Disclaimer: I'm not well informed about crypto-currencies. This is just to test if I'm understanding correctly.

So you are doing mixing. One of your users is a criminal, and that is apparent to you as you can trace where their coins came from. In your stash, you have 100BTC, 10 of which is the share from the criminal. He/she orders 1BTC to be transferred to a private wallet. You make a transfer to the private wallet from your stash, but you know exactly who gave the order. When the police comes to you, you will be forced to tell them who gave the order. Am I missing something? If I'm correct, then the attacker has to trust the mixer.