Aren’t these “natural attacks” (rotating or blurring the maze, etc) just distribution shifts?

They are in-distribution for us, since we’ve seen objects under all sorts of optical conditions. But they’re out-of-distribution for the RL model, which has only ever seen this exact maze format.