Maybe, we will 
1. create empty file first, 
2. put attribute that file is protected.
3. serialize there.

Because, in this implementation file insecure for 1 moment, if setting this attribute fail, then it will be insecure.