Pretty simple question. At the moment 99.999% of new coins tokens and crypto project all have a telegram group (full spam and bounty hunters) , a twitter account that only posts pre-made bullish news about their own coin, a subreddit with 20 subscribers and 5 bots, a Facebook page full of 3rd world country princes asking for your eth private key.
What is left to judge a product? Only their website. But how accurate and trustworthy can a website be? White paper too aren't to be trusted, since 90% of the time they get changed work-in-progress.
What metrics do you use?
I see your point, though the quality of a particular token or project is a lot more different after the end of a Campaign and you can be sure that most of them are indeed a great project or not after the ICO and mostly, after the token hits the market. Having said that, the most important thing is to verify first their credibility, their tokens and the project's potential by examining the activeness of their team developers and their road map. You said it yourself that we cannot rely on their whitepaper and their websites because it changes from time to time and from the fact that there are fraud schemes everywhere.