sher in potential privacy threats to the system. Furthermore, the distribution structure of the SS network increases the risk of privacy leakage. Finally, in order to train itself, ML requires huge amounts of data that may contain various private user information that must be protected during training and communication. One possible attack is the database inference attack (DIA), where malicious users can obtain PU location and other private information through collected data and sophisticated 11 Secure Spectrum Sharing with Machine Learning: Methodologies inference techniques. In another form of attack, the operational privacy threat of SUs comes from the untrustworthy database that collects the location information sent from SUs on the set of available channels in their region. The protection of PUs privacy cannot be addressed by strictly controlling access to the database, since each SU must access it to enable the spectrum sharing process. One possible solution might be to reveal obfuscated information instead of the original information to SU queries. By doing this, the system can use the obfuscated information to help determine the channel status while reducing leakage of PU's privacy information. SUs' privacy can also be protected by sending an obfuscated version of the original information of SUs. Some works also looked at the question of how much information to share with the database and the dynamic question of whether to share information with the database. ML algorithms require massive amount of data to train their models. These data usually include a lot of user-specific sensitive info and need to be exchanged in some distributed systems. Sensitive information may leak out during the training process that would have remained secure using the above spectrum sensing procedure. Three main strategies may be used to maintain privacy in ML work flow: differential privacy, homomorphic encryp- tion, and Secure Function Evaluation (SFE)/Secure Multi-party Computation (SMC) [102]. In the differential privacy me