Optimal sizing of a holdout set for safe predictive model updating