of the key attribution features into the value range.

[0020] This invention breaks down data silos and enhances the ability to perceive correlations and uncover deep semantics in multi-source data by reconstructing discrete data from IoT terminals into event streams with contextual temporal relationships. In the initial screening stage, multi-dimensional indicators such as model uncertainty, confidence differences, and feature space distance accurately represent the review value. Only high-value boundary samples are pushed for manual processing, reducing ineffective intervention and optimizing human resource allocation. A closed-loop optimization mechanism is constructed for the feedback results, avoiding review interference from low-value data by adjusting weighting coefficients. For manually corrected labels, gradient tracing is used to extract key attribution features to generate explicit regularization rules, which are then converted into penalty terms to constrain subsequent training. This transforms prior human knowledge into a basis for model parameter optimization, enhancing the model's accuracy and generalization ability in identifying sensitive content. Attached Figure Description

[0021] Figure 1 A flowchart illustrating a real-time filtering method for sensitive content that incorporates manual review; Figure 2 This is a diagram illustrating the fluctuation trend of the audit value and adjustment threshold. Figure 3 This is a schematic diagram of the trajectory of a feature-constrained penalty drift process; Figure 4 This is a diagram comparing the reliability of four types of algorithm combination mechanisms. Detailed Implementation

[0022] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0023] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0024] Reference Figure 1 This invention proposes a real-time filtering method for sensitive content that combines manual review, comprising the following steps: S1: Receive discrete data reported by IoT terminals, and reconstruct the discrete data into an event stream with contextual temporal relationships based on device identifier, timestamp proximity and a preset event semantic association graph.

[0025] The system utilizes the Mosquitto message middleware deployed on the edge gateway to receive discrete data packets in JSON format, including device identifiers, sensor readings, Base64-encoded on-site image data, and UNIX timestamps, published by various IoT terminals via the MQTT protocol. A data processing pipeline is built using the Apache Flink stream processing framework, calling the keyBy operator to partition the data stream according to device identifiers. An event time session window is applied using the window operator, setting a session interval timeout threshold based on timestamp proximity (e.g., 500ms) to aggregate temporally adjacent data into candidate time windows. An event semantic association graph is pre-constructed in memory using Python's NetworkX graph computing library, where nodes represent device semantic nodes mapped to device identifiers, directed edges represent topological connections and event logical associations between device nodes, and edge weights represent association transition probabilities. The system determines whether there is a directed connected path between the device nodes corresponding to each data point within a candidate time window in the event semantic association graph. If a connected path exists, the data within the candidate time window is sorted in ascending order by timestamp, merged, and encapsulated into a serialized data structure with contextual temporal relationships, thus obtaining the event stream.

[0026] As an optional implementation, the step of receiving discrete data reported by IoT terminals and reconstructing the discrete data into an event stream with contextual temporal relationships based on device identifiers, timestamp proximity, and a preset event semantic association graph includes: The received discrete data is parsed to extract the hardware media access control address as the device identifier, as well as the absolute timestamp at the microsecond level. The corresponding discrete data is allocated to the device-independent aggregation pool in memory according to the device identifier; In the device's independent collection pool, the absolute offset distance between the timestamps of adjacent first data and second data is calculated. When the absolute offset distance is less than a preset time step threshold, the first data and the second data are concatenated into an initial data chain. Using the device semantic node mapped by the device identifier of the first data in the initial data chain as the leaf node, traverse upwards in the preset event semantic association graph to query the parent node with the connection indication relationship, and extract the historical context data associated with the parent node. The historical context data is concatenated with the initial data chain in a time sequence to generate the event stream with contextual time sequence relationship.

[0027] When reconstructing discrete data, the data parsing module is invoked to unpack IoT reporting data packets in JSON or hexadecimal format, extracting the standard 48-bit hardware MAC address (e.g., 00:1A:2B:3C:4D:5E) as a unique device identifier, and extracting the microsecond-level absolute timestamp in UNIX timestamp format (e.g., 1633072800000000). An independent collection pool for each device, in the form of an ordered set or list, is established in a high-speed in-memory database such as Redis. The parsed discrete data is pushed into the corresponding pool in the order of arrival. Within the collection pool, the absolute timestamp offset between adjacent first and second data points is calculated in real time. The preferred range for the preset time step threshold is 50 to 500 ms (e.g., 200 ms, or 200,000 μs). When the absolute offset is less than this threshold, the two data segments are merged into an initial data chain by string concatenation or array expansion, eliminating high-frequency data fragments within a short period.

[0028] The system reads a pre-built event semantic association graph from a graph database such as Neo4j. This graph uses semantic nodes mapped to the MAC addresses of various IoT devices as leaf nodes. Starting from the MAC address node of the first data in the initial data chain, a depth-first or breadth-first search algorithm is executed to traverse upwards 1 to 3 levels, querying parent nodes with inclusion, preceding, or causal connection indicators, such as home gateway nodes or main control center nodes. The system then extracts the historical context data for the most recent 5 minutes stored in the attributes of these parent nodes. Following the chronological order, the extracted historical context data is used as preceding information and serialized and concatenated with the initial data chain to construct an event stream data packet containing environmental background information.

[0029] S2, the event stream is subjected to feature extraction and initial sensitivity screening using a pre-trained multimodal content understanding model to obtain a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors. The review value of the probabilistic semantic tuple is calculated. The review value is obtained by linearly combining the difference between 1 and the confidence level, the Shannon entropy of the model's predicted distribution, and the Mahalanobis distance between the trigger feature vector and the centroid of the historically confirmed sensitive sample features through weighted coefficients. When the review value exceeds the adjustment threshold, the event stream and the probabilistic semantic tuple are pushed to the manual review terminal and the review value is recorded.

[0030] The reconstructed event stream is input into a pre-trained multimodal content understanding model deployed on the PyTorch deep learning framework. This model employs a joint architecture of Visual Transformer and RoBERTa from the HuggingFace model library. The model's forward function is invoked to map the event stream to a unified high-dimensional hidden layer state, and the category label (CLS) vector from the last encoding layer output is extracted as the trigger feature vector. This trigger feature vector is input into the multilayer perceptron classification head, and the Softmax activation function is called to output the probability distribution tensor for each sensitive category dimension. The maximum probability value is obtained as the confidence score, and the category label mapped to the corresponding index is obtained as the sensitive topic. The sensitive topic, confidence score, and trigger feature vector are combined and packaged into a probabilistic semantic tuple data structure. When calculating the review value, the confidence score is subtracted from the aforementioned confidence score by a constant 1 to calculate the confidence difference.

[0031] The Shannon entropy of the aforementioned probability distribution tensor is calculated using the `stats.entropy` function from the SciPy scientific computing library. The mean vector of all trigger feature vectors in the historical sensitive sample database is calculated using the NumPy numerical computing library as the feature centroid, and the inverse of the covariance matrix of the historical samples is calculated. The Mahalanobis distance between the current trigger feature vector and the feature centroid is then calculated. Three weighting coefficients are initialized, multiplied by the confidence difference, Shannon entropy, and Mahalanobis distance respectively, and summed to obtain the numerical review value. An adjustment threshold floating-point value is maintained in a Redis in-memory database. The calculated review value is compared with this threshold. If the review value is greater than the adjustment threshold, a communication channel established using Python's WebSockets asynchronous network library is used to serialize and send the event stream and probabilistic semantic tuples to the front-end manual review system interface. The current event stream identifier and the calculated review value are recorded in a MySQL relational database log table.

[0032] As an optional implementation, the step of using a pre-trained multimodal content understanding model to perform feature extraction and initial sensitivity screening on the event stream to obtain a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors includes: Extract the text data and image data consisting of RGB three channels from the event stream; The text data is input into the natural semantic branch of the multimodal content understanding model to extract text feature vectors of a preset dimension; The image data is input into the visual network branch of the multimodal content understanding model, and image feature vectors of the same dimension are extracted through residual connections and global pooling layers. The text feature vector and the image feature vector are concatenated and then reduced to 128 dimensions through a fully connected network layer to obtain the trigger feature vector; The trigger feature vector is input into the classification network layer of the multimodal content understanding model, and the probability prediction distribution corresponding to multiple preset sensitive categories is output. The maximum probability value is selected as the confidence level, and the sensitive category corresponding to the maximum probability value is selected as the sensitive topic. The sensitive topic, the confidence level, and the trigger feature vector are packaged and output as the probabilistic semantic tuple.

[0033] The pre-trained multimodal content understanding model takes text data from the event stream and image data consisting of RGB three channels as input. The network structure includes a natural language processing branch network, a visual network branch network, a fully connected network layer, and a classification network layer. The model outputs probability prediction distributions corresponding to multiple preset sensitive categories. The multimodal feature extraction and initial screening process uses a data separator to extract UTF-8 encoded text data (e.g., logs or sensor readings with a length limit of 512 characters) and Base64-decoded RGB three-channel image data (e.g., snapshots of the scene scaled to 224×224 resolution) from the reconstructed event stream. After word segmentation, the text data is input to a pre-trained BERT or TextCNN model (serving as the natural language processing branch), extracting the output corresponding to the CLS tags and generating dense text feature vectors with dimensions of 768 or 512. Image data is input into convolutional networks such as ResNet-50, which are branches of visual networks. After passing through multiple residual blocks containing skip connections, the image tensor is mapped to a 768-dimensional or 512-dimensional image feature vector with the same dimension as the text features by a global average pooling layer. This dimension consistency mechanism avoids the imbalance of feature magnitudes during modality fusion.

[0034] Text feature vectors and image feature vectors are concatenated along the channel dimension to form a 1536-dimensional or 1024-dimensional joint multimodal feature. This joint feature is fed into a fully connected network structure containing batch normalization, ReLU activation function, and a dropout layer with a dropout rate preferably between 0.3 and 0.5, for example, 0.4. The joint feature is nonlinearly mapped and dimensionality-reduced to 128 dimensions to obtain a trigger feature vector. The 128-dimensional trigger feature vector is fed into a classification network layer activated by Softmax at the end, which outputs a floating-point probability distribution vector with a length equal to the preset total number of sensitive categories, such as 10 categories including terrorism, pornography, and political issues. The system extracts the maximum probability value in this vector as the confidence level, identifies the corresponding category as the sensitive topic, and combines it with the original 128-dimensional trigger feature vector to construct a data structure containing the corresponding topic, confidence level, and specific feature array as a probabilistic semantic tuple for output.

[0035] As an optional implementation, the calculation of the audit value of the probabilistic semantic tuple, wherein the audit value is obtained by a linear combination of 1 and the confidence difference, the Shannon entropy of the model prediction distribution, and the Mahalanobis distance between the trigger feature vector and the feature centroid of historically confirmed sensitive samples through weighted coefficients, includes: The prediction distribution output by the multimodal content understanding model is obtained, and the Shannon entropy of the prediction distribution is obtained by calculating the sum of the products of the negative logarithms of each probability and the probability itself. Extract the 128-dimensional feature centroid vectors and corresponding covariance inverse matrices of historically confirmed sensitive samples stored in the system. Based on the trigger feature vector, the feature centroid vector, and the covariance inverse matrix, the Mahalanobis distance of the current trigger feature vector in the feature space is calculated. The difference between 1 and the confidence level, the Shannon entropy, and the Mahalanobis distance are obtained and multiplied by three independent weighting coefficients configured by the system, respectively. The audit value is obtained by summing the three product results.

[0036] The evaluation of audit value begins with an analysis of the uncertainty in the model output, by reading the probability prediction distribution array containing N categories from the output of the multimodal classification network. The information entropy H of the overall distribution is calculated using the Shannon entropy formula. For example, when the probability distribution is relatively flat, such as 0.33, 0.33, and 0.34, the Shannon entropy value approaches its maximum value of approximately 1.58, indicating the uncertainty of the model's decision-making and suggesting that human intervention is of high value. The 128-dimensional feature centroid vector C of historically confirmed real sensitive sample groups in the same category (i.e., the arithmetic mean of the triggering features of all real sensitive samples in that category) and the pre-calculated 128×128 covariance inverse matrix are loaded from the offline feature library. Using the formula Calculate the Mahalanobis distance D between the current 128-dimensional trigger feature vector X and the feature centroid C. This step eliminates scale differences and correlation interference between feature dimensions, and measures the spatial distance of the current sample from the known sensitivity paradigm. The smaller the distance, the closer it is to a typical sensitive sample.

[0037] After obtaining the three core indicators mentioned above, the difference between 1 and the confidence level is calculated to obtain the confidence difference, which represents the model's degree of confidence in single-class prediction. This difference, Shannon entropy, and Mahalanobis distance are then substituted into the weighted summation module. Optionally, normalization is performed before weighted summation. Three independent floating-point weighting coefficients are configured, with their preferred ranges set as follows: The corresponding confidence level difference is such as 0.5. Corresponding Shannon entropy such as 0.3 and The Mahalanobis distance is weighted negatively because a smaller distance has a higher audit value, such as -0.2. Linear combination calculation is then performed. If a sample has a confidence level of 0.6, a Shannon entropy of 1.2, and a Mahalanobis distance of 2.5, then the overall score is 0.06. The audit value, accurate to four decimal places, is output to determine the necessity of human intervention.

[0038] As an optional implementation, the step of pushing the event stream and probabilistic semantic tuple to the manual review terminal and recording the review value when the review value exceeds the adjustment threshold includes: Obtain the currently calculated audit value and load the preset floating-point adjustment threshold from the system cache; Compare the audit value with the adjustment threshold; When the review value exceeds the adjustment threshold, a push instruction is triggered, and a data packet containing the event stream and the probabilistic semantic tuple is pushed to the manual review terminal through an encrypted channel. Extract the current timestamp of the system, and write the audit value and the timestamp as traceability records into the security mechanism log table to complete the recording operation.

[0039] When determining whether data needs to be transferred to manual processing, the system reads the current calculated double-precision floating-point audit value (e.g., 0.7654) from a memory cache such as Memcached or Redis, and loads a floating-point adjustment threshold updated by a background scheduled task. The preferred range for this adjustment threshold is between 0.60 and 0.85, with the actual value fluctuating in real-time due to a closed-loop control of the current audit team queue length and the overall false positive rate of the model. For example, if the queuing pressure is currently high, the threshold is automatically raised to 0.7500. An internal comparator compares the two values. If the logical determination is true (i.e., the current audit value of 0.7654 is greater than the adjustment threshold of 0.7500), an asynchronous push thread is initiated and a push command is generated. This thread serializes and encapsulates the reconstructed event stream context original text, image tensors, and structured probabilistic semantic tuples into a JSON-formatted data packet. Using an RSA-2048 encrypted WebSocket long connection established with the TLS 1.3 protocol, it delivers the packet to the pending task pool of the manual audit terminal in a low-latency manner.

[0040] After the secure push of the data packet is completed, to ensure the traceability of relevant parameters during subsequent model adjustments, the underlying time function is called to obtain the millisecond-level UNIX timestamp of the trigger moment, such as 1698765432123. The database management module uses this timestamp as the primary key, combined with the audit value that triggered the push, the unique identifier task ID of the event stream, and the adjustment threshold at that time, to construct a formatted traceability record SQL insert statement. This statement includes fields such as timestamp, task identifier, audit value, and adjustment threshold. The data is persistently stored in the security mechanism log table of a relational database such as PostgreSQL using a non-blocking asynchronous write method, thus completing the closed loop of the warning record. Figure 2 The dotted line represents the adjustment threshold maintained by the system in real time, and the triangular marker line represents the review value calculated in real time for a single task. The comparison of the two values ​​indicates the triggering logic for manual review push. When the review value exceeds the adjustment threshold, the task will be pushed to the manual terminal.

[0041] S3, Receive feedback labels. If the feedback label indicates low necessity for review, negatively adjust the weighting coefficient based on the difference between the recorded review value and the adjustment threshold. If the feedback label indicates a corrected classification label, calculate the gradient of the loss function based on the label with respect to the parameters of the associated network layer, extract the feature dimension with the highest gradient magnitude as the key attribution feature, and generate an explicit regularization rule for the value range of the key attribution feature based on the value of the key attribution feature in the current trigger feature vector and a preset floating margin. In subsequent iterations, the explicit regularization rule is used as a penalty term input to the loss function to update the model parameters.

[0042] A Python-based FastAPI web framework is used to build an application programming interface (API) to listen for and receive feedback tag data manually submitted by the review terminal. Conditional branching statements are written to determine the type of feedback tag. If the feedback tag is a predefined low enumeration value of review necessity, the review value of the previous record is retrieved from the MySQL log table. The difference between this review value and the adjustment threshold is calculated, and a small step reduction ratio parameter is constructed. The difference is multiplied by the step reduction ratio parameter to obtain the attenuation baseline, causing the absolute values ​​of the weighted coefficients corresponding to the confidence difference, Shannon entropy, and Mahalanobis distance to shrink towards zero. The magnitude of the weighted coefficients is then weakened and updated using positive and negative boundary thresholds. If the feedback tag is a manually corrected true classification tag, the cross-entropy loss value between the current multimodal content understanding model's predicted probability distribution and the true classification tag is calculated. The backward propagation method of the loss object is called to calculate the partial derivatives of the loss function with respect to the multilayer perceptron classification head weight parameters and the trigger feature vector. Obtain the gradient tensor corresponding to the trigger feature vector, calculate the absolute value to obtain the gradient magnitude, use the torch.argmax function to extract the index of the element with the largest magnitude, and determine the dimension represented by this index as the key attribution feature dimension.

[0043] The scalar value of the current trigger feature vector in the key attribution feature dimension is read. This scalar value is then added to and subtracted from the preset float margin value read from the system configuration file to generate the upper and lower bound intervals for this dimension. These intervals are then constructed as explicit regularization rules in a key-value pair structure and stored in the configuration dictionary. During subsequent online incremental training iterations of the multimodal content understanding model, in addition to calculating the standard cross-entropy loss, the explicit regularization rules in the configuration dictionary are traversed to extract the values ​​of the trigger feature vectors of new input batch samples in the key attribution feature dimension. It is determined whether these values ​​fall within the generated upper and lower bound intervals. If they do, the absolute deviation of the value from the center of the interval is calculated, and the difference between the half-width of the interval and the absolute deviation is used as the penalty benchmark value. Otherwise, the penalty benchmark value is 0. This penalty benchmark value is multiplied by the regularization coefficient and added to the cross-entropy loss as a penalty term to obtain the total loss value. The step function of the torch.optim.AdamW optimizer object is used to perform gradient descent based on the total loss value to update the model's network layer parameters.

[0044] As an optional implementation, the step of negatively adjusting the weighting coefficient based on the difference between the recorded audit value and the adjustment threshold includes: Read the review value recorded when the push was previously triggered from the system log table, and obtain the adjustment threshold at that time; Calculate the difference between the audit value and the adjustment threshold, and use it as a positive deviation value; Obtain the system's preset step drop ratio parameter, multiply the positive deviation value by the step drop ratio parameter, and obtain the baseline adjustment reduction; For the three weighted coefficients corresponding to 1 and the confidence difference, the Shannon entropy, and the Mahalanobis distance, the product of the baseline adjustment reduction and the absolute value of each weighted coefficient is calculated as the actual reduction amount. For weighted coefficients with a positive initial sign, the current value minus the actual reduction amount is divided by the preset positive lower limit threshold, and the maximum value is taken. For weighted coefficients with a negative initial sign, the current value plus the actual reduction amount is divided by the preset negative upper limit threshold, and the minimum value is taken. This ensures that each weight dimension does not become invalid and the logical attributes are not reversed, thus obtaining the final updated weighted coefficients, which are then overwritten by the original weighted coefficients and stored in the system.

[0045] When the system receives a low-needs-of-review feedback label from the manual review terminal, indicating that the sample is a false alarm and lacks analytical value, the model adjustment module performs a SELECT query on the log table in the relational database based on the task ID of the event stream. This retrieves the review value (e.g., 0.8500) recorded at the time of the trigger push and the adjustment threshold (e.g., 0.7500) at that time. The difference of 0.1000 is calculated as a positive deviation value, representing the magnitude by which the algorithm overestimates the review value of the current sample. The step reduction ratio parameter in the system configuration table is loaded. The preferred setting range for this parameter is 0.05 to 0.15. If set to 0.1, the positive deviation value of 0.1000 is multiplied by the step reduction ratio of 0.1 to calculate a scalar-form baseline adjustment reduction of 0.0100, which serves as the baseline step size for this coefficient decay. When updating the three independent weighted coefficients, a zero-decay strategy based on the current weight ratio is adopted.

[0046] Assume the three weighting coefficients for the current confidence difference, Shannon entropy, and Mahalanobis distance are as follows: Calculate the actual absolute value reduction to be deducted for each coefficient, i.e., the base adjustment reduction multiplied by the absolute value of the current coefficient. For example, for... The reduction amount was 0.0050, for The absolute value reduction is 0.0020. Perform a shrinkage operation towards zero: reduce the positive coefficient... Subtracting 0.0050 yields an initial difference of 0.4950; the negative coefficient... Adding 0.0020 reduces its absolute value, resulting in an initial difference of -0.1980. To prevent excessive weight decay during continuous adjustments from causing dimension invalidation or sign reversal leading to system evaluation logic collapse, a two-way protection boundary is established for both positive and negative weights: For the positive weighting coefficients corresponding to the confidence difference and Shannon entropy and The preferred range for setting a lower limit for positive values ​​is 0.01 to 0.05, for example, 0.05. By calling Python's built-in maximum value function, max(0.4950, 0.05), it is ensured that each updated positive coefficient is not lower than this safe lower limit.

[0047] For the negative weighting coefficients corresponding to the Mahalanobis distance The upper limit threshold for negative values ​​is set to a preferred range of -0.05 to -0.01, for example, -0.05. By calling the minimum value function, min(-0.1980, -0.05), since -0.1980 is mathematically less than -0.05, the result returns -0.1980. If the initial difference approaches zero in subsequent decay iterations, for example, reaching -0.02, then min(-0.02, -0.05) will return -0.05. This mechanism ensures that the absolute value of the negative weight decreases to weaken the judgment influence, while being intercepted by the safety upper limit during its continuous decay towards zero, always maintaining the negative attribute. The smaller the distance, the greater the review value. The three newly obtained weighting coefficients are serialized and overwritten with the original configuration parameters, and refreshed to the global cache memory for subsequent concurrent review tasks to read in real time, achieving a smooth suppression of the review judgment weight.

[0048] As an optional implementation, the step of generating an explicit regularization rule for the value range of the key attribution feature based on the value of the key attribution feature in the current trigger feature vector and a preset floating margin, and then using the explicit regularization rule as a penalty term to update the model parameters in subsequent iterations, includes: Determine whether the output value of the key attribution feature in the current forward propagation falls within the value range defined by the explicit regularization rule; If the value falls within the range, a penalty condition is triggered. The absolute deviation of the output value from the center of the range is calculated, and the difference between the half-width of the range and the absolute deviation is multiplied by a preset penalty coefficient to obtain a compensation difference. The compensation difference is used as a regularization penalty term and added to the original classification loss value calculated based on the corrected classification label to generate a global loss function; Based on the global loss function, the multimodal content understanding model is backpropagated and differentiated. The network layer parameters are updated using the gradient descent algorithm to limit the drift of the key attribution features into the value range.

[0049] Upon receiving corrected classification labels from manual review and initiating incremental fine-tuning training, the multimodal network, during the forward propagation of the current data batch, uses a built-in tensor monitor to intercept output values ​​of specific neuron channels identified as key attribution features. For example, the activation value of the 42nd dimension feature in the current sample is 0.75. The network then reads the explicit regularization rules previously generated using the gradient interpretation algorithm and a preset float margin of ±0.15, extracting a defined taboo value range. Assuming the range is 0.60 to 0.90, the center point is 0.75, and the half-width of the range is 0.15. Logical operator comparison reveals that the current activation value of 0.75 falls within this taboo range, triggering the regularization penalty condition. The absolute deviation value is calculated using the absolute value function d = |output value - interval center| (here, d = 0). The absolute deviation value is subtracted from the half-width of the interval (0.15), resulting in 0.15. This result is then multiplied by a preset penalty coefficient, preferably between 1.0 and 5.0 (e.g., set to 2.0), resulting in a penalty compensation difference of 0.30.

[0050] The closer the activation value is to the center of the tabu region, the larger the resulting penalty compensation difference. This scalar compensation difference of 0.30 is considered an explicit regularization penalty term, accumulated and added to the original classification loss calculated by the model using the cross-entropy algorithm and the manually corrected classification labels (e.g., a base loss of 1.20), resulting in a global loss function with a total value of 1.50. In the subsequent backpropagation stage, the automatic differentiation engine of the deep learning framework calculates the partial derivatives of the parameters of the fully connected layers and upstream convolutional and self-attention network nodes based on the global loss function carrying the penalty term. The AdamW or SGD optimization algorithm is then used at a set small learning rate. Next, the parameter weights are updated. The gradient update path is equivalent to applying a repulsive force to the neuron in the high-dimensional feature space, constraining and guiding the key attribution feature to shift its output value outside the range (less than 0.60 or greater than 0.90) when encountering similar data distributions, thus blocking the feature activation path that caused the original misjudgment. (Refer to...) Figure 3 As the fine-tuning rounds progress, the activation volume gradually moves out of the forbidden zone, correcting the false alarm path.

[0051] After obtaining the probabilistic semantic tuples from the initial model screening output and receiving the feedback tags returned by the manual review terminal, the data flow routing node is synchronously triggered to perform substantive filtering control actions. Specifically, an action execution engine driven by the policy distribution component is constructed: if the review value of the current event flow does not exceed the adjustment threshold and the confidence level of the sensitive category is higher than the preset violation red line, or the manual review terminal returns a classification tag confirming violation, then an interception policy is triggered. An intervention command is issued to the corresponding edge gateway and message middleware through the MQTT protocol or downlink control interface to directly delete the event flow from the data consumption queue flowing to the business application layer, or to replace sensitive text in the original JSON message with an asterisk mask, or to perform pixel-level Gaussian blurring on the on-site image data and then store it in a secure isolation area; conversely, if the confidence level of the sensitive category is lower than the security red line, or if a feedback tag indicating low review necessity (i.e., a security false alarm) is received from the manual review terminal, then a release policy is triggered. After adding a security-certified digital signature to the reconstructed event flow, it is allowed to continue flowing to the front-end IoT business.

[0052] The self-built IoT multimodal audit dataset contains 100,000 discrete sensor text and on-site image samples, with sensitive samples accounting for 20%. All experimental groups use the same multimodal content understanding model infrastructure with a uniform batch size of 64. The experiment is divided into four groups for comparison: the baseline model group only uses multimodal feature fusion and fixed confidence threshold for initial screening; the value assessment group adds an audit value calculation module based on Shannon entropy and Mahalanobis distance to the baseline; the adjustment group adds a weighted coefficient negative adjustment mechanism to the value assessment group; and the complete solution group adds an explicit regular rule loss function penalty fine-tuning mechanism to the adjustment group.

[0053] The experimental data and results show that the baseline model group's manual review accuracy was only 65.2%, with a false positive rate as high as 14.5% and an average single-stream latency of 1.2 seconds. The value assessment group improved the manual review accuracy to 78.6% and reduced the false positive rate to 10.2%. The adjustment group improved the manual review accuracy to 85.4% and reduced the false positive rate to 7.1%. The complete solution group performed best among all indicators, achieving a manual review accuracy of 94.8%, reducing the false positive rate to 2.3%, and achieving an average stream latency of 1.6 seconds. The comparative results show that the complete solution improves review accuracy and suppresses system false positives with only a slight increase in computational time. Figure 4 From the baseline model group to the complete solution group, the accuracy gradually improved and the false alarm rate continued to decrease, indicating the stepwise optimization effect of each module on the system performance.

[0054] This invention also proposes a real-time sensitive content filtering system that combines manual review, comprising the following modules: The reconstruction module is used to receive discrete data reported by IoT terminals and reconstruct the discrete data into an event stream with contextual temporal relationships based on device identifiers, timestamp proximity, and a preset event semantic association graph. The calculation module is used to perform feature extraction and initial sensitivity screening on the event stream using a pre-trained multimodal content understanding model, to obtain a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors. The module calculates the review value of the probabilistic semantic tuple, which is obtained by linearly combining the difference between 1 and the confidence level, the Shannon entropy of the model's predicted distribution, and the Mahalanobis distance between the trigger feature vector and the centroid of the historically confirmed sensitive sample features through weighted coefficients. When the review value exceeds an adjustment threshold, the event stream and the probabilistic semantic tuple are pushed to the manual review terminal and the review value is recorded. The update module receives feedback labels. If the feedback label indicates low necessity for review, the weighting coefficient is negatively adjusted based on the difference between the recorded review value and the adjustment threshold. If the feedback label indicates a corrected classification label, the gradient of the loss function based on the label with respect to the parameters of the associated network layer is calculated. The feature dimension with the highest gradient magnitude is extracted as the key attribution feature. Based on the value of the key attribution feature in the current trigger feature vector and a preset floating margin, an explicit regularization rule is generated for the value range of the key attribution feature. In subsequent iterations, the explicit regularization rule is used as a penalty term input to the loss function to update the model parameters.

[0055] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0056] The functional modules shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0057] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for real-time filtering of sensitive content combined with manual review, characterized in that, Includes the following steps: Receive discrete data reported by IoT terminals, and reconstruct the discrete data into an event stream with contextual temporal relationships based on device identifier, timestamp proximity, and a preset event semantic association graph; The event stream is subjected to feature extraction and initial sensitivity screening using a pre-trained multimodal content understanding model to obtain probabilistic semantic tuples containing sensitive topics, confidence levels, and trigger feature vectors. The review value of the probabilistic semantic tuples is calculated. The review value is obtained by linearly combining the difference between 1 and the confidence level, the Shannon entropy of the model's predicted distribution, and the Mahalanobis distance between the trigger feature vectors and the centroids of historically confirmed sensitive samples through weighted coefficients. When the review value exceeds the adjustment threshold, the event stream and the probabilistic semantic tuples are pushed to the manual review terminal and the review value is recorded. Upon receiving feedback labels, if the feedback label indicates low necessity for review, the weighting coefficient is negatively adjusted based on the difference between the recorded review value and the adjustment threshold. If the feedback label indicates a corrected classification label, the gradient of the loss function based on the label with respect to the parameters of the associated network layer is calculated. The feature dimension with the highest gradient magnitude is extracted as the key attribution feature. Based on the value of the key attribution feature in the current trigger feature vector and a preset floating margin, an explicit regularization rule is generated for the value range of the key attribution feature. In subsequent iterations, the explicit regularization rule is used as a penalty term input to the loss function to update the model parameters.

2. The method according to claim 1, characterized in that, The process of receiving discrete data reported by IoT terminals and reconstructing the discrete data into an event stream with contextual temporal relationships based on device identifiers, timestamp proximity, and a preset event semantic association graph includes: The received discrete data is parsed to extract the hardware media access control address as the device identifier, as well as the absolute timestamp at the microsecond level. The corresponding discrete data is allocated to the device-independent aggregation pool in memory according to the device identifier; In the device's independent collection pool, the absolute offset distance between the timestamps of adjacent first data and second data is calculated. When the absolute offset distance is less than a preset time step threshold, the first data and the second data are concatenated into an initial data chain. Using the device semantic node mapped by the device identifier of the first data in the initial data chain as the leaf node, traverse upwards in the preset event semantic association graph to query the parent node with the connection indication relationship, and extract the historical context data associated with the parent node. The historical context data is concatenated with the initial data chain in a time sequence to generate the event stream with contextual time sequence relationship.

3. The method according to claim 1, characterized in that, The process of extracting features and performing initial sensitivity screening on the event stream using a pre-trained multimodal content understanding model yields a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors, including: Extract the text data and image data consisting of RGB three channels from the event stream; The text data is input into the natural semantic branch of the multimodal content understanding model to extract text feature vectors of a preset dimension; The image data is input into the visual network branch of the multimodal content understanding model, and image feature vectors of the same dimension are extracted through residual connections and global pooling layers. The text feature vector and the image feature vector are concatenated and then reduced to 128 dimensions through a fully connected network layer to obtain the trigger feature vector; The trigger feature vector is input into the classification network layer of the multimodal content understanding model, and the probability prediction distribution corresponding to multiple preset sensitive categories is output. The maximum probability value is selected as the confidence level, and the sensitive category corresponding to the maximum probability value is selected as the sensitive topic. The sensitive topic, the confidence level, and the trigger feature vector are packaged and output as the probabilistic semantic tuple.

4. The method according to claim 1, characterized in that, The calculation of the review value of the probabilistic semantic tuple, wherein the review value is obtained by a linear combination of 1 and the confidence difference, the Shannon entropy of the model prediction distribution, and the Mahalanobis distance between the trigger feature vector and the feature centroid of historically confirmed sensitive samples through weighted coefficients, includes: The prediction distribution output by the multimodal content understanding model is obtained, and the Shannon entropy of the prediction distribution is obtained by calculating the sum of the products of the negative logarithms of each probability and the probability itself. Extract the 128-dimensional feature centroid vectors and corresponding covariance inverse matrices of historically confirmed sensitive samples stored in the system. Based on the trigger feature vector, the feature centroid vector, and the covariance inverse matrix, the Mahalanobis distance of the current trigger feature vector in the feature space is calculated. The difference between 1 and the confidence level, the Shannon entropy, and the Mahalanobis distance are obtained and multiplied by three independent weighting coefficients configured by the system, respectively. The audit value is obtained by summing the three product results.

5. The method according to claim 1, characterized in that, The step of pushing the event stream and probabilistic semantic tuple to the manual review terminal and recording the review value when the review value exceeds the adjustment threshold includes: Obtain the currently calculated audit value and load the preset floating-point adjustment threshold from the system cache; Compare the audit value with the adjustment threshold; When the review value exceeds the adjustment threshold, a push instruction is triggered, and a data packet containing the event stream and the probabilistic semantic tuple is pushed to the manual review terminal through an encrypted channel. Extract the current timestamp of the system, and write the audit value and the timestamp as traceability records into the security mechanism log table to complete the recording operation.

6. The method according to claim 1, characterized in that, The step of negatively adjusting the weighting coefficient based on the difference between the recorded audit value and the adjustment threshold includes: Read the review value recorded when the push was previously triggered from the system log table, and obtain the adjustment threshold at that time; Calculate the difference between the audit value and the adjustment threshold, and use it as a positive deviation value; Obtain the system's preset step drop ratio parameter, multiply the positive deviation value by the step drop ratio parameter, and obtain the baseline adjustment reduction; For the three weighted coefficients corresponding to 1 and the confidence difference, the Shannon entropy, and the Mahalanobis distance, the product of the baseline adjustment reduction and the absolute value of each weighted coefficient is calculated as the actual reduction amount. For weighted coefficients with a positive initial sign, the current value minus the actual reduction amount is divided by the preset positive lower limit threshold, and the maximum value is taken. For weighted coefficients with a negative initial sign, the current value plus the actual reduction amount is divided by the preset negative upper limit threshold, and the minimum value is taken. This ensures that each weight dimension does not become invalid and the logical attributes are not reversed, thus obtaining the final updated weighted coefficients, which are then overwritten by the original weighted coefficients and stored in the system.

7. The method according to claim 1, characterized in that, The process of generating explicit regularization rules for the value range of the key attribution features based on their values ​​in the current triggering feature vector and a preset floating margin, and then using these explicit regularization rules as penalty terms in subsequent iterations to update the model parameters in the loss function, includes: Determine whether the output value of the key attribution feature in the current forward propagation falls within the value range defined by the explicit regularization rule; If the value falls within the range, a penalty condition is triggered. The absolute deviation of the output value from the center of the range is calculated, and the difference between the half-width of the range and the absolute deviation is multiplied by a preset penalty coefficient to obtain a compensation difference. The compensation difference is used as a regularization penalty term and added to the original classification loss value calculated based on the corrected classification label to generate a global loss function; Based on the global loss function, the multimodal content understanding model is backpropagated and differentiated. The network layer parameters are updated using the gradient descent algorithm to limit the drift of the key attribution features into the value range.

8. A real-time sensitive content filtering system that combines manual review, characterized in that, Includes the following modules: The reconstruction module is used to receive discrete data reported by IoT terminals and reconstruct the discrete data into an event stream with contextual temporal relationships based on device identifiers, timestamp proximity, and a preset event semantic association graph. The calculation module is used to perform feature extraction and initial sensitivity screening on the event stream using a pre-trained multimodal content understanding model, to obtain a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors. The module calculates the review value of the probabilistic semantic tuple, which is obtained by linearly combining the difference between 1 and the confidence level, the Shannon entropy of the model's predicted distribution, and the Mahalanobis distance between the trigger feature vector and the centroid of the historically confirmed sensitive sample features through weighted coefficients. When the review value exceeds an adjustment threshold, the event stream and the probabilistic semantic tuple are pushed to the manual review terminal and the review value is recorded. The update module receives feedback labels. If the feedback label indicates low necessity for review, the weighting coefficient is negatively adjusted based on the difference between the recorded review value and the adjustment threshold. If the feedback label indicates a corrected classification label, the gradient of the loss function based on the label with respect to the parameters of the associated network layer is calculated. The feature dimension with the highest gradient magnitude is extracted as the key attribution feature. Based on the value of the key attribution feature in the current trigger feature vector and a preset floating margin, an explicit regularization rule is generated for the value range of the key attribution feature. In subsequent iterations, the explicit regularization rule is used as a penalty term input to the loss function to update the model parameters.

9. The system according to claim 8, characterized in that, The process of receiving discrete data reported by IoT terminals and reconstructing the discrete data into an event stream with contextual temporal relationships based on device identifiers, timestamp proximity, and a preset event semantic association graph includes: The received discrete data is parsed to extract the hardware media access control address as the device identifier, as well as the absolute timestamp at the microsecond level. The corresponding discrete data is allocated to the device-independent aggregation pool in memory according to the device identifier; In the device's independent collection pool, the absolute offset distance between the timestamps of adjacent first data and second data is calculated. When the absolute offset distance is less than a preset time step threshold, the first data and the second data are concatenated into an initial data chain. Using the device semantic node mapped by the device identifier of the first data in the initial data chain as the leaf node, traverse upwards in the preset event semantic association graph to query the parent node with the connection indication relationship, and extract the historical context data associated with the parent node. The historical context data is concatenated with the initial data chain in a time sequence to generate the event stream with contextual time sequence relationship.

10. The system according to claim 8, characterized in that, The process of extracting features and performing initial sensitivity screening on the event stream using a pre-trained multimodal content understanding model yields a probabilistic semantic tuple containing sensitive topics, confidence levels, and trigger feature vectors, including: Extract the text data and image data consisting of RGB three channels from the event stream; The text data is input into the natural semantic branch of the multimodal content understanding model to extract text feature vectors of a preset dimension; The image data is input into the visual network branch of the multimodal content understanding model, and image feature vectors of the same dimension are extracted through residual connections and global pooling layers. The text feature vector and the image feature vector are concatenated and then reduced to 128 dimensions through a fully connected network layer to obtain the trigger feature vector; The trigger feature vector is input into the classification network layer of the multimodal content understanding model, and the probability prediction distribution corresponding to multiple preset sensitive categories is output. The maximum probability value is selected as the confidence level, and the sensitive category corresponding to the maximum probability value is selected as the sensitive topic. The sensitive topic, the confidence level, and the trigger feature vector are packaged and output as the probabilistic semantic tuple.

Images