- use real Attack model to test in test_model