Model Extraction Attacks Revisited