Fair enough. But that argument is a bit subtle. Going back to the 2 bit input example, if your internal state is 4 bits, you only have 2 bits of entropy. So o

Fair enough. But that argument is a bit subtle. Going back to the 2 bit input example, if your internal state is 4 bits, you only have 2 bits of entropy. So outputting the first two bits of your 4 but state is still (probably) valid as far as a hash is concerned, assuming a good enough mixing function. But at the same time, if you need all 4 bits to adequately continue the hash, then 'hiding' those other two bits will help out. So it's not so much the truncation, as much as it is the unnecessary expansion and then later truncation steps that's useful for hashing. (Ex: SHA512 truncated to 256 bits is immune to the attack described). In any case, these attacks are ad-hoc and don't seem to have any pattern. Crypto-experts design against attacks like these. Since there is no pattern, you end up having to study all these attacks and designing against all of them.