The AuditTrail plugin is incompatible with JEP-200 Remoting / XStream whitelist integrated into Jenkins core.

Workaround: add the following commandline parameter to whitelist the required classes:
-Dhudson.remoting.ClassFilter=java.io.BufferedOutputStream,java.io.PrintStream,java.io.FileOutputStream,java.io.FileDescriptor,java.io.BufferedWriter,java.io.OutputStreamWriter,sun.nio.cs.StreamEncoder,sun.nio.cs.UTF_8,sun.nio.cs.UTF_8$$Encoder,java.nio.charset.CodingErrorAction,java.nio.HeapByteBuffer,java.text.SimpleDateFormat,java.text.DecimalFormat,java.text.DecimalFormatSymbols,java.text.DateFormatSymbols

There is already a pull request which prevents the serialization of java.io.PrintStream and java.text.SimpleDateFormat: Update ConsoleAuditLogger to store configuration correctly #10 (but unfortunately not yet released).