How does Spring annotation @Autowired work?

Java allows access controls on a field or method to be turned off (yes, there's a security check to pass first) via the AccessibleObject.setAccessible() method which is part of the reflection framework (both Field and Method inherit from AccessibleObject). Once the field can be discovered and written to, it's pretty trivial to do the rest of it; merely a Simple Matter Of Programming.

Java allows you to interact with private members of a class via reflection.

Check out ReflectionTestUtils, which is very handy for writing unit tests.