Towards More Realistic Extraction Attacks: An Adversarial Perspective