Further harden the `deserialize()` function and the `Input` class (see #6724)