## 4 Methods for Manipulation Protection and Detection
### [PERSON] et al. [35]  
One of the newer approaches in the field of image manipulation detection is the method proposed by [PERSON] and collaborators [35]. The authors introduce an innovative solution that involves embedding pre-learned templates into images to facilitate subsequent manipulation detection. This method stands out for its active nature, as it does not passively analyze images for manipulations but instead embeds visually imperceptible templates into the original images. As a result, any manipulation performed by generative models alters the embedded templates in detectable ways, enabling the effective identification of changes--see Figure 4.  
The process of embedding templates into an image can be defined as follows: for each image from the set of real images \(X_{a}\) a template \(S_{i}\) is randomly selected from a pre-prepared set of templates \(S=\left\{\,S_{1},\,S_{2},\,\dots,\,S_{n}\right\}\). This template is then added to the image in a controlled manner, regulated by a parameter mmm, which determines the strength of the template addition while ensuring that the changes remain imperceptible to the human eye.  
This process can be formalized as  
\[T\left(X_{a}^{j}\right)=X_{a}^{j}+m\times S_{i} \tag{1}\]  
where:  
\(X_{a}^{j}\)- original image;  
\(T\left(X_{a}^{j}\right)\)--modified image;  
\(m\)--parameter controlling the intensity of the template embedding.  
Figure 4: [PERSON] et al. [35] high level architecture.  
Figure 3: SPAN high level architecture.  
The template recovery module is used for manipulation detection by comparing the recovered template with the original one. This process employs an encoder network \(E\), which is trained to recover the embedded templates from images that may have been manipulated by a generative model \(G\).  
Thus, for each image, the process can be described as follows:  
\[S_{R}=E\Big{(}T\Big{(}X_{a}^{j}\Big{)}\Big{)} \tag{2}\]  
and  
\[S_{F}=E\Big{(}G\Big{(}T\Big{(}X_{a}^{j}\Big{)}\Big{)}\Big{)} \tag{3}\]  
If the image has not been manipulated, the recovered template \(S_{R}\) will be very similar to the original template \(S_{i}\). In the case of manipulation, the recovered template \(S_{F}\) will differ significantly from the original \(S_{i}\). The recovered template is compared with the original template using a classification network, which performs a binary evaluation to determine whether the image has been manipulated or not.  
The encoder network begins with two convolutional layers that perform initial feature extraction from the image. Each of these layers uses 3 \(\times\) 3 convolutions with a stride of one, processing the three-channel input image (RGB) and generating 64 feature maps as the output, utilizing the ReLU activation function. Following this, the network proceeds through ten convolutional blocks, where each convolutional layer is supported by batch normalization and the ReLU activation function. In the end, an additional 3 \(\times\) 3 convolutional layer reduces the number of output channels to one, allowing for the generation of the final template recovered from the image.  
The architecture of the classifier network is very similar to that of the encoder, with the primary differences being in the final portion and the number of convolutional blocks, reduced to eight instead of ten. Unlike the encoder, the classifier concludes with a sequence of fully connected layers that transform the extracted features into a classification decision. The fully connected layers contain 512, 256, and 1 neurons, respectively, enabling the assignment of the image to either the \"original\" or \"manipulated\" class.