Perhaps this would be the sort of situation where you boot from read-only USB stick, or LiveCD.
Theoretically someone could sneak and replace the LiveCD with one that looks identical but is infected with the required malware[1].
Carrying it on you, or locking it in the safe in the room[2], might mitigate that I suppose.
1. Sneak in once, steal a copy of the USB/LiveCD contents, go away and create a new version infected with malware, sneak in again and swap them over.
2. Not really safe as one previous link on HN showed.