diff --git a/book/quarto/contents/vol2/security_privacy/security_privacy.qmd b/book/quarto/contents/vol2/security_privacy/security_privacy.qmd
index 05c3a10ec9..e98e00ffe5 100644
--- a/book/quarto/contents/vol2/security_privacy/security_privacy.qmd
+++ b/book/quarto/contents/vol2/security_privacy/security_privacy.qmd
@@ -1339,7 +1339,7 @@ Consider a production API serving a ResNet-50 image classifier (1000 ImageNet cl
 - Model training cost: ~\$5K (GPU time, data, engineering)
 - Extraction requirements: ~5M queries for 90 percent fidelity (0.5 percent of ImageNet per class)
 - Without defenses: Attacker queries 25K/day for 200 days, cost \$0 (free tier abuse)
-- Total extraction cost: \$0 vs \$5K training → extraction is economically favorable
+- Total extraction cost: \$0 vs. \$5K training → extraction is economically favorable
 
 **Defense Implementation**: