While it is true that the transaction may be flagged, as I wrote in an earlier post, if you participated in a CoinJoin you can prove that the funds you pay out to your addresses came from your own input and were paid to addresses you own.

So all you have to show the exchange is that you had access to the address corresponding to the key which sent the coins. For this purpose, for example you can sign a message with all private keys involved, give the exchange the public keys, and they can check that you have indeed sent these funds. And if there were dubious funds involved in this CoinJoin, you can prove they are different from the funds caming from your sending address.

For example, let's say we have a CoinJoin:

- Address A pays 1 BTC
- Address B pays 2 BTC
- Address C pays 1 BTC
- Address D pays 3 BTC

Now the CoinJoin pays to Address E-K 1 Bitcoin each. Address E and F are owned by the owner of Address B, addresses G, H and I by the owner of Address D, J by the owner of Address A and K by the owner of Address C.

Address A owner wants to prove their source of funds, because an exchange found out that the funds coming from addresses B and D came from hacks. So they sign a message with the private key from Address A and another one with the private key from Address J.

Of course this makes it possible for the exchange to match the chain of transactions before the CoinJoin with chain analysis results. But as far as I understood the OP, their purpose is to anonymize the coins "for the public" (for observers on the public blockchain) but always to be able to prove the chain the funds came from, when requested by an exchange or authority.