We study how well LLMs can determine whether two programs are functionally equivalent. This is an important problem because benchmarking code equivalence helps assess LLM capability in tasks such as code rewriting and translation. To this end, we introduce CETBench — Code Equivalence with Transformations Benchmark — built from a repository of programs that may solve the same or different tasks. Each dataset instance is created by sampling a program pair and applying a random sequence of predefined code transformations, yielding either equivalent or non-equivalent pairs. Our analysis shows that even simple transformations cause a significant performance drop in state-of-the-art LLMs on code-equivalence checking. These challenges are further amplified in the cross-lingual setting when comparing programs written in different languages. To remedy this, we present a simple fine-tuning-based approach to boost LLM performance on the transformed pairs of programs. Our approach for dataset generation is generic, supporting cross-lingual equivalence checking, the generation of program pairs with varying difficulty levels, and the application of diverse transformations. In our experiments, we perform ablations over the difficulty level of original programs, as well as the kind of transformations used in generating pairs for equivalence checking. Our analysis presents deep insights into the working of LLMs for the task of code-equivalence, and points to the fact that they may still be far from what could be termed as a semantic understanding of the underlying code.

Most existing harmful prompt detection methods rely on surface-level semantic representations, making them vulnerable to paraphrasing, prone to false positives, and limited in their ability to generalize to novel or adversarial prompts. Recent work has explored the use of model-internal signals, such as gradients or spectral features, to train classifiers that capture latent malicious behavior beyond surface semantics. However, these approaches primarily operate on local or isolated internal features and do not model the global structure of model behavior, which limits their robustness against subtle adversarial manipulations. In this work, we focus on robust harmful prompt detection under adversarial attacks. We propose SAFER, a simple yet effective method that models cross-layer attention signature flow by learning spectral correlation priors between attention heads and constructing a cross-layer attention-head spectral graph. This facilitates explicit modeling of structured attention propagation across layers, allowing the capture of both local and global attention dynamics and leading to improved robustness. SAFER achieves superior performance across multiple benchmark datasets for harmful prompt detection, while demonstrating significantly greater resilience to diverse adversarial attacks compared to prior approaches.