PrinGS: Privacy Preservation in Gaussian Splatting

Gaurav Behera; Abhinav Raundhal; Archisha Panda; Saumya Balina; Gargi Shroff; Ponnurangam Kumaraguru

cs.CVOct 26, 2026

PrinGS: Privacy Preservation in Gaussian Splatting

Authors: Gaurav Behera, Abhinav Raundhal, Archisha Panda, Saumya Balina, Gargi Shroff, Ponnurangam Kumaraguru

Organizations: IIIT Hyderabad, India

Abstract

3D Gaussian Splatting (3DGS) has rapidly become the preferred representation for high-fidelity novel view synthesis and 3D scene reconstruction. However, the learned representation encodes sensitive visual information including human faces, license plates, documents, and computer screens, raising significant privacy concerns when trained splats are shared or deployed. In this work, we address the underexplored problem of privacy preservation in Gaussian Splatting by proposing a representation-level anonymization framework that directly anonymizes a trained splat. Given a trained splat and a user-provided reference view identifying sensitive content, our method localizes the corresponding regions in the underlying 3D representation and directly anonymizes them, ensuring that the sensitive information is absent from all subsequently rendered novel views while preserving the overall scene geometry and visual fidelity. We achieve this post-training anonymization in less than 1 second. Furthermore, we extend our framework with a privacy-by-design training strategy that prevents sensitive content from being embedded into the representation during optimization, enabling the generation of privacy-preserving splats directly from training images. Our method achieves a remarkably low Face Similarity Measure (FSM) of 9.79% at a retained Face Detection Rate (FDR) of 39.47% and makes sensitive text completely unreadable with an OCR Character Error Rate of 1.00. Our work aims to serve as the primary stepping stone towards privacy-aware 3D representations and motivates further research along these directions.

Figures & tables

Figure 1. Privacy Preservation in Gaussian Splatting. Given only a trained splat and user-selected reference views, our method localizes the Gaussians corresponding to sensitive content and directly anonymizes the splat without requiring the original training images. The resulting privacy-preserving splat consistently hides faces across arbitrary novel viewpoints while preserving the fidelity of the remaining scene. Overview of the proposed method.

Panel of Figure 2 — Algorithm 1 3D Segmentation of Sensitive Gaussians

Figure 2. Overview of core components for our privacy preservation pipeline. Single-view segmentation identifies sensitive Gaussians via rasterization against 2D masks combined with Isolation Forest outlier rejection. Multi-view aggregation uses a visibility counter threshold to isolate the final set of sensitive Gaussians. Once identified, localized volumetric blur is applied using $k$ -NN neighborhood. Face anonymization modifies the spherical harmonic coefficients with scale-dependent weights. Text anonymization, on the other hand, modifies both SH coefficients and spatial means with uniform weight. The final output is a splat with sensitive information anonymized.

Figure 3. Overview of our two operational settings. Top: Post-Training Privacy Preservation takes an already-trained 3D Gaussian Splat along with a reference camera view and binary mask, to produce an anonymized splat without accessing original training images. Bottom: Privacy-by-Design integrates our anonymization pipeline directly into the training iterations along with loss masking to yield a anonymized splat.

Figure 4. Qualitative results for post-training anonymization on scenes from our PrinGS-Humans dataset (rows 1-4) and Tanks and Temples ( Knapitsch et al., 2017 ) (row 5). Starting from a single user-selected reference view (left), our method directly anonymizes the underlying Gaussian representation without requiring access to the original training images. The remaining columns show novel views rendered after representation-level anonymization. Sensitive facial and textual information is consistently removed across arbitrary viewpoints, demonstrating that privacy preservation naturally propagates through the edited 3D representation rather than being limited to the selected view. Notice the geometry of the faces being preserved across all novel views, with the silhouette sharply defining face contours. (Best seen on screen).

Figure 5. Qualitative comparison of privacy-by-design training on scenes from DL3DV-10K ( Ling et al., 2024 ) (rows 1,3), Tanks and Temples ( Knapitsch et al., 2017 ) (row 2), and our PrinGS-Humans Dataset (rows 4-6). From left to right: ground truth image, novel rendered images from 3DGS, and our method PrinGS. While 3DGS reconstructs sensitive content, our approach prevents such information from being encoded during training, effectively anonymizing the scene while preserving the appearance of non-sensitive regions.

	3DGS		Ours
Scene	FDR $\uparrow$	FSM $\downarrow$	FDR $\uparrow$	FSM $\downarrow$
House	91.67	78.68	36.11	6.55
Hospital	97.50	88.55	42.50	12.70
Overall	94.74	83.87	39.47	9.79

Table 1. Face Similarity Measure and Face Detection Rate on our PrinGS-Humans benchmark. Lower FSM indicates stronger anonymization, while higher FDR indicates that facial geometry is preserved. 3DGS reconstructs facial identity, whereas our method substantially suppresses identity-related features while keeping the faces detectable.

OCR-CER $\uparrow$	Truck	Barn	M60	Piano	Car
3DGS	0.500	0.028	0.207	0.149	0.158
Ours	1.00	1.00	1.00	1.00	1.00

Table 2. OCR Character Error Rate (OCR-CER) comparison. Higher values indicate stronger anonymization, with a value of

1.0

corresponding to complete failure of text recognition. Our method consistently suppresses readable text across all scenes, achieving the maximum OCR-CER, whereas standard 3DGS reconstructs text with substantially lower error.

Scene	#G	#SensitiveG	$k$	$t$	Time (s)
House (P1)	592K	1531	25	30	0.70
House (P2)	592K	1213	40	30	0.57
Hospital (P4)	538K	1334	40	30	0.62
Hospital (P2)	538K	1127	40	30	0.52
Truck	2052K	2551	100	1	0.24

Table 3. Runtime analysis of post-training anonymization. We report the total number of Gaussians in each scene (#G), the number of Gaussians identified for anonymization (#SensitiveG), Neighbourhood Size (

k

), Anonymization Iterations (

t

), and the runtime of our post-training anonymization stage. P1–P4 index the individual human subjects within a scene, following the per-subject numbering used in the supplement.

Figure 6. Impact of neighborhood size ( $k$ ) and anonymization iterations ( $t$ ) on FSM. Evaluation on the House dataset shows that higher values of $k$ and $t$ yield lower FSM scores (stronger privacy preservation), with gains eventually saturating.

3D Gaussian Splatting

3D Gaussian Splatting represents scenes as optimizable 3D Gaussian primitives for fast, photorealistic rendering from new viewpoints.

See all 1,027 papers

NanoGS: Training-Free Gaussian Splat Simplification
Mar 17, 2026Butian Xiong, Rong Liu, Tiantian Zhou +33DGS Compression 3D Gaussian Splatting
USC Institute for Creative Technologies · Texas A&M University
LinearMask-GS: Stable-Mask Importance Pruning for Compact 3D Gaussian Splatting
Sep 9, 2026Donghun Ryu, Minhyeok Lee3DGS Compression 3D Gaussian Splatting
Department of Intelligent Semiconductor Engineering Chung-Ang University Seoul, Republic of Korea · School of Electrical and Electronics Engineering Chung-Ang University Seoul, Republic of Korea
G3Splat: Geometrically Consistent Generalizable Gaussian Splatting
Dec 19, 2025Mehdi Hosseinzadeh, Shin-Fang Chng, Yi Xu +33D Gaussian Splatting 3D Reconstruction
Australian Institute for Machine Learning · Goertek Alpha Labs · MBZUAI

Mar 17, 2026J/K move · Enter open · S save

NanoGS: Training-Free Gaussian Splat Simplification

Butian Xiong, Rong Liu, Tiantian Zhou, Meida Chen+2

USC Institute for Creative Technologies · Texas A&M University

3DGS Compression 3D Gaussian Splatting Gaussian Splatting Compression 3D Scene Representation Gaussian Splatting

Open paper AskPDF arXiv

3D Gaussian Splat (3DGS) enables high-fidelity, real-time novel view synthesis by representing scenes with large sets of anisotropic primitives, but often requires millions of Splats, incurring significant storage and transmission costs. Most existing compression methods rely on GPU-intensive post-training optimization with calibrated images, limiting practical deployment. We introduce NanoGS, a training-free and lightweight framework for Gaussian Splat simplification. Instead of relying on image-based rendering supervision, NanoGS formulates simplification as local pairwise merging over a sparse spatial graph. The method approximates a pair of Gaussians with a single primitive using mass preserved moment matching and evaluates merge quality through a principled merge cost between the original mixture and its approximation. By restricting merge candidates to local neighborhoods and selecting compatible pairs efficiently, NanoGS produces compact Gaussian representations while preserving scene structure and appearance. NanoGS operates directly on existing Gaussian Splat models, runs efficiently on CPU, and preserves the standard 3DGS parameterization, enabling seamless integration with existing rendering pipelines. Experiments demonstrate that NanoGS substantially reduces primitive count while maintaining high rendering fidelity, providing an efficient and practical solution for Gaussian Splat simplification. Our project website is available at https://saliteta.github.io/NanoGS/.

Abstract

3D Gaussian Splatting

Explore similar work

NanoGS: Training-Free Gaussian Splat Simplification

LinearMask-GS: Stable-Mask Importance Pruning for Compact 3D Gaussian Splatting

G3Splat: Geometrically Consistent Generalizable Gaussian Splatting