DeepSeek 企业级应用方案

1.1 架构全景图

企业级 DeepSeek 部署采用分层架构，每层独立可扩展、可替换。核心组件如下：

1.2 请求流转路径

一次完整的 API 请求流转路径：

1.3 架构设计原则

2.1 多节点部署架构

至少部署 3 个推理节点，分布在不同的物理机或可用区，避免单点故障：

# 多节点 vLLM 部署（3 节点集群）
# 节点 1（192.168.1.11）
python -m vllm.entrypoints.openai.api_server \
--model deepseek-ai/DeepSeek-R1-Distill-Qwen-32B \
--tensor-parallel-size 2 \
--host 0.0.0.0 --port 8000

# 节点 2（192.168.1.12）
python -m vllm.entrypoints.openai.api_server \
--model deepseek-ai/DeepSeek-R1-Distill-Qwen-32B \
--tensor-parallel-size 2 \
--host 0.0.0.0 --port 8000

# 节点 3（192.168.1.13）
python -m vllm.entrypoints.openai.api_server \
--model deepseek-ai/DeepSeek-R1-Distill-Qwen-32B \
--tensor-parallel-size 2 \
--host 0.0.0.0 --port 8000

2.2 健康检查配置

负载均衡器需要定期探测后端服务健康状态，自动摘除故障节点：

# Nginx 健康检查配置
upstream deepseek_cluster {
server 192.168.1.11:8000 max_fails=3 fail_timeout=30s;
server 192.168.1.12:8000 max_fails=3 fail_timeout=30s;
server 192.168.1.13:8000 max_fails=3 fail_timeout=30s;

# 主动健康检查（需要 nginx-plus 或 nginx-module）
# check interval=3000 rise=2 fall=3 timeout=1000 type=http;
# check_http_send "HEAD /health HTTP/1.0\r\n\r\n";
# check_http_expect_alive http_2xx;
}

# 自定义健康检查脚本
# /usr/local/bin/healthcheck-vllm.sh
#!/bin/bash
for node in 192.168.1.11 192.168.1.12 192.168.1.13; do
status=$(curl -s -o /dev/null -w "%{http_code}" http://$node:8000/health)
if [ "$status" != "200" ]; then
echo "ALERT: Node $node is DOWN" | systemd-cat -t healthcheck
# 触发告警通知
fi
done

2.3 故障转移策略

2.4 Kubernetes HA 配置

# deepseek-ha-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: deepseek-vllm
namespace: deepseek
spec:
replicas: 3
selector:
matchLabels:
app: deepseek-vllm
template:
metadata:
labels:
app: deepseek-vllm
spec:
# Pod 反亲和：确保 Pod 分散在不同节点
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app
operator: In
values:
- deepseek-vllm
topologyKey: kubernetes.io/hostname
# 优雅终止：给 Pod 30 秒处理完当前请求
terminationGracePeriodSeconds: 30
containers:
- name: vllm
image: vllm/vllm-openai:latest
ports:
- containerPort: 8000
resources:
requests:
nvidia.com/gpu: 2
memory: "64Gi"
limits:
nvidia.com/gpu: 2
memory: "80Gi"
livenessProbe:
httpGet:
path: /health
port: 8000
initialDelaySeconds: 120
periodSeconds: 10
failureThreshold: 3
readinessProbe:
httpGet:
path: /health
port: 8000
initialDelaySeconds: 60
periodSeconds: 5
failureThreshold: 3
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 1

2.5 自动扩缩容（HPA）

# deepseek-hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: deepseek-vllm-hpa
namespace: deepseek
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: deepseek-vllm
minReplicas: 3
maxReplicas: 10
metrics:
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: 70
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: 80
behavior:
scaleDown:
stabilizationWindowSeconds: 300
policies:
- type: Percent
value: 50
periodSeconds: 60
scaleUp:
stabilizationWindowSeconds: 30
policies:
- type: Pods
value: 2
periodSeconds: 30

3.1 Nginx Upstream 配置

# /etc/nginx/conf.d/deepseek-upstream.conf
upstream deepseek_vllm {
# least_conn 算法：优先分配给连接数最少的节点
# 适合 LLM 推理场景（请求耗时差异大）
least_conn;

# 推理节点池
server 192.168.1.11:8000 weight=1 max_fails=3 fail_timeout=30s;
server 192.168.1.12:8000 weight=1 max_fails=3 fail_timeout=30s;
server 192.168.1.13:8000 weight=1 max_fails=3 fail_timeout=30s;

# 备用节点（低优先级，仅在主节点全挂时启用）
server 192.168.1.14:8000 weight=1 backup;

# 长连接池：减少 TCP 握手开销
keepalive 64;
keepalive_requests 1000;
keepalive_timeout 60s;
}

# vLLM 推理服务（高性能）
upstream deepseek_vllm_large {
least_conn;
server 192.168.1.21:8000 weight=3; # A100 × 8（高权重）
server 192.168.1.22:8000 weight=3; # A100 × 8
server 192.168.1.23:8000 weight=1; # A10 × 1（低权重）
keepalive 32;
}

3.2 Sticky Session（会话保持）

LLM 推理场景中，Sticky Session 可将同一用户的连续请求路由到同一节点，提高 KV Cache 命中率：

# 基于 Cookie 的会话保持
upstream deepseek_sticky {
# ip_hash 算法：相同客户端 IP 始终路由到同一节点
ip_hash;

server 192.168.1.11:8000;
server 192.168.1.12:8000;
server 192.168.1.13:8000;
}

# 使用 sticky cookie（需要 nginx-plus 或 sticky-module）
upstream deepseek_sticky_cookie {
# sticky cookie srv_id expires=1h domain=.example.com path=/;
server 192.168.1.11:8000;
server 192.168.1.12:8000;
server 192.168.1.13:8000;
}

3.3 连接池与 Keepalive 优化

3.4 负载均衡算法对比

4.1 API 认证方案

支持 JWT（JSON Web Token）和 OAuth2 两种认证方式，适应不同场景：

JWT 认证（服务间调用）

# JWT Token 生成（服务端）
# Python 示例
import jwt
import time

def generate_api_token(user_id: str, scope: str = "deepseek:read") -> str:
payload = {
"sub": user_id,
"scope": scope,
"iat": int(time.time()),
"exp": int(time.time()) + 3600 # 1 小时过期
}
return jwt.encode(payload, "your-secret-key", algorithm="HS256")

# Nginx JWT 验证（使用 njs 或 lua-nginx-module）
# 在 location 块中添加 JWT 验证逻辑
location /v1/ {
auth_jwt "DeepSeek API";
auth_jwt_key_file /etc/nginx/jwt_public_key.pem;
proxy_pass http://deepseek_vllm;
}

OAuth2 认证（用户授权）

# Kong API Gateway OAuth2 插件配置
# 启用 OAuth2 插件
curl -X POST http://localhost:8001/services/deepseek/plugins \
--data "name=oauth2" \
--data "config.enable_authorization_code=true" \
--data "config.enable_client_credentials=true" \
--data "config.token_expiration=3600"

# 创建 OAuth2 应用
curl -X POST http://localhost:8001/consumers/your-app/oauth2 \
--data "name=DeepSeek App" \
--data "client_id=your-client-id" \
--data "client_secret=your-client-secret" \
--data "redirect_uris[]=https://your-app.com/callback"

4.2 速率限制

# Nginx 速率限制配置
# /etc/nginx/nginx.conf
http {
# 按 IP 限速：10 请求/秒，突发 20
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

# 按 API Key 限速：50 请求/秒
limit_req_zone $http_x_api_key zone=per_key_limit:10m rate=50r/s;

# 并发连接限制
limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
}

# Server 块中应用
server {
location /v1/chat/completions {
# 基础限速
limit_req zone=api_limit burst=20 nodelay;
limit_req_status 429;

# 按 API Key 限速
limit_req zone=per_key_limit burst=50 nodelay;

# 并发限制
limit_conn conn_limit 10;

proxy_pass http://deepseek_vllm;
}
}

4.3 IP 白名单

# Nginx IP 白名单
location /v1/admin/ {
# 仅允许内网和 VPN 网段访问
allow 10.0.0.0/8;
allow 172.16.0.0/12;
allow 192.168.0.0/16;
deny all;

proxy_pass http://deepseek_vllm;
}

# 使用 GeoIP 模块限制国家/地区
# geoip_country /usr/share/GeoIP/GeoIP.dat;
# map $geoip_country_code $allowed_country {
# default no;
# CN yes;
# US yes;
# }

4.4 请求校验

在 API Gateway 层对请求进行校验，防止恶意或异常请求：

# Nginx 请求校验
location /v1/chat/completions {
# 限制请求体大小
client_max_body_size 1M;

# 仅允许 POST 方法
limit_except POST {
deny all;
}

# 限制 Content-Type
if ($http_content_type !~ "^application/json") {
return 415 '{"error":"Unsupported Media Type"}';
}

# 限制 max_tokens 参数（防止资源滥用）
# 需配合 lua-nginx-module 或 njs 实现

proxy_pass http://deepseek_vllm;
}

4.5 Prompt 注入防护

Prompt 注入是企业级 AI 应用面临的主要安全威胁之一。攻击者通过精心构造的 Prompt 绕过系统指令，获取敏感信息或执行非授权操作。

# Python 端 Prompt 注入检测示例
import re

INJECTION_PATTERNS = [
r"ignore\s+(all\s+)?(previous|above|prior)\s+instructions?",
r"you\s+are\s+now\s+(DAN|jailbreak)",
r"system\s*prompt[:=]",
r"pretend\s+you\s+are",
r"<\|im_start\|>",
r"<\|im_end\|>",
]

def detect_injection(user_input: str) -> bool:
for pattern in INJECTION_PATTERNS:
if re.search(pattern, user_input, re.IGNORECASE):
return True
return False

4.6 数据加密

5.1 RBAC 权限模型

基于角色的访问控制（Role-Based Access Control），定义角色、权限、资源的映射关系：

5.2 多租户隔离

多租户隔离是企业级平台的刚需。推荐方案：

5.3 API Key 管理

# API Key 管理最佳实践
# 1. Key 生成
openssl rand -hex 32 # 64 字符随机 Key

# 2. Key 存储（哈希存储，不存明文）
import hashlib
import secrets

def create_api_key() -> tuple[str, str]:
raw_key = "sk-" + secrets.token_hex(24)
hashed = hashlib.sha256(raw_key.encode()).hexdigest()
return raw_key, hashed # 明文返回给用户，哈希存数据库

# 3. Key 验证
def verify_api_key(raw_key: str, stored_hash: str) -> bool:
return hashlib.sha256(raw_key.encode()).hexdigest() == stored_hash

# 4. Key 权限绑定
api_key_config = {
"key_hash": "abc123...",
"tenant_id": "tenant-001",
"role": "developer",
"rate_limit": 100, # 请求/分钟
"daily_quota": 1000000, # Token/天
"allowed_models": ["deepseek-v3", "deepseek-r1"],
"expires_at": "2026-12-31T23:59:59Z"
}

5.4 用量配额管理

5.5 部门级访问控制

# 部门级权限配置示例
departments:
engineering:
quota: 5000000 # 500万 Token/天
models: [deepseek-v3, deepseek-r1, deepseek-coder]
rate_limit: 200
members: [user1, user2, user3]

marketing:
quota: 1000000 # 100万 Token/天
models: [deepseek-v3]
rate_limit: 50
members: [user4, user5]

finance:
quota: 500000
models: [deepseek-v3]
rate_limit: 30
members: [user6]
# 金融部门特殊限制：禁用流式输出
features:
streaming: false

6.1 请求日志记录

完整记录每次 API 请求的元数据，用于审计、计费和问题排查：

# Nginx 审计日志格式
# /etc/nginx/conf.d/deepseek-log.conf
log_format deepseek_audit escape=json
'{'
'"timestamp":"$time_iso8601",'
'"remote_addr":"$remote_addr",'
'"api_key":"$http_x_api_key",'
'"request_method":"$request_method",'
'"request_uri":"$request_uri",'
'"status":$status,'
'"body_bytes_sent":$body_bytes_sent,'
'"request_time":$request_time,'
'"upstream_addr":"$upstream_addr",'
'"upstream_response_time":"$upstream_response_time",'
'"user_agent":"$http_user_agent",'
'"x_forwarded_for":"$http_x_forwarded_for"'
'}';

access_log /var/log/nginx/deepseek-audit.log deepseek_audit buffer=64k flush=5s;

6.2 用户活动追踪

在应用层记录用户操作，构建完整的审计链路：

# Python 审计日志中间件
import logging
import json
from datetime import datetime, timezone

audit_logger = logging.getLogger("deepseek.audit")

def log_api_call(user_id: str, action: str, details: dict):
audit_entry = {
"timestamp": datetime.now(timezone.utc).isoformat(),
"user_id": user_id,
"action": action, # "chat.completion", "model.list", etc.
"model": details.get("model"),
"prompt_tokens": details.get("prompt_tokens"),
"completion_tokens": details.get("completion_tokens"),
"total_tokens": details.get("total_tokens"),
"latency_ms": details.get("latency_ms"),
"ip_address": details.get("ip_address"),
"user_agent": details.get("user_agent"),
"status": details.get("status"), # "success" | "error"
}
audit_logger.info(json.dumps(audit_entry, ensure_ascii=False))

6.3 合规审计要求

6.4 日志保留策略

# Logrotate 配置
# /etc/logrotate.d/deepseek
/var/log/deepseek/*.log {
daily
rotate 90 # 保留 90 天
compress
delaycompress
missingok
notifempty
dateext
dateformat -%Y%m%d
postrotate
# 发送信号给 Nginx 重新打开日志文件
/usr/bin/killall -USR1 nginx 2>/dev/null || true
endscript
}

# 审计日志（符合等保要求，保留 6 个月）
/var/log/deepseek/audit/*.log {
daily
rotate 180
compress
delaycompress
missingok
notifempty
dateext
# 归档到对象存储（S3/OSS）
lastaction
/usr/local/bin/archive-logs.sh
endscript
}

6.5 ELK Stack 集成

# Filebeat 配置：采集 Nginx 日志发送到 Elasticsearch
# /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/deepseek-audit.log
json.keys_under_root: true
json.add_error_key: true
fields:
service: deepseek-api
log_type: audit
fields_under_root: true

output.elasticsearch:
hosts: ["https://elasticsearch.example.com:9200"]
username: "filebeat_writer"
password: "${ES_PASSWORD}"
index: "deepseek-audit-%{+yyyy.MM.dd}"

# ILM 策略：热数据 7 天，温数据 30 天，冷数据 90 天
setup.ilm.enabled: true
setup.ilm.rollover_alias: "deepseek-audit"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.policy_name: "deepseek-audit-policy"

7.1 Prometheus 指标采集

vLLM 内置 Prometheus 指标端点，开箱即用：

# prometheus.yml
global:
scrape_interval: 15s
evaluation_interval: 15s

alerting:
alertmanagers:
- static_configs:
- targets: ['alertmanager:9093']

rule_files:
- '/etc/prometheus/rules/deepseek-alerts.yml'

scrape_configs:
- job_name: 'vllm'
scrape_interval: 10s
static_configs:
- targets:
- 'vllm-node-1:8000'
- 'vllm-node-2:8000'
- 'vllm-node-3:8000'
metrics_path: '/metrics'

- job_name: 'nginx'
static_configs:
- targets: ['nginx-exporter:9113']

- job_name: 'node'
static_configs:
- targets:
- 'node-exporter-1:9100'
- 'node-exporter-2:9100'
- 'node-exporter-3:9100'

- job_name: 'dcgm' # NVIDIA GPU 指标
static_configs:
- targets: ['dcgm-exporter:9400']

7.2 Grafana 仪表盘

推荐导入以下 Grafana Dashboard 模板：

7.3 AlertManager 告警规则

# /etc/prometheus/rules/deepseek-alerts.yml
groups:
- name: deepseek_sla
rules:
# 可用性告警
- alert: DeepSeekServiceDown
expr: up{job="vllm"} == 0
for: 1m
labels:
severity: critical
team: platform
annotations:
summary: "DeepSeek 推理服务不可用"
description: "节点 {{ $labels.instance }} 已宕机超过 1 分钟"

# 延迟告警
- alert: HighLatency
expr: histogram_quantile(0.95, rate(vllm:time_to_first_token_seconds_bucket[5m])) > 2
for: 5m
labels:
severity: warning
annotations:
summary: "TTFT P95 超过 2 秒"

# GPU 显存告警
- alert: GPUMemoryHigh
expr: vllm:gpu_cache_usage_perc > 90
for: 5m
labels:
severity: warning
annotations:
summary: "GPU 显存使用率超过 90%"

# 队列积压告警
- alert: RequestQueueBacklog
expr: vllm:num_requests_waiting > 20
for: 3m
labels:
severity: warning
annotations:
summary: "请求队列积压超过 20"

# 错误率告警
- alert: HighErrorRate
expr: rate(vllm:request_errors_total[5m]) / rate(vllm:request_total[5m]) > 0.05
for: 5m
labels:
severity: critical
annotations:
summary: "API 错误率超过 5%"

# 成本告警
- alert: HighCostDaily
expr: increase(vllm:total_tokens_generated[24h]) * 0.000002 > 100
for: 1h
labels:
severity: info
annotations:
summary: "日 Token 消耗估算成本超过 $100"

7.4 SLA 监控

# Prometheus SLA 记录规则
# /etc/prometheus/rules/deepseek-sla.yml
groups:
- name: deepseek_sla_recording
interval: 1m
rules:
# 可用性百分比
- record: job:availability:ratio
expr: avg(up{job="vllm"})

# 成功请求率
- record: job:success_rate:ratio
expr: |
sum(rate(vllm:request_success_total[5m]))
/
sum(rate(vllm:request_total[5m]))

# P50/P95/P99 延迟
- record: job:ttft:p50
expr: histogram_quantile(0.50, rate(vllm:time_to_first_token_seconds_bucket[5m]))

- record: job:ttft:p95
expr: histogram_quantile(0.95, rate(vllm:time_to_first_token_seconds_bucket[5m]))

- record: job:ttft:p99
expr: histogram_quantile(0.99, rate(vllm:time_to_first_token_seconds_bucket[5m]))

8.1 模型备份策略

8.2 多区域部署架构

# 多区域 DNS 配置（Route 53 / Cloud DNS）
# 主区域：ap-southeast-1（新加坡）
# 备用区域：us-west-2（俄勒冈）

# 智能 DNS 路由策略
Record: api.deepseek.example.com
Type: A (Alias)
Routing: Latency-based

# 主区域
ap-southeast-1:
- api.deepseek.example.com → 主集群 LB (103.x.x.x)

# 备用区域（热备）
us-west-2:
- api.deepseek.example.com → 备用集群 LB (54.x.x.x)

# 故障切换配置
# 健康检查：每 30 秒探测主集群 /health
# 连续 3 次失败 → 自动切换至备用区域
# 主集群恢复 → 自动切回

8.3 RTO/RPO 定义

8.4 故障切换演练

# 故障切换演练脚本
#!/bin/bash
# failover-drill.sh

echo "=== 故障切换演练开始 ==="
echo "时间: $(date)"

# 1. 模拟主集群故障
echo "[1/5] 模拟主集群故障..."
kubectl scale deployment deepseek-vllm --replicas=0 -n deepseek
sleep 10

# 2. 验证 DNS 切换
echo "[2/5] 验证 DNS 切换..."
PRIMARY_HEALTH=$(curl -s -o /dev/null -w "%{http_code}" https://primary-api.example.com/health)
BACKUP_HEALTH=$(curl -s -o /dev/null -w "%{http_code}" https://backup-api.example.com/health)
echo "主集群: HTTP $PRIMARY_HEALTH"
echo "备用集群: HTTP $BACKUP_HEALTH"

# 3. 验证 API 可用性
echo "[3/5] 验证 API 可用性..."
curl -s https://api.deepseek.example.com/v1/models | jq .

# 4. 验证数据一致性
echo "[4/5] 验证数据一致性..."
# 检查最近 1 分钟的审计日志是否完整

# 5. 恢复主集群
echo "[5/5] 恢复主集群..."
kubectl scale deployment deepseek-vllm --replicas=3 -n deepseek

echo "=== 故障切换演练完成 ==="
echo "RTO: 记录实际恢复时间"
echo "RPO: 检查是否有数据丢失"

建议每季度进行一次完整的故障切换演练，验证 RTO/RPO 是否达标，同时发现预案中的不足。访问 DeepSeek 部署教程 了解基础部署方案。

9.1 Token 用量追踪

# Token 用量统计 SQL 示例（ClickHouse）
CREATE TABLE token_usage (
timestamp DateTime,
api_key String,
tenant_id String,
department String,
model String,
prompt_tokens UInt64,
completion_tokens UInt64,
total_tokens UInt64
) ENGINE = MergeTree()
PARTITION BY toYYYYMM(timestamp)
ORDER BY (tenant_id, department, timestamp);

# 按部门统计每日用量
SELECT
department,
toDate(timestamp) as date,
sum(total_tokens) as daily_tokens,
sum(prompt_tokens) as prompt_tokens,
sum(completion_tokens) as completion_tokens
FROM token_usage
WHERE timestamp >= now() - INTERVAL 30 DAY
GROUP BY department, date
ORDER BY department, date;

9.2 按部门成本分摊

9.3 预算告警配置

# Prometheus 预算告警规则
groups:
- name: cost_alerts
rules:
# 部门预算使用率告警
- alert: DeptBudget80Percent
expr: |
(sum by (department) (increase(vllm:total_tokens[30d])) * 0.01)
/
(dept_budget_limit) > 0.8
for: 1h
labels:
severity: warning
annotations:
summary: "部门 {{ $labels.department }} 预算使用超过 80%"

# 日成本异常增长告警
- alert: CostSpike
expr: |
(sum(increase(vllm:total_tokens[1h])) * 0.01)
>
(sum(increase(vllm:total_tokens[1h] offset 24h)) * 0.01) * 3
for: 30m
labels:
severity: critical
annotations:
summary: "Token 消耗相比昨日同时段增长超过 300%"

9.4 模型分级策略

根据任务复杂度智能路由到不同模型，避免"杀鸡用牛刀"：

9.5 缓存策略

语义缓存可大幅降低推理成本，对于重复或相似问题直接返回缓存结果：

# Redis 语义缓存配置
# 使用 GPTCache 或 LangChain Cache
from gptcache import cache
from gptcache.adapter import openai
from gptcache.embedding import Onnx
from gptcache.manager import CacheBase, VectorBase, get_data_manager
from gptcache.similarity_evaluation.distance import SearchDistanceEvaluation

# 初始化语义缓存
onnx_embedding = Onnx()
data_manager = get_data_manager(
CacheBase("redis", host="redis-cache", port=6379),
VectorBase("milvus", host="milvus", port="19530")
)

cache.init(
embedding_func=onnx_embedding.to_embeddings,
data_manager=data_manager,
similarity_evaluation=SearchDistanceEvaluation(),
similarity_threshold=0.85 # 相似度阈值
)

# 缓存命中率预期
# 客服场景：30%-50%
# 代码生成：10%-20%
# 通用问答：20%-40%

语义缓存可节省 20%-40% 的推理成本。访问 DeepSeek 使用指南 和 DeepSeek 模型详情 了解模型选型。

10.1 数据驻留

确保用户数据存储在指定的地理区域，满足不同国家/地区的数据主权要求：

10.2 GDPR 合规检查清单

10.3 数据脱敏

在 Prompt 发送到模型之前，自动检测并脱敏敏感信息：

# Python 数据脱敏中间件
import re
from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine

analyzer = AnalyzerEngine()
anonymizer = AnonymizerEngine()

def anonymize_prompt(text: str) -> str:
# 检测 PII 实体
results = analyzer.analyze(
text=text,
entities=["PHONE_NUMBER", "EMAIL_ADDRESS",
"PERSON", "CREDIT_CARD", "IBAN_CODE",
"CN_ID", "PASSPORT_NUMBER"],
language="zh"
)

# 脱敏处理
anonymized = anonymizer.anonymize(text=text, analyzer_results=results)
return anonymized.text

# 示例
original = "我的手机号是 13812345678，邮箱是 zhang@example.com"
safe = anonymize_prompt(original)
# 输出: "我的手机号是 <PHONE_NUMBER>，邮箱是 <EMAIL_ADDRESS>"

10.4 模型卡片（Model Card）

每个模型实例应维护模型卡片，记录模型的基本信息、能力边界和风险提示：

10.5 负责任 AI 指南

负责任 AI 不是一次性工作，而是持续的过程。建议成立 AI 治理委员会，定期审查 AI 应用的风险和合规性。访问 DeepSeek 模型列表 和 提示词工程 了解更多最佳实践。