Definition~\ref{def:dp} of \dempar can be written synthetically as the following property:
$P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}$.
Where $P_{\hat{Y}}\otimes P_{S}$ is the product measure defined as the unique measure on 
$\mathcal{P}(\mathcal{Y})\times\mathcal{P}(\mathcal{S})$ such that
$\forall y\in\mathcal{P}(\mathcal{Y})\forall s\in\mathcal{P}(\mathcal{S})\quad P_{\hat{Y}}\otimes P_{S}(y\times s) = P_{\hat{Y}}(y)P_{S}(s)$.
This is equivalent to definition~\ref{def:dp} for binary labels and sensitive attribute but more general because when $\hat{Y}$ is not binary as in soft labels, this new definition is well defined.
% We write formally 
\begin{definition}
\label{def:dps}
    $\hat{Y}$ satisfies extended \dempar for $S$ if and only if: $P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}$.
\end{definition}
This definition is the same as the statistical parity introduced for fair regression~\cite{fairreg}. 
Note that we can not derive a quantity similar to \demparlevel with this definition but this extended \dempar assures indistinguishably of the sensitive attribute when looking at the soft labels.
We have the following theorem:
\begin{theorem}\label{th:advdebias}
    The following propositions are equivalent: ``$\hat{Y}_s$ is independent of $S$'' and ``Balanced accuracy of \aia in \ref{tm:soft} is $\frac{1}{2}$''
\end{theorem}
\begin{proof}
Let's show that it is equivalent to say "all attack models have a balanced accuracy of 0.5" and "the target model satisfies extended demographic parity".
{\footnotesize
    \begin{align*}
            &\forall a~P(\hat{Y}\in a^{-1}(\{0\})|S=0)+P(\hat{Y}\in a^{-1}(\{1\})|S=1) = 1\\
            \Leftrightarrow&\forall a~P(\hat{Y}\in a^{-1}(\{0\})|S=0)=P(\hat{Y}\in a^{-1}(\{0\})|S=1)\\
            \Leftrightarrow&\forall A~P(\hat{Y}\in A)|S=0)=P(\hat{Y}\in A|S=1) \\
            \Leftrightarrow &P_{\hat{Y},S}=P_{\hat{Y}}\otimes P_{S}
        \end{align*}
        }
\end{proof}

%In conclusion, with extended \dempar we can not unconditionally bound the balanced accuracy of the attack without introducing distances in the space of distributions, but it gives us a condition to protect the sensitive attribute in case of an adversary gaining access to soft labels (AS).