ISerializable

ISerializable is an interface defined in the .NET Framework that enables an object to control its own serialization and deserialization process. Implementing this interface allows a class to provide custom logic for converting its instance data into a serialized format and reconstructing an instance from that format. The interface resides in the System.Runtime.Serialization namespace and contains a single method: void GetObjectData(SerializationInfo info, StreamingContext context).

When a class implements ISerializable, the serialization infrastructure calls GetObjectData during serialization. Inside this method, the object populates the SerializationInfo collection with name/value pairs representing the data that must be persisted. During deserialization, a special constructor that takes SerializationInfo and StreamingContext parameters is invoked. In this constructor the object retrieves the stored values from the SerializationInfo and restores its internal state.

Implementing ISerializable is often combined with the [Serializable] attribute. The attribute marks the type as eligible for serialization, while ISerializable customizes the actual data that is serialized. Without the attribute, the runtime will not serialize the type even if ISerializable is implemented.

Common use cases include handling complex object graphs, securing sensitive data by controlling what is exposed, preserving read‑only fields, or supporting version tolerance by adding extra fields and handling their absence during older deserialization.

Care must be taken to maintain compatibility across versions. Changing the names of serialized values or the order of fields can break deserialization of older binary files. A recommended practice is to use unique names and to provide robust fallback logic for missing entries.

Security concerns arise because deserialization can instantiate arbitrary types. Microsoft recommends avoiding BinaryFormatter with untrusted data and instead using safer serializers such as DataContractSerializer or System.Text.Json. When ISerializable is used, developers should validate the SerializationInfo contents and ensure that no malicious data can be injected.

In summary, ISerializable gives a .NET developer fine‑grained control over the serialization pipeline, enabling custom data representation, compatibility strategies, and enhanced security at the cost of additional implementation effort compared to the default serialization behavior.