I'm a bit worried - there could be idiosyncratic links that these models learn that causes deanonymization. Ideally you could just add a forget loss to prevent this... but how do you add a forget loss if you don't have all of the precise data necessary for such a term?

This is the right question. If full attribution-based control is achieved, then this would be impossible. And the ingredient you've suggested could be a useful way to help achieve it.