Why are processes requiring (almost) as much work as brute force considered an "attack" on a hash function? In the literature on attacks against hash functions, I frequently come across algorithms requiring $2^n$ work described as being preimage or collision "attacks" on a hash function with only marginally more than $n$ bits of output$^1$.

Have I grievously misunderstood the terminology here?

If the result of the attack is an $n$-bit value then brute force takes $2^n$ tries; how can anything only slightly better than this be considered a meaningful enough "attack" to be worthy of publishing?

It seems to be making article titles nearly useless; a well peer-reviewed article titled "an attack against AES" in a reputable publication could be anything from irrelevant to cataclysmically internet-shattering in its consequences.

Here's an example from the Wikipedia page for Salsa20:


  In 2007, Tsunoo et al. announced a cryptanalysis of Salsa20 which breaks 8 out of 20 rounds to recover the 256-bit secret key in $2^{255}$



or key-recovery "attacks" against a symmetric cipher having only marginally more than $n$ bits of secret key, although I've been reading mostly hash function papers lately.
It's just a matter of terminology, which (as often in mathematics and related disciplines) may not match your intuitive interpretation of the words.


An attack is any algorithm that performs better than the "obvious" brute force algorithms. Cryptographic primitives are designed to admit no attack better than generic ones, so any proof that this goal is not met constitutes a break (but maybe not a complete break) to a theorist. For more practically-minded people, it demonstrates attack vectors and techniques which may be useful in constructing more efficient algorithms.
If an attack is effectively breaking the system for realistic key sizes, it is often referred to as a practical attack. (And people usually proudly put this term into their paper's titles if their attack performs this good.) For well-studied primitives, this luckily does not happen very often.
Some papers describe attacks against round-reduced variants of a cipher: this again serves as a demonstration of attack techniques and (just like any other kind of cryptanalysis) is an important step in cipher design, because it provides an estimate for the number of rounds the cipher should have. Papers should (and usually do) clearly point out that they're attacking non-standard variants.


Then of course, unfortunately some (if not many) people have a tendency to oversell their results — there's nothing you can do against that, but the above should help in filtering for the kind of attacks you're interested in.