AEGIS: Preserving privacy of 3D Facial Avatars with Adversarial Perturbations