AEGIS: Preserving privacy of 3D Facial Avatars with Adversarial Perturbations

2025-11-21

AI Summary

3D Gaussian splatting–based dynamic facial avatars are vulnerable to cross-view identity recognition attacks. Method: We propose the first retraining-free, geometry-preserving privacy protection framework specifically designed for 3D facial avatars. Guided by a pre-trained face verification model, our approach applies adversarial perturbations solely to the color coefficients of Gaussian primitives, jointly optimizing perceptual and identity losses to achieve view-consistent de-identification—without altering geometric structure or retraining the rendering model. Results: Experiments demonstrate complete identity anonymization (0% identity retrieval and verification accuracy), while maintaining high visual fidelity (SSIM = 0.9555, PSNR = 35.52 dB). Our method achieves an optimal trade-off between strong privacy preservation and photorealistic quality, and crucially preserves key semantic attributes—including age, gender, and expression.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Privacy
• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy

Application Category

• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

The growing adoption of photorealistic 3D facial avatars, particularly those utilizing efficient 3D Gaussian Splatting representations, introduces new risks of online identity theft, especially in systems that rely on biometric authentication. While effective adversarial masking methods have been developed for 2D images, a significant gap remains in achieving robust, viewpoint-consistent identity protection for dynamic 3D avatars. To address this, we present AEGIS, the first privacy-preserving identity masking framework for 3D Gaussian Avatars that maintains the subject's perceived characteristics. Our method aims to conceal identity-related facial features while preserving the avatar's perceptual realism and functional integrity. AEGIS applies adversarial perturbations to the Gaussian color coefficients, guided by a pre-trained face verification network, ensuring consistent protection across multiple viewpoints without retraining or modifying the avatar's geometry. AEGIS achieves complete de-identification, reducing face retrieval and verification accuracy to 0%, while maintaining high perceptual quality (SSIM = 0.9555, PSNR = 35.52 dB). It also preserves key facial attributes such as age, race, gender, and emotion, demonstrating strong privacy protection with minimal visual distortion.

Problem

• Protecting 3D facial avatars from identity theft risks
• Achieving viewpoint-consistent identity masking for dynamic avatars
• Preserving avatar realism while concealing identity features

Innovation

• Applies adversarial perturbations to Gaussian color coefficients
• Uses pre-trained face verification network for guidance
• Maintains avatar realism while concealing identity features