How big of a risk is overfitting for these kinds of models? I think common practice is to hold back some of the data for testing.