Winning the Battle for Secure ML, Bestan Maaroof’s free Fanshawe College textbook, gives students a usable map of poisoning, evasion, backdoors, and privacy attacks. Read against the production AI security problem of late 2026, it is strongest as curriculum—and thinnest where the field has already moved.
Machine learning security finally has an open textbook that treats the topic as a course, not a conference tutorial. Winning the Battle for Secure ML, compiled and edited by Bestan Maaroof and published June 16, 2025 by Fanshawe College Pressbooks under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 license, claims to be the first open-source textbook focused exclusively on machine learning security. After reading the full 161-page PDF edition, that claim looks directionally fair even if “first” is hard to police. What matters more is what kind of book it is: a structured classroom map of classical adversarial machine learning, assembled from open research, not a singular argument from the research frontier.
That distinction is the review. Teams shipping models into products need both maps and field manuals. Maaroof’s book is clearly the former. Used that way, it is useful. Mistaken for the latter, it will disappoint.
What the book is trying to do
The front matter states the audience without hedging: upper-level undergraduates and graduate students, plus computer science, cybersecurity, and AI practitioners who already have “a solid foundation in machine learning principles.” Each of the six chapters opens with learning outcomes and closes with key terms, reflective questions, and multiple-choice checks. The pedagogical intent is unmistakable. This is courseware.
The spine of the book is a lifecycle tour of ML vulnerabilities. Chapter 1 introduces integrity, confidentiality, and availability failures across the pipeline and sorts attacks by stage (poisoning at training, evasion at test time, inversion and membership inference as privacy threats), by adversary knowledge (black-, gray-, and white-box), and by intent (targeted versus untargeted). Chapter 2 reframes the same terrain as threat modelling: threat actors, attack surfaces, causative versus exploratory influence, and the training scenarios that make poisoning realistic—training from scratch, fine-tuning untrusted models, and outsourcing training to a third party. Chapters 3 through 6 then deepen the four families that dominate the classical literature: evasion and adversarial examples; poisoning and mitigations; backdoors, including federated-learning settings; and privacy attacks with differential-privacy defenses.
As a syllabus, that order is sound. A student who finishes the book will know the vocabulary that papers, NIST taxonomies, and vendor threat models actually use.
How it is built: compilation as method
The acknowledgements say the quiet part plainly. The open textbook was “compiled and edited” by Maaroof with Fanshawe’s OER Design Studio. Section after section ends with Creative Commons attributions to source surveys—especially Anum Paracha and colleagues’ review of machine learning security and privacy threats—and to the U.S. National Institute of Standards and Technology’s adversarial machine learning taxonomy by Apostol Vassilev, Alina Oprea, Alie Fordyce, and Hyrum Anderson. Figure descriptions and attack surfaces often travel with those citations. Chapter 3’s treatment of distance metrics, FGSM, iterative FGSM / BIM, PGD, and Carlini–Wagner attacks leans on survey prose and standard references (Goodfellow et al., Kurakin et al., Madry et al., Carlini et al.).
That is not a scandal for an OER textbook. It is the genre. The honest reading is that Maaroof’s contribution is curation, sequencing, accessibility formatting, and classroom apparatus more than original theory. Readers looking for a new technical claim will not find one. Readers looking for a free on-ramp that points at the right papers will.
The book is also unusually transparent about generative assistance. Several chapter summaries and a threat-model section credit OpenAI’s ChatGPT with prompts such as “Can you generate key takeaways for this chapter content?” End-of-chapter question banks in the poisoning and backdoor chapters credit DeepSeek with prompts that ask for quiz items, then note author review and editing. Using models to draft pedagogy is increasingly common. Putting the prompts in the PDF is rarer—and useful, because it lets a reviewer see where the book’s voice is editorial and where it is synthetic scaffolding.
What it gets right
First, the taxonomy holds together. Separating poisoning from evasion, and both from privacy extraction, remains the right first cut for newcomers. Maaroof’s early boxed examples—traffic-sign evasion against autonomous vehicles, poisoned recommendation data, healthcare-model privacy leakage—are conventional, but they keep the stakes concrete. The citation to Zou et al. (2023) on transferable adversarial attacks against aligned language models, with reported inference-related success figures the text gives as 50% on GPT-4 and 86.6% on GPT-3.5, and to Gong et al. (2023) on a commercial API attack at a 97% success rate, correctly signals that adversarial ML is no longer a lab curiosity.
Second, Chapter 2’s “reactive versus anticipatory” framing is the book’s clearest conceptual contribution as teaching material. The digital-camouflage vignette—spam misspellings, then image-hidden text, then CAPTCHA-like distortions—is simplified ecology, but it lands the point the field keeps relearning: defenses that only patch yesterday’s trick lose by default. The “three golden rules” that close the chapter—know your adversary, be proactive, protect yourself—are slogans, yet they are the right slogans for a first course.
Third, the later chapters do not pretend every attack is the same. Chapter 3 walks white-box methods (L-BFGS, FGSM, PGD/BIM, C&W) before black-box score- and decision-based settings and transferability. Chapter 4 distinguishes indiscriminate damage from targeted clean-label techniques such as feature collision, and discusses sanitization, robust training, and differential privacy’s double-edged effect on poisoning. Chapter 5’s backdoor material covers outsourced training, transfer learning, and federated participants submitting poisoned updates, and names trigger types (patch, clean-label, dynamic, functional, semantic) plus defenses such as data sanitization, NeuralCleanse-style trigger reconstruction, and fine-pruning—while noting limits against stealthier triggers. Chapter 6’s privacy chapter, largely adapted from the NIST taxonomy, covers reconstruction, membership inference, property inference, and the usual DP toolkit (Laplace/Gaussian mechanisms, DP-SGD), with the important caveat that DP helps less against model extraction and property inference.
For a free course text, that coverage of the classical stack is the main achievement.
Where it falls short
The compilation method shows in the prose. Sentences sometimes wobble—“Key threads for machine learning system,” “Differentiated privacy” for differential privacy—and a few definitions blur neighboring concepts. The Chapter 1 gloss of model inversion as stealing a model by replicating behavior through queries sits awkwardly next to the usual research distinction between inversion (recovering training inputs or sensitive attributes) and extraction (stealing the model itself). Membership inference is described more cleanly. Instructors will need to tidy those edges in lecture.
Depth is uneven by design. The evasion chapter is the richest technical section; the privacy chapter is shorter and more taxonomic. Physical-world adversarial examples and patches appear, but mostly as pointers. There is little runnable code in the PDF itself—unlike hands-on commercial titles that ship notebooks for every attack—so a practitioner cannot treat this as a lab bench without building one.
The larger gap is temporal and architectural. By late 2026, much of the urgent AI security work sits on large language models, retrieval-augmented systems, tool-using agents, prompt injection, supply-chain risk in model hubs, and evaluation harnesses for jailbreaks. Maaroof’s book cites LLM adversarial work and names jailbreak-style techniques in places, and the table of contents promises a ChatGPT “security arms race” case study, but the PDF’s Chapter 2 body I examined resolves more into threat-modelling frameworks and ChatGPT-assisted summaries than a sustained case analysis of production LLM defenses. Students will still need OWASP’s LLM materials, MITRE ATLAS, and current red-team writeups as a second shelf. That is not fatal for a 2025 OER; it is a limit buyers and instructors should price in.
Quiz quality is also mixed. Some knowledge checks are sharp. Others repeat answer options or lean on wording tricks. Because the book discloses LLM help on question banks, that unevenness is unsurprising—and another reason to treat the exercises as drafts instructors should edit.
Who it is for
Assign this book if you teach an adversarial ML module and want a free, accessible spine that already speaks the language of Biggio-style threat models and NIST categories. Pair it with primary papers (Szegedy, Goodfellow, Madry, Carlini–Wagner, Gu et al. on BadNets-style backdoors, Shokri et al. on membership inference) and with a modern LLM/agent security unit the textbook does not fully carry.
Skip it as a sole reference if you are a security engineer standing up an AI red team next quarter. You will get vocabulary and a reading list shape, not an operational playbook, evaluation suite, or governance checklist deep enough for regulated deployments. For that job, treat Maaroof as orientation, then move to primary standards, lab notebooks, and current incident literature.
How it meets the moment
The moment is an industry that ships probabilistic systems faster than most teams can threat-model them, while universities still lack mature, free ML-security curricula. Winning the Battle for Secure ML meets that moment as infrastructure for teaching: open license, clear chapter outcomes, classical attack taxonomy, and explicit links into the research and standards corpus. It misses the moment as a complete answer to 2026’s production surface, where agent tool use, model-supply integrity, and continuous evaluation matter as much as L∞ patches on ImageNet classifiers.
That is still a favorable verdict for what the book claims to be. A free Fanshawe textbook will not win the battle for secure ML. It can train more people to see the battlefield. In a field short on open courseware, that is a real contribution—so long as nobody confuses the map with the campaign.