Black-Box Interaction Research

• Black-box interaction is a framework that treats systems as hidden mappings, interacting solely through input queries and observed outputs to reveal operational insights.
• It employs controlled perturbations and adversarial querying to extract interpretable regularities and analyze joint feature interactions across varied domains.
• It supports hybrid system training by integrating opaque modules via differentiable proxies, enhancing performance while adhering to restricted-access settings.

Black-box interaction denotes the study and use of systems that are accessible only through an interface of queries and observed outputs: in one line of work, a black-box is defined by a hidden function that maps a specific set of inputs to outputs; in others, it is an arbitrary, potentially non-differentiable program module, a query-only predictor $f(x)$, an API-only LLM, an object detector observed through detections, or a quantum device whose behavior must be inferred while minimizing disturbance (Yin et al., 26 Aug 2025, Jacovi et al., 2019, Britton, 2019, Navaratnarajah et al., 3 Dec 2025, Matsumoto, 2016). Across these settings, black-box interaction serves at least four roles: probing whether nominal inputs actually matter, extracting interpretable regularities from input-output behavior, composing trainable systems around fixed opaque components, and controlling or evaluating agents when parameter-level access is unavailable. Several studies also show that strong end-task performance can coexist with minimal use of intended information sources or with weak adaptive exploration, making interface-level analysis a methodological necessity rather than a purely explanatory add-on (Mironenco et al., 2017, Yin et al., 26 Aug 2025).

1. Interface-centered formulations

A central formulation treats the black box as a hidden mapping $f:\mathcal{X}\to\mathcal{Y}$ that can be queried during an exploration stage and then evaluated on unseen inputs. In the \textsc{Oracle} benchmark, LLMs submit valid inputs, observe corresponding outputs, accumulate a history $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$, and generate the next query according to $x^t = M(H_{t-1})$ before predicting outputs for test inputs (Yin et al., 26 Aug 2025). A related but more general interface assumption appears in model-agnostic interpretability: VINE requires only the ability to query the predictor function $f(x)$, BETA explains any black-box classifier through transparent approximations, and BlackCAtt requires only the ability to query object detectors with images and observe bounding boxes and labels (Britton, 2019, Lakkaraju et al., 2017, Navaratnarajah et al., 3 Dec 2025).

The same interface logic extends beyond explanation. In "Estimate and Replace," existing black-box functions are arbitrary, potentially non-differentiable program modules embedded into trainable systems through a differentiable proxy during training and exact replacement at inference (Jacovi et al., 2019). In black-box LLM work, API-only access is treated as an environment constraint: Matryoshka regards the black-box LLM as an environment guided by a white-box controller, AMC treats the fixed black-box LLM agent as the prior policy $\pi_0(\tau)$, and DiverseAgentEntropy constructs multiple agents from the same base LLM by assigning diverse related questions (Li et al., 2024, Hwang et al., 3 Jun 2026, Feng et al., 2024).

This interface-centered view is important because it decouples methodology from internals. The black box may be a multimodal dialog model, a recommender, a LLM, a detector, or a quantum operation; what is common is that claims are established from interventions, queries, and observed responses rather than from gradients or parameter inspection. A plausible implication is that black-box interaction is best understood as a family of experimental protocols rather than as a single explanatory technique.

2. Intervention, perturbation, and adversarial querying

One influential use of black-box interaction is component testing by targeted impairment. In visual dialog, structured and randomized interventions are applied to initial conditions and dialog tokens without making assumptions about internals. The image feature vector is replaced by random noise $z \sim \mathrm{Uniform}(0,1)$; caption tokens are replaced by random words with probability $p$; dialog tokens in questions or answers are randomized with probability $p$; and a structured negation intervention flips yes/no answers. The task metric is Mean Percentile Rank (MPR). At round 10, the reported values are: None $= 92.6\%$, Image $f:\mathcal{X}\to\mathcal{Y}$0, Caption $f:\mathcal{X}\to\mathcal{Y}$1, Answer $f:\mathcal{X}\to\mathcal{Y}$2, and Question $f:\mathcal{X}\to\mathcal{Y}$3. Replacing image features with noise causes less than $f:\mathcal{X}\to\mathcal{Y}$4 degradation, question randomization causes a $f:\mathcal{X}\to\mathcal{Y}$5 drop at $f:\mathcal{X}\to\mathcal{Y}$6, answer randomization causes less than $f:\mathcal{X}\to\mathcal{Y}$7, and negation causes less than $f:\mathcal{X}\to\mathcal{Y}$8, whereas destroying the caption drives performance near chance. The reported interpretation is that the Q-bot mostly relies on the initial caption, uses dialog only marginally, and rarely uses the image (Mironenco et al., 2017).

Counterfactual explanation methods in NLP also operationalize black-box interaction through perturbation. Transparent methods modify text directly by adding, removing, or replacing words, expressed as $f:\mathcal{X}\to\mathcal{Y}$9, while opaque methods perturb a latent non-interpretable representation, $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$0. On fake news detection, sentiment analysis, and spam detection, evaluation uses minimality, plausibility, label flip rate, and runtime. The reported result is that opaque approaches add an additional level of complexity with no significant performance gain, and transparent or partially transparent methods generally produce more minimal, plausible, and interpretable counterfactuals (Delaunay et al., 2024). This creates an explicit controversy within black-box interaction research: whether it makes sense to explain a black box using another black box.

A more user-facing perturbational protocol appears in interaction-based xAI for image classification. A web-based prototype built with React and FastAPI exposes a ResNet-50 pretrained on ImageNet through painting and erasing operations on an image. The backend evaluates masked images through

$H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$1

Across five images—golden retriever, soccer ball, coffee mug, bakery, and cinema—users iteratively mask and unmask regions and observe class and confidence shifts. In the coffee mug case, keeping only the mug raises confidence for "coffee mug" to $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$2, while removing the handle changes the label to "pill bottle" with confidence $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$3; in the golden retriever case, masking the background preserves the class with confidence $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$4, while keeping only the face changes the class to "labrador retriever" with confidence $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$5 (Yun, 2024). The method is explicitly framed as enabling users to probe the black box through controlled perturbations rather than passively reading static heatmaps.

Interactive exploration can also be global rather than instance-local. BETA learns two-level decision sets that jointly optimize fidelity, interpretability, and unambiguity, and it allows users to specify features or feature values so that explanations focus on subspaces of interest. In user studies, BETA yields $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$6 human accuracy with average time $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$7 seconds, compared with $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$8 and $H_{t-1} = (x^1, y^1, \ldots, x^{t-1}, y^{t-1})$9 for IDS and $x^t = M(H_{t-1})$0 and $x^t = M(H_{t-1})$1 for BDL; its interactive version reaches $x^t = M(H_{t-1})$2 accuracy with $x^t = M(H_{t-1})$3 seconds (Lakkaraju et al., 2017). Here the interaction lies not in perturbing the model’s raw input, but in constraining the explanatory region of feature space.

Adversarial querying extends perturbation from explanation to attack. BlackCAtt treats the object detector as a complete black box and identifies minimal, causally sufficient pixel sets (MSPS) using black-box explainability. Many MSPSs extend beyond the predicted bounding box, with over $x^t = M(H_{t-1})$4 not fully contained by the box. On the COCO test dataset, the approach is reported as $x^t = M(H_{t-1})$5 times better than the baseline in removing a detection, $x^t = M(H_{t-1})$6 times better in changing a detection, and $x^t = M(H_{t-1})$7 times better in triggering new, spurious, detections (Navaratnarajah et al., 3 Dec 2025). This is still black-box interaction in the strict sense: query the detector, observe detections, infer causal pixels, and then act only through the query interface.

3. Interaction structure, regional behavior, and higher-order explanations

A second major research line studies not merely whether the black box changes under perturbation, but how its behavior depends on interactions among features or regions. VINE defines a statistical interaction effect for features $x^t = M(H_{t-1})$8 and $x^t = M(H_{t-1})$9 by

$f(x)$0

searches for statistically significant interactions through black-box queries, clusters regions of the feature space exhibiting strong interactions, and visualizes them through a dashboard of small multiples and drill-down regional explanations (Britton, 2019). The paper’s stated motivation is that global and local explanations leave a gap at the regional level: how groups of similar instances behave and where interactions are strongest.

Directional explanations push this further by treating pairwise interactions as asymmetric. For a utility function $f(x)$1, the bivariate explanation map $f(x)$2 is defined through filtered utilities $f(x)$3, and the bivariate Shapley extension yields a matrix $f(x)$4 that is not symmetric in general. This matrix defines a weighted directed graph in which sinks correspond to the most influential features, sources to the least influential ones, and strongly connected components in the redundancy graph identify mutually redundant or interchangeable feature groups (Masoomi et al., 2023). The approach is evaluated on CIFAR10, IMDB, Census, Divorce, Drug, and gene data, with the claim that the directional method is superior to state-of-the-art approaches that are symmetric and therefore miss directional effects (Masoomi et al., 2023).

In recommender systems, interaction discovery is tied directly to model augmentation. A source black-box recommender is probed through LIME-style perturbations, a lasso-regularized MLP is fitted, and Neural Interaction Detection (NID) extracts feature interactions from shared hidden units. These interactions are then encoded as explicit cross features in a target black-box recommender. On ad-click prediction, the reported Criteo AUC for DeepFM rises from $f(x)$5 to $f(x)$6, and the Wide model rises from $f(x)$7 to $f(x)$8; corresponding log-loss values improve from $f(x)$9 to $\pi_0(\tau)$0 for DeepFM and from $\pi_0(\tau)$1 to $\pi_0(\tau)$2 for Wide (Tsang et al., 2020). The paper emphasizes that the discovered interactions are both informative and predictive, and that the same methodology transfers to text, image, DNA sequence, and graph classification.

These works collectively treat black-box interaction as a route to latent structure. Instead of asking only which single features matter, they ask where joint effects emerge, whether those effects are symmetric or directional, and whether the discovered interactions can be rendered operational in downstream models. A plausible implication is that black-box interaction has become a bridge between explanation and representation engineering.

4. Learning through black-box interfaces and hybrid predictive systems

Black-box interaction is not limited to post hoc analysis. It can be used to train neural systems around precise external functions. In "Estimate and Replace," the target task $\pi_0(\tau)$3 is assumed to factor through a black-box function $\pi_0(\tau)$4 and learned argument extractors $\pi_0(\tau)$5, so that

$\pi_0(\tau)$6

Training uses a differentiable estimator $\pi_0(\tau)$7 as a proxy, with offline, online, and hybrid modes for generating black-box training pairs by querying the exact function as an oracle. At inference, the estimator is replaced by the precise black-box function. The paper reports better generalization than a fully differentiable model and more efficient learning than RL-based methods, while also highlighting confidence regularization through entropy regularization and label smoothing to prevent vanishing gradients from over-confident proxies (Jacovi et al., 2019).

Partially Interpretable Estimators (PIE) pursue a different interface design. Predictions are decomposed into an interpretable additive component and a residual black-box interaction term: $\pi_0(\tau)$8 The $\pi_0(\tau)$9 terms are estimated through a sparse generalized additive model, while $z \sim \mathrm{Uniform}(0,1)$0 is estimated by gradient-boosted regression trees. Training alternates between updating the additive model with the current crust fixed and updating the crust on residuals. The $z \sim \mathrm{Uniform}(0,1)$1-score,

$z \sim \mathrm{Uniform}(0,1)$2

quantifies how much predictive variance is explained by the interpretable part. The reported human evaluation states that PIE is almost as easy to understand as linear models when the crust value is a small fraction, for example $z \sim \mathrm{Uniform}(0,1)$3 of prediction, whereas larger crust values such as $z \sim \mathrm{Uniform}(0,1)$4 reduce trust and understanding (Wang et al., 2021).

These two directions formalize different answers to the same question: how should a learning system relate to an opaque but useful component? "Estimate and Replace" preserves exact external functionality by learning to satisfy an interface; PIE preserves interpretability by isolating a residual interaction term and making its magnitude explicit. In both cases, black-box interaction is not merely observational. It is architectural.

5. LLMs, agents, and black-box control under restricted access

The recent LLM literature has turned black-box interaction into a central evaluation and control problem. The \textsc{Oracle} benchmark defines black-box interaction as an evaluation paradigm for advanced reasoning in unknown environments. It contains 6 types of black-box task and 96 black-boxes, with 19 modern LLMs benchmarked. The six task types are Code Intent Inference, Circuit Rule Inference, Physics System Inference, Encryption Rule Inference, Interactive Puzzle Inference, and Game Strategy Inference. The reported headline result is that o3 ranks first in 5 of the 6 tasks, achieves over $z \sim \mathrm{Uniform}(0,1)$5 accuracy on most easy black-boxes, but drops below $z \sim \mathrm{Uniform}(0,1)$6 on some hard tasks; the paper’s analysis identifies a universal difficulty among LLMs in developing efficient and adaptive exploration strategies for hypothesis refinement (Yin et al., 26 Aug 2025).

Matryoshka addresses the control side of the same access constraint. A lightweight white-box LLM controller produces intermediate guidance for a large-scale black-box LLM generator, treating the generator as an environment and the controller as a policy. The controller is warmed up with supervised fine-tuning and then optimized by a DPO-style objective over good and bad guidance trajectories. Reported results include up to $z \sim \mathrm{Uniform}(0,1)$7 improvement in BLEU on LaMP headline generation, $z \sim \mathrm{Uniform}(0,1)$8 accuracy/F1 gains on LaMP classification, $z \sim \mathrm{Uniform}(0,1)$9 accuracy on GSM8K, and $p$0 success rate on ALFWorld (Li et al., 2024). The paper also reports plug-and-play transfer: a controller trained with one black-box LLM can improve other black-box LLMs without retraining.

Agentic Monte Carlo (AMC) replaces parameter updates with posterior sampling over trajectories. Starting from the KL-regularized RL objective, the optimal policy is written as

$p$1

where $p$2 is the fixed black-box LLM agent. AMC uses Sequential Monte Carlo, guided by a learned value function, to sample from this posterior without changing the underlying black-box model. In WebShop on GPT-4.1-mini, the reported scores are ReAct $p$3, Best-of-15 $p$4, and AMC $p$5; on Llama-3.2-11B they are $p$6, $p$7, and $p$8. In TextCraft on Llama-3.2-11B, ReAct is $p$9, Best-of-15 $p$0, and AMC $p$1 (Hwang et al., 3 Jun 2026). The method is explicitly presented as principled RL-style optimization of black-box LLM agents at test time.

Uncertainty estimation under black-box access has likewise become interactive. DiverseAgentEntropy generates a set of varied questions about the same original query, assigns them to multiple agents instantiated from the same LLM, and then runs one-on-one interaction rounds in which agents may revise or abstain. Final uncertainty is computed as entropy over the weighted answer distribution,

$p$2

with weights determined by answer stability across rounds (Feng et al., 2024). The paper reports higher AUROC than self-consistency and graph-based baselines, higher selective accuracy under abstention, and stronger hallucination detection. Its underlying claim is that consistency on the original query alone does not reliably measure certainty.

Alignment and meta-learning research use related patterns. CycleAlign iteratively distills alignment from a black-box LLM to a white-box model through in-context ranking, agreement-based pseudo-labels, and ranking-based supervised fine-tuning; on a LLaMA-7B backbone, CycleAlign+RRHF achieves $p$3 points over standard RRHF (Hong et al., 2023). In black-box meta reinforcement learning, the policy and learning algorithm are jointly encoded in a recurrent network, $p$4; incorporating symmetries such as parameter sharing and permutation invariance in SymLA improves generalisation to unseen action and observation spaces, tasks, and environments (Kirsch et al., 2021). These results suggest that restricted-access interaction is now a primary design condition, not just a deployment inconvenience.

6. Non-invasive interaction, persistent theories, and methodological limits

The most stringent form of black-box interaction seeks information while minimizing disturbance. In quantum interaction-free measurement, the task is to detect whether a given blackbox interacts with input states or not, with negligible distortion of the blackbox and high detection probability. The paper proves an optimality statement using the adversary method: for any protocol,

$p$5

so the detection-disturbance tradeoff is essentially tight in the stated setting (Matsumoto, 2016). The same work also gives a protocol for identifying unitary operations from a finite family with arbitrarily high probability and no effect on the input state. This is a limit case of black-box interaction in which the interface must be informative yet non-invasive.

At the opposite end of the lifecycle, SToBB reframes black-box interaction as the maintenance of a persistent explanatory record. A Scientific Theory of a Black-Box is grounded in three obligations: empirical adequacy with respect to all available observations of black-box behaviour, adaptability via explicit update commitments that restore adequacy when new observations arrive, and auditability through transparent documentation of assumptions, construction choices, and update behaviour. The framework specifies an extensible observation base, a traceable hypothesis class, algorithmic components for construction and revision, and query interfaces for different stakeholders. Its proof-of-concept algorithm, CoBoT, maintains an empirically adequate rule-based surrogate online as observations accumulate (Müller et al., 2 Feb 2026). In this formulation, explanations are not isolated outputs of a method but queries against a maintained record.

Several methodological limits recur across the literature. One is that high task performance can mask irrelevance of supposedly critical modalities, as in visual dialog where the caption dominates and image/dialog contributions are small (Mironenco et al., 2017). Another is that complex explanation machinery may add opacity without commensurate gains, as in latent-space counterfactual generation for NLP (Delaunay et al., 2024). A third is that even strong LLMs struggle to transform feedback into adaptive exploration plans in unknown black-box environments (Yin et al., 26 Aug 2025). A plausible implication is that future black-box interaction research will be judged less by whether it can query an opaque system and more by whether it can maintain faithful, auditable, and strategically useful theories of what those queries reveal.