Which attacks are prevented by the different initial hash values for SHA-2 with truncated output? NIST specified SHA-2 hash functions with truncated output. Those hashes use different initialization values than SHA-256 or SHA-512. SHA-224 is based on SHA-256. SHA-384, SHA-512/224 and SHA-512/256 are all based on SHA-512.

Although I have seen loose comments on why truncated SHA-2 functions use different initial values, I haven't seen any strong reasoning. The only thing that I can formally find is a quote from RFC 3874: "A 224-bit One-way Hash Function: SHA-224", section "1.1. Usage Considerations:


  The use of
     a different initial value ensures that a truncated SHA-256 message
     digest value cannot be mistaken for a SHA-224 message digest value
     computed on the same data.


But that quote doesn't list any specific attacks nor is it part of a security review of SHA-2.

Can anybody explain which attacks are prevented by choosing different initial values for the SHA-2 variants?

I'm specifically looking for answers that indicate how the initial values help mitigate the attack. More importantly, I'm looking for authoritative answers, that is: answers that can point to a security evaluation or proof of SHA-2 on this subject.
The question's citation is likely the reason why it was chosen different initial starting values for SHA-2 variants of the same internal block size. It is a valid objective by itself that different hash functions yield independent results, linkable only knowing their common input. It is not necessary to have a specific attack in mind to make that conservative choice.

Otherwise stated: For an attacker knowing the SHA-1 of some secret, the best option to find the SHA-256 of that secret is to find the secret. Using different initial values makes it such that the same holds if the attacker knows the SHA-224 hash instead of the SHA-1 hash. That could be called (domain) separation of hash functions.

It is easy to construct artificial protocols where this precaution saves the day. For example: Alice draws a 80-byte random string $S$, reveals its SHA-224 (say, as a commitment or a Key Check Value), then uses $S$ as an HMAC key with SHA-256 as the underlying hash. HMAC will start by hashing $S$ with SHA-256, then use that as its internal key. With the different initialization values in SHA-224 and SHA-256, Alice is safe. Without, she's headed for disaster, as all but 32 bits of the HMAC key coincide with the leaked SHA-224.