I think this article by Kent Beck referring more to TDD and unit-testing sums this up fairly well. Basically, it depends on how you actually write the tests*. Here is another article on the subject that might help clarify things.
*If you are testing from within your application, then it is whitebox. If you are testing it just like an outsider would make the calls to only your public facing API, then it is blackbox.