Unique one-time links are a standard solution, but if the OP's requirements disallow sending the survey credentials to the user, the solution needs to use something that the user already has and the system knows of, and store it in a way that prevents reverse engineering and extracting identifiable information.
This, unfortunately, means that the user has to present some sort of proof of identity to the system, and the system must be able to tie that proof of identity to the user. But there's some leeway in how the data can be stored.
Let's say Alice wants to cast a vote in survey #42. The system can do the following:
- Take Alice's username and password and authenticate her using the standard authentication mechanism, presumably involving a hash of the password.
- Compute a hash of
Alice|42|alicespassword and store that in the database alongside the vote.
Even if Eve manages to steal the entire database, she won't know that Alice has voted, and she won't be able to correlate votes across different surveys, since both would require reversing the hash. Eve will also not be able to cast a vote for Alice since Alice needs to authenticate to your system first, and Alice won't be able to vote again unless she changes her password (which a real solution should be secured against - I'll leave that as an exercise to the reader).
There are still attacks that can be performed - with write access Eve can add votes to the database without a real way of verifying that they're legitimate, and the system can capture Alice's credentials and try to match them against surveys she filled in. But since, as @Philipp stated, there's pretty much no way to have a 100% trustless solution (especially if the requirement is that no key can be provided from the system to the user) this seems like a reasonable compromise.