is the threat model something you put into a ML or nah?