If possible, you should prefer not to use serialization/deserialization.
Implement integrity checks such as digital signatures (MD5, SHA-2) on all serialized objects received on both the client and server sides so that if any object has been tampered with, it is rejected by the application before any processing or deserialization happens.
Run deserialization code for low-privilege users.
Log and monitor serialization and deserialization processes and all of their errors and warnings. Use the monitoring system as an input to the security monitoring process in order to generate the appropriate alerts.
