It is assumed that generating a collision requires more than 2^156 ciphertext modifications. This is plenty enough for any practical purposes, but it hasn't been proven to be >= 2^256. Be consistent and conservative here; just claim the same security as the other variants.