3D Gaussian Splatting (3DGS) has rapidly become the preferred representation for high-fidelity novel view synthesis and 3D scene reconstruction. However, the learned representation encodes sensitive visual information including human faces, license plates, documents, and computer screens, raising significant privacy concerns when trained splats are shared or deployed. In this work, we address the underexplored problem of privacy preservation in Gaussian Splatting by proposing a representation-level anonymization framework that directly anonymizes a trained splat. Given a trained splat and a user-provided reference view identifying sensitive content, our method localizes the corresponding regions in the underlying 3D representation and directly anonymizes them, ensuring that the sensitive information is absent from all subsequently rendered novel views while preserving the overall scene geometry and visual fidelity. We achieve this post-training anonymization in less than 1 second. Furthermore, we extend our framework with a privacy-by-design training strategy that prevents sensitive content from being embedded into the representation during optimization, enabling the generation of privacy-preserving splats directly from training images. Our method achieves a remarkably low Face Similarity Measure (FSM) of 9.79% at a retained Face Detection Rate (FDR) of 39.47% and makes sensitive text completely unreadable with an OCR Character Error Rate of 1.00. Our work aims to serve as the primary stepping stone towards privacy-aware 3D representations and motivates further research along these directions.
Figures & tables
Figure 1. Privacy Preservation in Gaussian Splatting. Given only a trained splat and user-selected reference views, our method localizes the Gaussians corresponding to sensitive content and directly anonymizes the splat without requiring the original training images. The resulting privacy-preserving splat consistently hides faces across arbitrary novel viewpoints while preserving the fidelity of the remaining scene. Overview of the proposed method.
Algorithm 1 3D Segmentation of Sensitive Gaussians
Figure 2. Overview of core components for our privacy preservation pipeline. Single-view segmentation identifies sensitive Gaussians via rasterization against 2D masks combined with Isolation Forest outlier rejection. Multi-view aggregation uses a visibility counter threshold to isolate the final set of sensitive Gaussians. Once identified, localized volumetric blur is applied using k -NN neighborhood. Face anonymization modifies the spherical harmonic coefficients with scale-dependent weights. Text anonymization, on the other hand, modifies both SH coefficients and spatial means with uniform weight. The final output is a splat with sensitive information anonymized.
Figure 3. Overview of our two operational settings. Top: Post-Training Privacy Preservation takes an already-trained 3D Gaussian Splat along with a reference camera view and binary mask, to produce an anonymized splat without accessing original training images. Bottom: Privacy-by-Design integrates our anonymization pipeline directly into the training iterations along with loss masking to yield a anonymized splat.
Figure 4. Qualitative results for post-training anonymization on scenes from our PrinGS-Humans dataset (rows 1-4) and Tanks and Temples ( Knapitsch et al., 2017 ) (row 5). Starting from a single user-selected reference view (left), our method directly anonymizes the underlying Gaussian representation without requiring access to the original training images. The remaining columns show novel views rendered after representation-level anonymization. Sensitive facial and textual information is consistently removed across arbitrary viewpoints, demonstrating that privacy preservation naturally propagates through the edited 3D representation rather than being limited to the selected view. Notice the geometry of the faces being preserved across all novel views, with the silhouette sharply defining face contours. (Best seen on screen).
Figure 5. Qualitative comparison of privacy-by-design training on scenes from DL3DV-10K ( Ling et al., 2024 ) (rows 1,3), Tanks and Temples ( Knapitsch et al., 2017 ) (row 2), and our PrinGS-Humans Dataset (rows 4-6). From left to right: ground truth image, novel rendered images from 3DGS, and our method PrinGS. While 3DGS reconstructs sensitive content, our approach prevents such information from being encoded during training, effectively anonymizing the scene while preserving the appearance of non-sensitive regions.
3DGS
Ours
Scene
FDR ↑
FSM ↓
FDR ↑
FSM ↓
House
91.67
78.68
36.11
6.55
Hospital
97.50
88.55
42.50
12.70
Overall
94.74
83.87
39.47
9.79
Table 1. Face Similarity Measure and Face Detection Rate on our PrinGS-Humans benchmark. Lower FSM indicates stronger anonymization, while higher FDR indicates that facial geometry is preserved. 3DGS reconstructs facial identity, whereas our method substantially suppresses identity-related features while keeping the faces detectable.
OCR-CER ↑
Truck
Barn
M60
Piano
Car
3DGS
0.500
0.028
0.207
0.149
0.158
Ours
1.00
1.00
1.00
1.00
1.00
Table 2. OCR Character Error Rate (OCR-CER) comparison. Higher values indicate stronger anonymization, with a value of 1.0 corresponding to complete failure of text recognition. Our method consistently suppresses readable text across all scenes, achieving the maximum OCR-CER, whereas standard 3DGS reconstructs text with substantially lower error.
Scene
#G
#SensitiveG
k
t
Time (s)
House (P1)
592K
1531
25
30
0.70
House (P2)
592K
1213
40
30
0.57
Hospital (P4)
538K
1334
40
30
0.62
Hospital (P2)
538K
1127
40
30
0.52
Truck
2052K
2551
100
1
0.24
Table 3. Runtime analysis of post-training anonymization. We report the total number of Gaussians in each scene (#G), the number of Gaussians identified for anonymization (#SensitiveG), Neighbourhood Size ( k ), Anonymization Iterations ( t ), and the runtime of our post-training anonymization stage. P1–P4 index the individual human subjects within a scene, following the per-subject numbering used in the supplement.
Figure 6. Impact of neighborhood size ( k ) and anonymization iterations ( t ) on FSM. Evaluation on the House dataset shows that higher values of k and t yield lower FSM scores (stronger privacy preservation), with gains eventually saturating.
3D Gaussian Splat (3DGS) enables high-fidelity, real-time novel view synthesis by representing scenes with large sets of anisotropic primitives, but often requires millions of Splats, incurring significant storage and transmission costs. Most existing compression methods rely on GPU-intensive post-training optimization with calibrated images, limiting practical deployment. We introduce NanoGS, a training-free and lightweight framework for Gaussian Splat simplification. Instead of relying on image-based rendering supervision, NanoGS formulates simplification as local pairwise merging over a sparse spatial graph. The method approximates a pair of Gaussians with a single primitive using mass preserved moment matching and evaluates merge quality through a principled merge cost between the original mixture and its approximation. By restricting merge candidates to local neighborhoods and selecting compatible pairs efficiently, NanoGS produces compact Gaussian representations while preserving scene structure and appearance. NanoGS operates directly on existing Gaussian Splat models, runs efficiently on CPU, and preserves the standard 3DGS parameterization, enabling seamless integration with existing rendering pipelines. Experiments demonstrate that NanoGS substantially reduces primitive count while maintaining high rendering fidelity, providing an efficient and practical solution for Gaussian Splat simplification. Our project website is available at https://saliteta.github.io/NanoGS/.
Butian Xiong, Rong Liu, Tiantian Zhou +3
USC Institute for Creative Technologies · Texas A&M University
3D Gaussian Splatting (3DGS) enables real-time novel view synthesis but produces millions of primitives through adaptive densification, leading to significant storage overhead. Learned-mask pruning methods such as LP-3DGS address this by assigning each Gaussian a learnable mask to identify and prune redundant primitives. However, we identify a limitation of this paradigm: the steep slope of the Gumbel-Sigmoid activation drives mask values to the extremes within the short mask-training window, before the importance ranking has stabilized, producing a sharply bimodal distribution from which that ranking can no longer be reliably recovered. We propose LinearMask-GS, which replaces Gumbel-Sigmoid with a linear increment activation that keeps mask values in a mid-confidence regime throughout mask training, producing a stable, unimodal mask distribution whose ranking tracks importance. On Mip-NeRF 360, our method achieves 3.6x and 1.6x Gaussian reductions over 3DGS and LP-3DGS, respectively, while maintaining or improving rendering quality. For outdoor scenes, it yields a 1.6x reduction (from 2.18M to 1.36M) with notable gains in PSNR (+0.38 dB), SSIM (+0.025), and LPIPS (-0.029).
Donghun Ryu, Minhyeok Lee
Department of Intelligent Semiconductor Engineering Chung-Ang University Seoul, Republic of Korea · School of Electrical and Electronics Engineering Chung-Ang University Seoul, Republic of Korea
3D Gaussians have become a powerful scene representation for real-time splatting and high-quality novel-view synthesis. This has motivated generalizable splatting -- methods that adapt feed-forward geometry prediction networks to produce per-pixel Gaussians from a set of images. However, most generalizable splatting pipelines are supervised primarily through a view-synthesis loss to predict Gaussian orientation, anisotropic scale, opacity, and appearance in addition to their locations. We show that this learning objective is under-constrained. Models trained with view synthesis alone produce splats whose orientations and scales have no geometric connotation. The result is that, while producing decent view-synthesis performance, nearly all generalizable splatting methods produce geometrically inaccurate and misaligned Gaussians. We introduce G3Splat, a geometry-consistent generalizable splatting framework that addresses these degeneracies through differentiable geometric priors on the predicted 3D Gaussians, making the learning problem well-posed. These priors encourage the per-pixel splats to remain on their viewing rays and to orient themselves in accordance with local surfaces. Our priors are architecture-agnostic and can be incorporated into any previously studied geometric backbone for generalizable splatting, as well as different scene representations. We test G3Splat with both DUSt3R-style and VGGT-style backbones to predict pixel-aligned full-rank 3DGS as well as surfel-like 2DGS. Trained on RE10K, G3Splat produces Gaussian splats with significantly higher geometric fidelity than baselines, providing state-of-the-art novel-view depth, mesh reconstruction, and relative pose estimation performance while preserving novel-view synthesis quality, as evaluated on datasets such as ACID and ScanNet. Code and pretrained models are released on our project page.
Mehdi Hosseinzadeh, Shin-Fang Chng, Yi Xu +3
Australian Institute for Machine Learning · Goertek Alpha Labs · MBZUAI