The metadata format is per-target, so there's no one answer to your question. But since you mention the phishing classifier, I can point you
here, which is where that target processes the metadata. It needs to be a ClientSidePhishingModelMetadata (with the Any wrapping, serialization, etc), and you can read the nearby code to understand the semantics.
I'll also note that the phishing classifier seems to have its own override flag (
source). I'm not sure which will be more usable for you, but it might be interesting to look at.