Anonymizing face in surgical environment

Abstract

A system may anonymize a face in a surgical environment. The system may generate a three-dimensional (3D) model of a person in a surgical environment based on a plurality of video streams received from a plurality of cameras. Each camera may provide a different view of the surgical environment. The 3D model may indicate a position of the person in a global coordinate space. The system may determine a first position in the 3D model including the face of the person based on the position of the person in the global coordinate space. The system may match the first location to a second location in each video stream. The system may then anonymize the face in each video stream based on the visibility of the face at the second location. Other aspects are described and claimed.

Description

[0001] Cross-references and related applications This patent application claims the benefit of priority to U.S. Provisional Application No. 63 / 468,546, filed May 24, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This invention relates generally to surgical settings, and more specifically to systems and methods for anonymizing faces in surgical settings. Other aspects are also described. Background Technology

[0003] Many operating rooms (ORs) are equipped with cameras to monitor OR workflows. OR videos captured by these cameras provide visual feedback on events occurring during surgery, and analyzing and mining these recorded videos can improve OR efficiency, which in turn can reduce costs for both patients and hospitals. However, OR videos need to be de-identified first by removing personally identifiable information (PII). This de-identified OR video can then be stored and passed to post-processing services without exposing the PII of the patient and OR staff.

[0004] The primary source of facial identification artifacts (PIIs) in OR videos is the faces of patients and OR staff. To de-identify faces captured in the video, facial detection must first be performed. Conventional facial detection techniques typically employ a bottom-up approach, relying on detecting facial features such as the nose and eyes to establish and infer facial locations within the video. Summary of the Invention

[0005] Embodiments of this disclosure include identifying the location of a person's face in a video stream using a three-dimensional (3D) model generated from video streams corresponding to different views of a surgical environment and anonymizing it when visible. In some embodiments, the system may generate a 3D model of a person in a surgical environment based on multiple video streams received from multiple cameras arranged in the surgical environment. Each camera may provide a different view of the surgical environment. The 3D model may indicate the person's location in a global coordinate space. The system may determine a first location, including the person's face, in the 3D model based on the person's location in the global coordinate space. The system may then match the first location with a second location in each video stream. The system may then anonymize the face in the video stream based on the identification of the second location. Other aspects are also described and claimed.

[0006] The above summary of the invention does not include an exhaustive list of all aspects of the present disclosure. It is contemplated that the present disclosure includes all systems and methods that can be practiced from all suitable combinations of the various aspects summarized above, as well as those disclosed in the DETAILED DESCRIPTION below and particularly pointed out in the claims part of the application. Such combinations have particular advantages as compared to the prior art, but other aspects of the present disclosure can be spent without realizing all such advantages. BRIEF DESCRIPTION OF DRAWINGS

[0007] Several aspects of the disclosure are illustrated in the figures of the accompanying drawings, which are shown by way of example and not limitation. Like references indicate like elements. It should be noted that references made to "a" or "one" aspect in this disclosure are not necessarily to the same aspect, and they refer to at least one. In addition, to be clear and concise, a given figure can be used in the specification to show a feature of more than one aspect of the disclosure. Not all of the elements of a figure can be required for every aspect of the disclosure.

[0008] Figure 1 is an example of a system for anonymizing faces in a surgical environment.

[0009] Figure 2 is an example of a 3D model generated from video streams from different cameras arranged in a surgical environment.

[0010] Figure 3 is an example of a matching location of a face in an original video stream.

[0011] Figure 4 is an example of an anonymized face in an anonymized video stream.

[0012] Figure 5 is a block diagram of an example internal configuration of a computer system for anonymizing faces in a surgical environment.

[0013] Figure 6 is a flowchart of an example of a process for anonymizing faces in a surgical environment. DETAILED DESCRIPTION

[0014] Several aspects of the disclosure are now explained with reference to the drawings. Whenever the shapes, relative positions and other aspects of the parts described are not explicitly defined, the scope of the invention is not limited only to the parts shown, which are shown only for illustrative purposes. In addition, although many details are set forth, it is to be understood that some aspects of the disclosure can be practiced without these details. In other instances, well-known circuits, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

[0015] It is often desirable to perform de-identification on OR video from a surgical environment to blur or remove the faces of patients and OR staff from the video. However, the faces of people in the OR are often heavily covered by personal protective equipment (PPE) such as masks, face shields, goggles, and glasses, and can also be obscured by other OR personnel and OR equipment, which renders existing face detection techniques ineffective. These challenges can be exacerbated by off-angle poses of the face, faces facing away, small faces with low resolution, low illumination, and in some cases too strong illumination. Conventional automatic two-dimensional (2D) anonymization systems can have difficulty when such obstructions / obstacles are present, sometimes requiring manual intervention. More complex is the large amount of video data and images that need to be anonymized, which makes manual anonymization cumbersome. What is needed is a robust and effective OR video de-identification technique that does not have the drawbacks of the prior art.

[0016] Embodiments of the present disclosure address such problems by utilizing a 3D model generated from video streams corresponding to different views of a surgical environment to identify the visible locations of the faces of people in the video streams and anonymize them when visible. In some embodiments, a system can generate a 3D model of people in a surgical environment based on multiple video streams (raw video streams) received from multiple cameras arranged in the surgical environment. Each camera can provide a different view of the surgical environment. The 3D model can indicate the locations of the people in a global coordinate space, such as by utilizing a Cartesian coordinate system or a spherical coordinate system. The system can then determine a first location in the 3D model that includes a face of a person based on the location of the person in the global coordinate space. The system can then match the first location to a second location in each video stream, such as by projecting a 3D face mesh model to the second location in the raw video streams. The system can then anonymize the face in each video stream based on the visibility of the face at the second location to produce anonymized video streams in place of the raw video streams.

[0017] In some implementations, the system can determine a global 3D face mesh model that overlaps with each person in the scene from multiple raw video streams corresponding to different views of the cameras. The system can perform 2D anonymization of faces in the raw video streams by projecting the mesh from the 3D model back into the raw video streams from the cameras. In some cases, a face can be occluded in a particular view, e.g., by an OR light, and thus not visible. The system can determine whether a 3D face is visible in a 2D image by searching for discrepancies between the depth map produced by the camera and the generated 3D face mesh. The system can then perform anonymization on the visible faces, including 2D render adjustments, to obtain a more realistic face replacement. For example, the system can merge the 3D face mesh model with a background image. In some cases, the system can utilize a face replacement template that can be personalized and changed for each person, including factors affecting such as age, gender, and / or race.

[0018] In some implementations, generating a 3D model of a person can include combining 2D poses of the person from multiple video streams into a 3D pose. In some implementations, determining a location of the person in a global coordinate space can include regressing a body model onto body keypoints detected in the 3D model. In some implementations, the 3D model can include a 3D point cloud, and each video stream can include a partial point cloud that is registered in the global coordinate space of the 3D point cloud. In some implementations, the 3D model can be generated based on a combination of red, green, blue (RGB) images and depth maps (collectively, red, green, blue, depth (RGB-D) data) from the multiple video streams. In some implementations, matching the first location to the second location can include projecting a 3D face model into the video stream to determine a location of the face. In some implementations, anonymizing the face at the second location can include determining that the face in the 3D model is visible in the video stream. In some implementations, anonymizing the face can include replacing the face with an artificially generated face. In some implementations, anonymizing the face can include utilizing a face replacement template that is personalized for the person.

[0019] Referring now to the drawings, Figure 1 is an example of a system 100 for anonymizing faces in a surgical environment. For example, it can be desirable to perform de-identification on OR video from a surgical environment to blur or remove faces of patients and OR staff from the video. The system 100 can receive multiple video streams (e.g., raw video streams) from multiple cameras arranged in the surgical environment. There can be n cameras in the surgical environment, providing n video streams, respectively, where n is an integer greater than 1. For example, the system 100 can receive video stream 1 (VS1) from camera 1, video stream 2 (VS2) from camera 2, and so on.

[0020] Each camera can provide a video stream including a multi-view RGB-D image with color and depth. Further, each video stream can correspond to a different view of the surgical environment, such as a different angle or perspective of the scene. For example, a first set of one or more cameras can be surgical cameras that acquire the scene from a relatively narrow vantage point above the surgical procedure, and a second set of one or more cameras can be workflow cameras that acquire the scene from a relatively wide vantage point in the OR. In some cases, the system 100 can receive the video streams from the cameras in real-time, and in other cases, the system 100 can receive the video streams from storage devices that hold recordings from the cameras.

[0021] The system 100 can utilize the 3D model generator 102 to generate a 3D model of a person in the surgical environment. For example, the 3D model generator 102 can generate a 3D mesh model of a person in the environment. The 3D model generator 102 can generate the 3D model based on the video streams from the cameras (e.g., VS1, VS2). The 3D model generator 102 can detect 2D human keypoints in each video stream and regress a human model in a global coordinate space. The 3D model can indicate a location of the person in a global coordinate space, such as a Cartesian coordinate space with XYZ axes, a spherical coordinate space, or others. For example, referring additionally to Figure 2 The 3D model generator 102 can generate a 3D model 120 of the persons (such as persons 122 and 124) in the global coordinate space.

[0022] In some implementations, the 3D model 120 can represent a point cloud, where certain data points in the point cloud correspond to persons (e.g., persons 122 and 124) in the environment. Each video stream can include a partial point cloud that is registered in the global coordinate space of the 3D point cloud. For example, two or more partial point clouds from VS1, VS2 can be registered in one global coordinate space of the 3D model 120 by minimizing photometric re-projection error on keypoints on a large visual marker.

[0023] In some implementations, determining a location of a person in the 3D model 120 can include regressing a human model (e.g., a statistical parametric human mesh model) onto detected human keypoints by the generator 102. The generator 102 can then align a face of the human model onto a keypoint in the 3D point cloud of the 3D model 120. Thus, the 3D model 120 can be generated based on utilizing raw video streams from cameras (such as VS1 and VS2) with different angles, perspectives, and / or scene views. The 3D model 120 can be generated based on a combination of RGB-D images from each video stream. For example, RGB images and depth maps / images, or multi-view RGB-D data, from the cameras can be fused into the 3D point cloud of the 3D model 120 to represent the scene in the surgical environment.

[0024] In some implementations, generating a 3D model of the person for the 3D model 120 can include combining 2D poses of the person from the video streams into a 3D pose of the person in the 3D model 120. For example, with further reference to Figure 3 , generating the 3D model 120 of the person 122 can include combining 2D poses of the person 122 from the video streams VS1 and VS2 (shown in the focus regions of VS1 and VS2 in Figure 3 , highlighting the person 122 in different 2D poses) into a single 3D pose of the person 122 (shown in the 3D model 120 of Figure 2 In some implementations, the 3D pose from the 3D model 120 can be projected back into each 2D image of the video streams as input to guide the 3D model regression (re-projection). Thus, the system 100 can combine 2D human poses from multiple views into one joint 3D human pose for each person in the scene. The system 100 can perform temporal smoothing on each 3D human pose sequence to interpolate missing poses and / or reduce noise.

[0025] With further reference to Figure 1 , the system 100 can then determine, with the face localizer 104, a first location in the 3D model 120 that includes a face of the person based on the location of the person in the global coordinate space. The face localizer 104 can determine the first location based on the determined location of the person as constructed in the global coordinate space. For example, with further reference to Figure 2 , the face localizer 104 can determine a first location 132 registered in the global coordinate space of the 3D model 120 that corresponds to the face of the person 122. The face localizer 104 can also determine another first location 134 registered in the global coordinate space of the 3D model 120 that corresponds to the face of the person 124, and so on.

[0026] The system 100 can then match, with the matching system 106, the first location to a second location in each video stream (e.g., the original video stream). The matching system 106 can project the 3D face model from the first location into the video stream to determine a location of the face at the second location. For example, with further reference to Figure 3, the matching system 106 can match the first location 132 corresponding to the face of the person 122 with the second locations 142 and 144 in each video stream. To perform the matching, the matching system 106 can project the 3D face model of the person 122 from the first location 132 into the video streams VS1 and VS2 to determine the position of the face of the person 122 at the second locations 142 and 144, respectively. The matching system 106 can similarly match the first location 134 corresponding to the face of the person 124 in the 3D model 120 with other second locations in the video streams VS1 and VS1. In some implementations, matching the first location with the second location can include comparing the face in the 3D model 120 with the face in a depth map or color image from the video stream.

[0027] The system 100 can then utilize the anonymizer 108 to anonymize the faces in each video stream based on the visibility of the faces at the second locations to produce anonymized video streams. For example, the system 100 can produce an anonymized video stream 1 (AS1, corresponding to an anonymized version of VS1 for camera 1), an anonymized video stream 2 (AS2, corresponding to an anonymized version of VS2 for camera 2), and so on. To perform the anonymization, the anonymizer 108 can determine that the faces in the 3D model 120 are visible (e.g., not occluded in the view by other OR workers or equipment) at the second locations in the video streams. When the faces are visible, the anonymizer 108 can render a face of a person model (e.g., a statistical parametric person mesh model) in the video stream to replace the face with an artificially generated face (e.g., altering facial features, such as adding / removing glasses, changing eyes, ears, nose, hair, etc.).

[0028] For example, again referring to Figure 3 , the anonymizer 108 can anonymize the face of the person 122 based on the visibility of the face at the second locations 142 and 144 in the video streams VS1 and VS2. With additional reference to Figure 4 , the anonymizer 108 can anonymize the face of the person 122 by replacing the face with an artificially generated face 152 and 154 (e.g., adding glasses) at the second locations in the anonymized video streams AS1 and AS2, respectively.

[0029] In some implementations, the system 100 can determine, from the video streams (e.g., VS1 and VS2), a global 3D face mesh model that overlaps with each person in the scene. The system 100 (e.g., anonymizer 108) can then perform 2D anonymization of the faces by projecting the mesh back into the video streams to produce anonymized video streams AS1 and AS2 (re-projection). In some cases, a 3D face can be occluded in a particular view, e.g., by an OR light, and thus not visible. The system 100 can determine whether a 3D face is visible in a 2D image by searching for discrepancies between a depth map produced by the camera and the 3D face mesh. The system 100 can also perform 2D rendering adjustments to obtain a more realistic face replacement, such as by merging the 3D face mesh model with a background image. In some implementations, the anonymizer 108 can utilize a face replacement template, which can be personalized and changed for each person (e.g., to generate artificially generated faces 152 and 154). This can enable adjustment of factors such as age, gender, and / or ethnicity. In some implementations, anonymizing a face by the anonymizer 108 can include pixelating, blurring, and / or covering the face that is visible at the second location.

[0030] In some embodiments, the system 100 can initially perform multi-view face localization by utilizing 3D information. This can enable consistent anonymization across multiple camera views. In some cases, the system 100 can utilize grid-based anonymization to control 3D face replacement. Images anonymized by the system 100 can then enable utilization by other systems further downstream. Figure 2 D face localization. This can enable consistent anonymization across multiple camera views. In some cases, the system 100 can utilize grid-based anonymization to control 3D face replacement. Images anonymized by the system 100 can then enable utilization by other systems further downstream.

[0031] Figure 5 is a block diagram of an example internal configuration of a computer system 500 for anonymizing faces in a surgical environment. The computer system 500 can be, for example, a client, a server, a computer, a smart phone, a PDA, a laptop, or a tablet, or another computing device in which one or more processors are embedded or to which one or more processors are coupled. The computer system 500 can include different types of computer-readable media and interfaces for various other types of computer-readable media. The computer system 500 includes a bus 502, one or more processors 504, a system memory 506, a read-only memory (ROM) 508, a storage device 510, input devices 512, output devices 514, and a network interface 516. In some embodiments, the computer system 500 can be part of a robotic surgical system.

[0032] Buses 502 collectively represent all system and peripheral buses of communication fabric that communicatively connect the various internal devices of the computer system 500. For instance, buses 502 can communicatively connect one or more processors 504 with ROM 508, system memory 506, and storage 510.

[0033] One or more processors 504 retrieve instructions and data to be processed from various storage / memory units in order to perform the various processes described herein, including the above-described processes of anonymizing faces in a surgical environment. One or more processors 504 can include any type of processor, including but not limited to microprocessors, graphics processing units (GPUs), tensor processing units (TPUs), intelligent processor units (IPUs), digital signal processors (DSPs), field-programmable gate arrays (FPGAs), and application-specific integrated circuits (ASICs). In different implementations, including distributed computing, one or more processors 504 can be a single processor or a multi-core processor.

[0034] ROM 508 stores static data and instructions that are available to the one or more processors 504 and other modules of the computer system 500. Storage 510, on the other hand, is a read-and-write memory device. Storage 510 can be a nonvolatile memory unit that even when computer system 500 is off, retains instructions and data for use in booting or initializing the computer system 500 upon turn-on. Some implementations of the subject disclosure use a mass-storage device (such as a magnetic or optical disk and its corresponding disk drive) as storage 510. Other implementations use a removable storage device (such as a floppy disk, flash drive, and its corresponding disk drive) as storage 510.

[0035] Like storage 510, system memory 506 is a read-and-write memory device. However, unlike storage 510, system memory 506 is a volatile read-and-write memory, such as a random access memory (RAM). System memory 506 can store some of the instructions and data that the one or more processors 504 need at runtime. In some implementations, the various processes described herein (including the above-described processes of anonymizing faces in a surgical environment) can be stored in system memory 506, ROM 508, and / or storage 510. From these various storage / memory units, the one or more processors 504 retrieve instructions and data to process according to the processes of some implementations.

[0036] Bus 502 can also be connected to input devices 512 via input device interface and to output devices 514 via output device interface. Input devices 512 can enable the user to communicate information and select commands to the computer system 500. Input devices 512 can include, for example, alphanumeric keyboards and pointing devices (also referred to as "cursor control devices"). Output devices 514 can enable, for example, the display of images generated by the computer system 500 to a user. Output devices 514 can include, for example, printers and display devices, such as cathode ray tubes (CRT) or liquid crystal displays (LCD). Some embodiments include devices that function as both input and output devices, such as a touch screen.

[0037] Bus 502 can also couple computer system 500 to a network through network interface 516. In this manner, the computer system 500 can be a part of a network of computers such as a local area network ("LAN"), a wide area network ("WAN"), or an Intranet, or a network of networks, such as the Internet. Any or all components of the computer system 500 can be used in conjunction with the subject disclosure.

[0038] The various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein can be implemented as electronic hardware, computer software, or combinations of both. To illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans can implement the described functionality in varying ways for each particular application. The

[0039] The hardware used to implement the various illustrative logics, logical blocks, modules, and circuits described in connection with the aspects disclosed herein can be implemented or performed with a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor can be a microprocessor, but in the alternative, the processor can be any conventional processor, controller, microcontroller, or state machine. A processor can also be implemented as a combination of receiver devices such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Alternatively, some steps or methods can be performed by circuitry that is specific to a given function.

[0040] In one or more exemplary aspects, the functions described can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions can be stored as one or more instructions or code on a non-transitory computer-readable storage medium. The steps of a method or algorithm disclosed herein can be embodied in a processor-executable instruction that can reside on a non-transitory computer-readable storage medium. Non-transitory computer-readable or processor-readable storage media can be any storage media that can be accessed by a computer or a processor. By way of example but not limitation, such non-transitory computer-readable storage media can include RAM, ROM, EEPROM, FLASH memory, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer. Disk and disc, as used herein, includes compact discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks and blu-ray discs where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of non-transitory computer-readable and processor-readable media. Additionally, the operations of a method or algorithm can reside in one or any combination of the above memory hardware, which can be located in a computing device or other processor- enabled hardware, such that implementation of the method or algorithm is not limited to a single location or a single device.

[0041] Figure 6 is a flowchart of an example of a process 600 for anonymizing faces (e.g., OR video de-identification) in a surgical environment. Process 600 can be performed using a computing device, such as the systems, hardware, and software described with respect to Figures 1 to 5 Process 600 can be performed, for example, by executing machine-readable programs or other computer-executable instructions, such as routines, instructions, programs, or other code. The operations of process 600, or another technique, method, process, or algorithm described in connection with the implementations disclosed herein can be embodied directly in hardware, in software, in firmware, in a circuit, or in any combination thereof.

[0042] To simplify illustration, process 600 is depicted and described herein as a series of operations. However, the operations according to the present disclosure can occur in various orders and / or concurrently. Additionally, other operations not presented and described herein can be used. Moreover, not all illustrated operations can be required to implement a technique in accordance with the disclosed subject matter.

[0043] At operation 602, the system can generate a 3D model of a person in a surgical environment based on video streams received from cameras in the surgical environment. For example, the system 100 can generate a 3D model 120 of people in an OR based on video streams VS1 and VS2 received from cameras 1 and 2, respectively. Each camera can provide a different view of the surgical environment based on its different position and / or orientation in the environment, such as a different angle, perspective, and / or view of the scene. The 3D model can indicate the position of the person in a global coordinate space, e.g., with a Cartesian coordinate system or a spherical coordinate system. In some cases, the 3D model can include a 3D point cloud, and each video stream can include a partial point cloud registered in the global coordinate space of the 3D point cloud.

[0044] At operation 604, the system can determine a first location in the global coordinate space that includes a face of the person based on the position. For example, the system 100 can determine first locations 132 and 134 in the 3D model 120 that include faces of the people 122 and 124, respectively. The system 100 can determine the first locations based on regressing a body model onto the detected body keypoints in the 3D model and aligning the face of the body model to the detected face body keypoints in the 3D model.

[0045] At operation 606, the system can match the first location to a second location in each of the plurality of video streams. For example, the system 100 can match the first locations 132 and 134 in the 3D model 120 to second locations 142 and 144 in the video streams VS1 and VS2. The system 100 can perform the matching based on projecting a 3D face model into the video streams to determine the location of the face and / or by comparing the face in the 3D model to the face in a depth map / image from the video stream. In some cases, the system can utilize a bounding box to perform the matching.

[0046] At operation 608, the system can anonymize the face in each video stream based on the visibility of the face at the second location (e.g., at the second location where the face is not occluded in the view by other OR staff or equipment). For example, the system 100 can anonymize the faces of the people 122 and 124 in the video streams VS1 and VS2 based on the visibility of the faces at the second locations 142 and 144. The system 100 can then produce anonymized video streams AS1 and AS2 based on performing the anonymization on the visible faces. In various implementations, anonymizing the face can include replacing the face with an artificially generated face (e.g., altering facial features such as adding / removing glasses, changing eyes, ears, nose, hair, etc.), pixelating the face, blurring the face, and / or covering the face, or a combination thereof. In some implementations, anonymizing the face can include utilizing a face replacement template that can be personalized for each person.

[0047] While certain aspects of the application have been described and shown in the drawings, it will be understood that these are simply aspects of the application and are not to be considered in a limiting sense, and are not intended to show all aspects to which the application is deemed applicable. It is therefore contemplated to cover by the present application any and all modifications and variations that fall within the scope of the present application. It is appreciated that some aspects of the application can include optional elements, and that not all aspects of the application will necessarily include all of the optional elements. For example, some aspects of the application can not necessarily include the optional elements.

Claims

1. A method for anonymizing a face in a surgical setting, comprising: A three-dimensional (3D) model of a person in a surgical environment is generated based on multiple video streams received from multiple cameras, wherein each camera provides a different view of the surgical environment, and wherein the 3D model indicates the position of the person in a global coordinate space. The first position, including the face, in the 3D model is determined based on the position of the person in the global coordinate space. Match the first position with the second position in the plurality of video streams; as well as Anonymize faces in the plurality of video streams based on the visibility of the face at the second location.

2. The method according to claim 1, wherein, Generating the 3D model of the person includes combining the two-dimensional (2D) poses of the person from the plurality of video streams into a 3D pose.

3. The method according to claim 1, wherein, Determining the location includes: regressing the human body model to the detected human body key points in the 3D model.

4. The method according to claim 1, wherein, The 3D model includes a 3D point cloud, and each video stream includes a portion of the point cloud registered in the global coordinate space of the 3D point cloud.

5. The method according to claim 1, wherein, The 3D model is generated based on a combination of red, green, and blue (RGB) images and depth maps from the multiple video streams.

6. The method according to claim 1, wherein, Matching the first position with the second position includes: projecting a 3D facial model into a video stream to determine the position of the face.

7. The method according to claim 1, wherein, Anonymizing the face includes replacing the face with an artificially generated face.

8. The method according to claim 1, wherein, Facial anonymization includes using a personalized facial replacement template for the person.

9. A system for anonymizing a face in a surgical setting, comprising: Memory; and A processor, configured to execute instructions stored in the memory to: A three-dimensional (3D) model of a person in a surgical environment is generated based on multiple video streams received from multiple cameras, wherein each camera provides a different view of the surgical environment, and wherein the 3D model indicates the position of the person in a global coordinate space. The first position, including the face, in the 3D model is determined based on the position of the person in the global coordinate space. Match the first position with the second position in the plurality of video streams; as well as Anonymize faces in the plurality of video streams based on the visibility of the face at the second location.

10. The system according to claim 9, wherein, Generating the 3D model includes generating a 3D mesh model for each person in the surgical environment.

11. The system according to claim 9, wherein, Determining the position includes aligning the face of the human model with the detected human body key points of the face in the 3D model.

12. The system according to claim 9, wherein, Partial point clouds from each video stream are registered in the global coordinate space.

13. The system according to claim 9, wherein, The 3D model is generated based on red, green, blue, and depth (RGB-D) data from images from the multiple video streams.

14. The system according to claim 9, wherein, Matching the first location with the second location includes comparing the face in the 3D model with the face in the depth map from the video stream.

15. A non-transitory computer-readable medium storing instructions operable to cause one or more processors to perform operations including: A three-dimensional (3D) model of a person in a surgical environment is generated based on multiple video streams received from multiple cameras, wherein each camera provides a different view of the surgical environment, and wherein the 3D model indicates the position of the person in a global coordinate space. The first position, including the face, in the 3D model is determined based on the position of the person in the global coordinate space. Match the first position with the second position in the plurality of video streams; as well as Anonymize faces in the plurality of video streams based on the visibility of the face at the second location.

16. The non-transitory computer-readable medium according to claim 15, wherein, Generating the 3D model involves using red, green, blue, and depth (RGB-D) data from each camera.

17. The non-transitory computer-readable medium according to claim 15, wherein, Determining the location includes: regressing the statistical parameter human mesh model to the detected human key points in the 3D model.

18. The non-transitory computer-readable medium according to claim 15, wherein, Matching the first position with the second position includes: projecting a 3D facial mesh model into a video stream to determine the position of the face.

19. The non-transitory computer-readable medium according to claim 15, wherein, Anonymizing the face includes merging a 3D facial mesh model with a background image.

20. The non-transitory computer-readable medium according to claim 15, wherein, Partial point clouds of the video stream are registered to the global coordinate space by minimizing photometric reprojection error.

Images